North Korean Hackers Stole $400 Million Through Fake Video Calls, FBI Says

1. North Korean hackers took over $400 million in crypto in 18 months through fake video calls, the FBI says.

2. The calls replayed secret recordings of earlier victims, then used a fake audio glitch to plant malware.

3. The Justice Department also secured court orders covering $1.2 billion stolen in the Binance hack.

North Korean hackers stole over $400 million in cryptocurrency during the past 18 months through fake video calls that appeared to include the victims’ own friends and colleagues, the FBI said Nov. 12. The familiar faces on screen were secretly recorded footage of earlier victims, and a staged audio problem then tricked each new target into installing malware.

The Justice Department said it had seized the cloud servers behind the scheme, which the FBI calls FaceStealer, along with over 900 recorded webcam videos of victims.

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” said Patrick Grandy, head of the FBI’s Los Angeles office.

The department also moved against the proceeds of the Binance hack, announcing court orders that let it seize or freeze over $1.2 billion in cryptocurrency stolen from the exchange on Oct. 29. U.S. agencies and private firms have now frozen over $2.7 billion in stolen crypto, more than 40% of the roughly $6.3 billion Binance says it lost.

How the Scheme Worked

The hackers sent meeting invitations from messaging and social media accounts they had taken over from earlier victims, steering targets to fake copies of Google Meet, Zoom and Microsoft Teams. Once a target joined, the hackers recorded their webcam while playing prerecorded clips of friends or colleagues, so the call appeared to include people the target trusted. They also used deepfakes of well-known figures in the crypto industry, made with what the department called “super intelligence,” the same term federal prosecutors in Manhattan used Nov. 5 in a $129 million deepfake fraud case .

A few moments in, the target would be told they could not be heard and offered a link to fix the problem. The link installed malware that let the hackers drain cryptocurrency, reach other systems and pull the victim’s lists to pick the targets. In several cases, the hackers waited months, and sometimes over a year, between infecting a device and stealing from it.

The hackers mainly target people in cryptocurrency and Web3, the industry building blockchain-based services. They have also increasingly targeted open-source software maintainers, which the department said “appears calculated to enable software supply-chain attacks.” The FBI tied the scheme to a North Korean group known by names including Sapphire Sleet, BlueNoroff and APT38.

The FBI blames the Binance theft on a different unit, North Korean military hackers it calls TraderTraitor, who it says took more than $6 billion from the exchange. Binance has said the attackers behind the largest crypto heist on record got in through a fake job interview , which SOFX reported earlier this month.

What Officials Are Saying: “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, the department’s principal deputy assistant attorney general for national security.

What’s : The department said it is still tracing the Binance assets and working to freeze and forfeit them as TraderTraitor moves funds through crypto bridges, mixers and exchanges. In forfeiture cases, a judge typically decides who is entitled to recovered funds. The FBI has published a guide to the FaceStealer scheme with steps for potential victims.

U.S. Department of Justice, Office of Public Affairs, “Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency,” Nov. 12, 2026

The Associated Press (via ABC News), “US has seized $1.2 billion worth of cryptocurrency stolen from Binance, FBI says,” Nov. 12, 2026

FBI, “FaceStealer Cryptocurrency Theft Scheme” — FBI guidance page

Stay Ahead of Global Conflict, Security, and Technology.

Get the #1 daily intel report for decision-makers on global conflict, security, and technology. Over 72,000 leaders trust The SOFX Report to deliver apolitical, fact-based news on issues impacting their lives.