Securityaffairs

North Korean Hackers Steal $400M via Deepfake Video Calls

First seen 13 Nov 2026, 23:47 UTC • •76.3

Article Content

1 / 3

Browse articles

ThreatCluster •November 13, 2026 at 23:48 UTC

•North Korean hackers have stolen $400 million using deepfake video calls.
•The FBI warns that the scheme is ongoing and primarily targets individual cryptocurrency users.
•Users are advised to establish verification methods beyond video calls to prevent fraud.

The FBI issued a warning about North Korean hackers using deepfake technology to steal $400 million in cryptocurrency. The hackers compromise legitimate accounts to obtain webcam footage, which they then use to create realistic deepfake videos impersonating the account owners. This social engineering scheme involves fake video calls to gain trust before stealing digital assets. The FBI's Internet Crime Complaint Center (IC3) confirmed that this operation is ongoing, indicating potential for further losses. The FBI recommends that cryptocurrency users implement verification methods beyond video calls to prevent falling victim to these scams. The total amount stolen through this scheme is reported to be $400 million, primarily targeting individual account holders rather than centralized exchanges. The FBI's alert highlights the sophistication of the attack, which leverages advanced AI tools for deepfake creation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-11-13

FBI issues warning about deepfake scheme

The FBI alerted the public about North Korean hackers using deepfake technology to steal $400 million in cryptocurrency through social engineering.

Onebullex

2026-11-13

DOJ seizes $1.2 billion from North Korea

The DOJ announced the seizure of over $1.2 billion related to North Korea's cryptocurrency theft operations, including the FaceStealer scheme.

Securityaffairs

Threat Graph

9 entities, 18 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

APT38
BlueNoroff
Sapphire Sleet

Technique (4)

Malware
Phishing
T1566.002 - Spearphishing Link
T1566 - Phishing

Campaign (1)

FaceStealer

Organization (1)

Binance

Relationships

APT38 uses Malware
APT38 uses Phishing
APT38 uses T1566.002 - Spearphishing Link
APT38 uses T1566 - Phishing
BlueNoroff uses Malware
BlueNoroff uses Phishing
BlueNoroff uses T1566.002 - Spearphishing Link
BlueNoroff uses T1566 - Phishing
Sapphire Sleet uses Malware
Sapphire Sleet uses Phishing
Sapphire Sleet uses T1566.002 - Spearphishing Link
Sapphire Sleet uses T1566 - Phishing
FaceStealer attributed to APT38
FaceStealer attributed to BlueNoroff
FaceStealer attributed to Sapphire Sleet
APT38 targets Binance
BlueNoroff targets Binance
Sapphire Sleet targets Binance

Following this threat?

Track APT38 and Binance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

How are the hackers operating?

The hackers compromise legitimate accounts to steal webcam footage, then use deepfake technology to impersonate account owners in video calls.

What is the total amount stolen?

The total amount reported stolen through this deepfake scheme is $400 million.

What should users do to protect themselves?

Users should implement verification methods that do not rely solely on video calls, such as confirming requests through separate communication channels.