North Korea FaceStealer Hackers Stole $400m: FBI
North Korea FaceStealer hackers stole more than $400 million in cryptocurrency using fake video calls and AI-powered deepfakes, the FBI said on Thursday.
The scheme, which the FBI calls FaceStealer, ran for 18 months and targeted people in the cryptocurrency and Web3 sectors. A familiar face on a video call turned out to be a recording, and a routine request to fix a sound problem turned out to be malware.
The disclosure came in a coordinated US Department of Justice announcement, which also moved to seize more than $1.2 billion in cryptocurrency stolen from the Binance exchange. The FBI has blamed North Korean hackers for that theft as well, a charge Pyongyang denies.
How North Korea FaceStealer hackers run the trap
FaceStealer starts with a meeting invitation sent from an account stolen from an earlier victim. The target joins what looks like a normal video call, on a fake version of Zoom, Microsoft Teams or Google Meet.
Once the target joins, the hackers play a prerecorded video of a previous victim the target knows. The familiar face on screen makes the call feel real. The FBI said the hackers have also started using AI deepfakes of well-known people in the crypto and Web3 industries to make the trick more convincing.
Then comes the hook: a fake technical error, such as telling the target they cannot be heard, followed by a link or prompt to fix it. The fix installs malware on the target’s computer.
After that, the hackers raid the victim’s contact lists, social media and messaging apps, and use them to impersonate the victim and lure the next target into the same trap.
“FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” said Patrick Grandy, assistant director at the FBI’s Los Angeles Field Office.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.
FBI seizes 900 victim videos and disrupts the network
The FBI said it seized more than 900 webcam videos of FaceStealer victims under a federal warrant. The bureau says the videos were recorded during the fake calls and used to impersonate victims in later attacks.
US prosecutors in the Central District of California also disrupted the cloud-based infrastructure behind the scheme. The Justice Department said the hackers behind FaceStealer are tracked under names including Sapphire Sleet, UNC1069, BlueNoroff, APT38, CryptoCore and Stardust Chollima.
“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” said FBI Cyber Branch Operations Director Brett Leatherman.
The bureau has also warned that the same groups have targeted developers who maintain widely used open-source software, which widens the risk beyond crypto traders to the software supply chain itself.
Why this matters for Pakistan
Pakistan has a large community of crypto users, freelancers and remote workers, and many of them live on video calls. FaceStealer is built for exactly that routine. Its victims are experienced technical people who joined a call with someone they trusted and clicked a link to fix a sound problem.
The FBI has published a technical report on the scheme, with warning signs for people who think they may have been targeted.
The disclosure lands alongside the Binance case, in which North Korean hackers stole $6.3 billion in late October, according to Binance. US authorities say they have frozen more than $2.7 billion of it, and a court has authorised the seizure of over $1.2 billion.
North Korea has been linked to a $6.3 billion Binance heist in earlier reporting, and the FBI has previously blamed North Korean hackers for the Binance attack. Pakistan’s own cyber threats report counted 326 attacks in a year, which shows the same risks are already present at home.
Frequently asked questions
What is FaceStealer?
FaceStealer is a scheme run by North Korean state-backed hackers. It uses fake video meetings and prerecorded video of trusted contacts, plus AI deepfakes, to trick victims into installing malware.
How much did the hackers steal?
The FBI said the scheme stole more than $400 million in cryptocurrency over 18 months, and the bureau seized more than 900 webcam videos of victims.
How does the scam work?
Hackers send an invitation from a stolen account, play a recording of a familiar face on a fake Zoom or Teams call, then claim a technical error and send a link that installs malware.
Who is behind FaceStealer?
The FBI attributes it to a North Korean hacking cluster known as Sapphire Sleet, also tracked as UNC1069. The US Justice Department disrupted the cloud infrastructure behind it.
