North Korean Hackers Steal $400 Million Using Fake Video Calls
FBI says over 900 crypto workers fell for the FaceStealer scheme in the last year and a half.
By Aiko Soto ·
North Korean hackers have stolen more than $400 million in cryptocurrency by tricking victims into joining fake video calls. US authorities say the operation, known as FaceStealer, targeted more than 900 people over the past 18 months.
The FBI and the US Department of Justice detailed the scheme on Thursday. Investigators found that hackers used fake or hijacked social media accounts to invite targets into video meetings. These meetings were hosted on imposter versions of Zoom, Microsoft Teams, and Google Meet.
Once connected, the hackers played pre-recorded videos of people the victim already knew. The audio in these calls was designed to appear broken. A message then popped up on the screen, asking the user to click a link to fix the sound. That link downloaded malware, giving hackers access to the victim's contacts and applications.
The attackers then recorded these calls. They used the new recordings to deceive additional victims. This cycle expanded the pool of targets rapidly. The FBI described FaceStealer as a highly effective social engineering scheme. They noted it could fool even experienced security professionals.
Brett Leatherman, the FBI cyber director, explained the financial motive. He stated that the North Korean regime uses proceeds from large-scale cryptocurrency theft to fund its illicit weapons program. He added that the group has stolen billions of dollars in recent years.
This disclosure comes one week after Binance, the world's largest crypto exchange, reported a massive breach. Binance said hackers stole a record $6.3 billion using fake job interviews. US law enforcement attributed that hack to North Korea-linked actors, though Pyongyang denied the claim.
Authorities say FaceStealer specifically targets those in the cryptocurrency and web3 sectors. It focuses heavily on individuals involved in developing and maintaining open-source software. Patrick Grandy, assistant director of the FBI's Los Angeles field office, said the scheme exploits trust in common video platforms and personal relationships. He warned that if you cannot imagine how you might fall for it, you are not thinking creatively enough.
