North Korean hackers stole $400m in crypto via fake video calls, FBI says

How the scam works

The FBI calls the operation FaceStealer. Hackers send meeting invitations from social media and messaging accounts they took over from earlier victims, then lure targets into calls hosted on imposter versions of Zoom, Microsoft Teams and Google Meet. Once a target joins, the hackers play prerecorded webcam footage of previous victims whom the target knows, so the call looks genuine, while the target's own webcam is secretly recorded. A staged technical fault follows, and the target is asked to click a link to 'fix' it, which installs malware, the Justice Department said. In some cases the hackers waited months, or more than a year, before taking funds. Access gained through compromised devices then exposes contact lists and apps, which supply the next round of targets.

Most targets work in crypto and other internet-related fields. The FBI says the hackers have increasingly gone after open-source software developers and maintainers, whose device and software repository accounts can be used to compromise software supply chains. The bureau also says the group has started using artificial intelligence to build deepfakes of well-known figures in crypto and blockchain, which makes the impersonation more convincing. Brett Leatherman, assistant director of the FBI's cyber division, described the approach as a blend of tools.

“North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.”

Seizures and the Binance link

Authorities say they disrupted the cloud infrastructure the hackers used and seized more than 900 webcam videos of victims under a federal warrant. Patrick Grandy, who heads the FBI's Los Angeles field office, warned that anyone could be caught out by the scheme.

“If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”

Separately, the Justice Department has joined the two largest stablecoin issuers in efforts to secure almost half of the money taken in the Binance hack, according to Bloomberg. The department obtained court authorization to seize or restrain $1.2 billion, while US agencies and private firms have frozen more than $2.7 billion in total. On 12 November Bloomberg reported that Binance said it had covered all $6.3 billion in crypto assets taken from customers in the incident of 29 October.

Stolen (AP figure)6.3

Frozen by US agencies and private firms2.7

Court-authorized seizure or restraint1.2

Stolen (AP figure)

6.3 USD billion

Frozen by US agencies and private firms

2.7 USD billion

Court-authorized seizure or restraint

1.2 USD billion

Data from the article text

Attribution and Pyongyang's response

The FBI ties FaceStealer to Sapphire Sleet, which it describes as an offshoot of the Lazarus group and which is also known as UNC1069, Stardust Chollima, APT38 and BlueNoroff. The Binance theft is a separate matter: the FBI attributes it to a group called TraderTraitor, which it says took more than $6 billion on or around 29 October. Deutsche Welle reports that the Binance theft is blamed on North Korean military hackers, distinct from the Sapphire Sleet cluster. AP called it the biggest crypto heist on record.

Pyongyang has denied the US accusations. Kim Yo Jong, sister of Kim Jong-un, reportedly dismissed the claims as absurd rhetoric meant to portray North Korea as a cybercriminal state, and called them a serious political provocation against her country.

What comes next

The FBI says it will keep exposing and disrupting North Korean hacking activity and raising the cost of those operations. The bureau argues that the regime depends on crypto theft to fund its weapons programs. For the frozen funds, authorities usually file a forfeiture claim in court, and a judge then rules on who holds a legitimate claim to the recovered money.