Skip to content
FaceStealer Scheme: North Korean Hackers Steal $400 Million in Cryptocurrency

FaceStealer Scheme: North Korean Hackers Steal $400 Million in Cryptocurrency

First seen 13 Nov 2026, 21:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 13, 2026 at 21:48 UTC
  • •North Korean hackers stole over $400 million in cryptocurrency via the FaceStealer scheme.
  • •The operation uses AI-powered deepfake video calls to impersonate victims' contacts.
  • •The FBI has seized over 900 webcam videos related to the scheme.

The FBI has reported that North Korean state-sponsored hackers have stolen over $400 million in cryptocurrency through a scheme known as 'FaceStealer'. This operation involves social engineering tactics, including AI-powered deepfake video calls, where hackers impersonate trusted contacts of victims. They create fake technical issues during these calls, tricking victims into downloading malware that compromises their devices. The scheme has affected over 900 individuals in the cryptocurrency and Web3 sectors. The FBI has seized a significant number of webcam videos linked to the victims, indicating the scale of the operation. The FBI's disruption of the hackers' infrastructure marks a significant step in combating this threat. The stolen funds are believed to be used to finance North Korea's weapons development programs.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-11-13
FBI disrupts FaceStealer infrastructure
The FBI announced the disruption of the infrastructure used by North Korean hackers in the FaceStealer cryptocurrency theft scheme.
Fbi

More articles in this cluster (3)

Following this threat?

Track BlueNoroff in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

Who are the primary targets of the FaceStealer scheme?
The primary targets are individuals in the cryptocurrency and Web3 industries, including developers and executives.
How do the hackers execute their attacks?
Hackers impersonate trusted contacts through deepfake video calls and create fake technical issues to trick victims into downloading malware.
What steps can I take to protect myself?
Be cautious of unexpected video calls, verify identities through alternative means, and ensure your devices have updated security software.