The FBI has disrupted a North Korean hacking campaign that used fake video calls — and increasingly, AI-generated deepfakes — to steal more than $400 million in cryptocurrency over the past 18 months.
The scheme, which the bureau calls "FaceStealer," targeted people working in cryptocurrency and Web3, along with developers who maintain widely used open-source software. The Justice Department announced the takedown on Thursday, alongside court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from the exchange Binance in a separate, larger heist last month.
A familiar face on a fake call
FaceStealer worked by exploiting trust. Hackers sent meeting invitations from accounts stolen from earlier victims, luring targets onto imposter versions of Zoom, Microsoft Teams and Google Meet. Once the target joined, the attackers played a prerecorded webcam video of someone the target knew — or, increasingly, a deepfake video of a well-known figure in the crypto industry.
Midway through the call, the attackers would introduce a fake audio problem and offer a "fix." Clicking it installed malware designed to steal cryptocurrency, and harvested the victim's contact list so the scam could spread to the next target. The FBI said the scheme was capable of deceiving "even the most experienced technical and security conscious computer user."
Agents seized the cloud infrastructure used to run the operation and recovered more than 900 webcam videos of victims under a federal warrant. The bureau also published a detailed report on how the scheme works and opened a public information hub at fbi.gov/facestealer.
A supply-chain angle, and a separate $1.2 billion seizure
The campaign went beyond crypto theft. The FBI said the hackers also targeted people who maintain open-source software, in what appeared to be an effort to reach the software supply chain. In one case, attackers broke into a developer's computer and added malicious code to software used by others; the intrusion was detected and stopped before it spread widely.
The FBI attributed FaceStealer to a North Korean cluster tracked as Sapphire Sleet, also known as UNC1069, APT38 and BlueNoroff — a group widely regarded as an offshoot of the Lazarus Group.
Separately, the Justice Department said it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance on October 29, when attackers took roughly $6.3 billion from the exchange. Authorities and private partners have now frozen more than $2.7 billion of that haul — about half of it. The FBI attributed the Binance attack to TraderTraitor, a separate North Korean military-linked operation.
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said Brett Leatherman, the FBI's Cyber Branch operations director. "North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics."
The bureau said the takedown was part of a broader effort to impose costs on North Korean actors targeting the virtual-asset community — and warned that deepfake impersonation is making these scams harder to spot, and easier to scale.
