FBI says North Korean hackers stole over $400M in crypto via fake video calls

The FBI has revealed that hackers working on behalf of the North Korean state have taken more than $400 million in cryptocurrency through fake video calls, according to the BBC. The bureau calls the scheme FaceStealer and says it has claimed more than 900 victims over the past 18 months.

Alongside the announcement, the FBI released redacted samples of the victim recordings the attackers secretly collected during their calls.

How the scheme works

According to the FBI and the US Justice Department, FaceStealer concentrates on people working in the cryptocurrency and web3 sectors, above all those who build or maintain open-source software.

The attack begins with an invitation. Operators using fake or hijacked social media accounts lure a target into a video call hosted on counterfeit replicas of familiar conferencing services such as Zoom, Microsoft Teams and Google Meet. Once the target joins, the attackers play pre-recorded footage of people the target personally knows — material captured from earlier victims — to imitate a real conversation, while the audio deliberately appears to malfunction.

A pop-up then urges the target to repair the sound by clicking a link, which installs malware on the device. The FBI says the implant gives the attackers access to the victim's contact lists and apps, which both exposes their holdings and seeds the next wave of targets. Each call is also recorded, and those recordings become the raw material for deceiving the victim's own colleagues and friends.

A wider pattern of crypto theft

The disclosure landed a week after Binance, the world's largest cryptocurrency exchange, said attackers used fake job interviews to steal a record $6.3 billion from the company. US law enforcement attributed that incident, believed to be the largest cryptocurrency theft on record, to actors linked to North Korea. Pyongyang denies the accusation.

Brett Leatherman, the FBI's cyber director, said the North Korean regime depends on proceeds from large-scale cryptocurrency theft to fund its illicit weapons programmes and has taken billions of dollars in recent years.

The bureau describes FaceStealer as a social engineering campaign capable of deceiving even highly technical and security-conscious users. Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said it exploits trust in everyday video conferencing platforms and in valued personal relationships. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," he said.

Why it matters

The campaign shows that the weakest point in cryptocurrency security is often not a buggy wallet or exchange, but the human on the call. FaceStealer requires no software vulnerability in Zoom, Teams or Meet — it substitutes convincing copies of them — so patching alone offers no defence, and even experienced engineers have reportedly been taken in.

The choice of targets raises the stakes further. By focusing on open-source developers and maintainers, the attackers position themselves where a single compromise can cascade: access to one maintainer's machine can open the door to tampered code, hijacked repositories and downstream breaches across the software ecosystem.

For anyone working in crypto, web3 or open source, the practical lessons from the FBI's account are clear: treat unexpected meeting invitations with suspicion, join calls only through official apps and verified links, and regard any in-call prompt asking you to click a link to fix the audio as a warning sign rather than a nuisance.