The Federal Bureau of Investigation (FBI) has stated that state-sponsored hackers from North Korea used a deceptive scheme called 'FaceStealer' to steal more than $400 million in cryptocurrency between the last 18 months.
How FaceStealer Works
Hackers use fake or hijacked social media accounts to invite targets into video calls hosted through imposter versions of Zoom, Microsoft Teams, and Google Meet. During these sessions, they play pre-recorded videos of people known to the target — such as friends or colleagues — to create a sense of authenticity.
The audio during the call appears to malfunction, prompting the user to click on a message that reads: "Fix" the issue by clicking a link. That action downloads malware onto their device, allowing attackers access to contact lists and installed applications, expanding their network of potential victims.
Victim Numbers and Targeting
FBI data indicates over 900 individuals have been targeted in this scheme since its emergence. The attacks specifically focus on professionals working within cryptocurrency and web3 sectors, particularly those involved in open-source software development or maintenance.
Official Statements
Brett Leatherman, FBI cyber director, said North Korea's regime uses proceeds from large-scale crypto thefts to fund its illicit weapons programs. He added that such activities represent a significant threat to global financial security.
Patrick Grandy, assistant director at the FBI’s Los Angeles field office, emphasized how effective FaceStealer is: "It exploits our trust in ubiquitous video conference platforms and valued personal relationships.", he stated in an official release on Thursday. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
FBI Redaction of Evidence
The FBI has redacted examples of videos secretly recorded during these attacks — footage captured from actual sessions with victims — which were used by hackers as part of their scam operations.
These findings come one week after Binance revealed that North Korean-linked actors had exploited fake job interviews to steal $6.3 billion from the exchange — widely considered the largest crypto hack ever reported. While Binance attributed this breach to North Korea-connected groups, Pyongyang has denied involvement in both incidents.
All information presented here is based on publicly available reports and statements issued by US law enforcement agencies through official channels. The FBI has not independently verified or confirmed all claims made about specific individuals or organizations involved; such attributions are drawn directly from agency disclosures.