FBI confirms theft of more than $400 million in crypto by North Korean hackers using deepfake video calls
The FBI identified a social engineering scheme, called FaceStealer, that allegedly stole more than $400 million in cryptocurrencies using fake video calls, attributed to the North Korean group BlueNoroff.
The United States Federal Bureau of Investigation (FBI) disclosed that threat actors linked to the Democratic People's Republic of Korea (DPRK) stole over US$ 400 million in cryptocurrencies over the past 18 months. The attack, dubbed FaceStealer, combines advanced social engineering with deepfake videos to deceive victims in the crypto and Web3 sectors.
FBI and DOJ Investigation
In an official statement, the FBI attributed the crime to the North Korean hacker group known as BlueNoroff – also referenced by the names APT38, CageyChameleon, CryptoCore, among others. The agency stated that the cloud-based infrastructure used for the campaign was seized as part of a coordinated set of actions announced by the US government.
In parallel, the Department of Justice (DoJ) reported the judicial seizure of over US$ 1.2 billion in cryptocurrencies linked to the TraderTraitor group, which allegedly acted following the attack on the Binance exchange. According to the DoJ, the stolen funds are intended to finance Pyongyang's illicit weapons program.
How the FaceStealer Scheme Works
FaceStealer relies on videoconference invitations sent from compromised accounts of previous victims. When the victim accepts, the call is secretly recorded while, simultaneously, a pre-recorded video – or a deepfake – of a trusted contact is played to build trust.
A few seconds after the meeting starts, the attackers simulate a technical error (for example, “we can't hear you”) and send a malicious link that, when clicked, installs malware on the victim's device. The code is typically distributed via a “ClickFix” – a lure that downloads and executes a payload capable of stealing private keys, seed phrases, and other wallet credentials.
Typical Stages of the Attack
Initial compromise: harvesting wallets, seed phrases, and hijacking communication accounts (Telegram, LinkedIn, Slack, Discord).
Use of the compromised account to send fake Zoom or Microsoft Teams invitations, often via Calendly.
Sending typosquatted links that mimic legitimate URLs of videoconferencing platforms.
Playing recorded videos or deepfakes of known contacts to create the illusion of real presence.
Presenting a supposed technical error and delivering a malicious link or script that installs the payload.
Propagation: the compromised device is then used to attack new contacts, completing a self-propagating cycle.
Scale and Targets of the Campaign
Reports from Arctic Wolf, published in April 2026, indicate that FaceStealer has already targeted over 400 victims in 20 countries, with concentrations in the US, Singapore, the United Kingdom, Hong Kong, South Korea, and the United Arab Emirates. Around 80 % of the targets work directly in cryptocurrency finance or adjacent sectors, and nearly half are CEOs or founders.
The total number of targets grew to 677 individuals in 58 countries, with 80 % of them holding C-suite positions. The campaign has also begun using AI content generation (ChatGPT, Google, SpaceXAI Grok, Wondershare AI) to create even more convincing deepfake avatars, images, and videos.
Variations and Related Campaigns
FaceStealer shares techniques with the ClickFake Interview campaign, an offshoot of Contagious Interview, which uses recruitment lures on platforms like LinkedIn. In October 2026, Alina Krasavina, an engineering manager at Delivery Hero, reported being targeted by two distinct fake interview attempts, both involving the delivery of malicious code.
In addition, the group has been exploiting malware delivery via open-source repositories, manipulating Visual Studio Code configuration files (tasks.json) and git hook scripts to execute payloads when projects are opened. Sophos identified a case where a VS Code workspace contained a JavaScript loader (BeaverTail) that downloaded a Python backdoor (InvisibleFerret).
Practical Recommendations for Organizations and Users
Based on the information released by authorities and researchers, companies and professionals are recommended to adopt the following immediate measures:
Be wary of videoconference invitations sent by contacts who have already been compromised; verify authenticity through another channel.
Implement “sandbox” policies to open unknown files and repositories, preferably in isolated virtual machines.
Disable automatic script execution in development environments (VS Code, git hooks) and review integrated terminal settings.
Monitor communication accounts (Telegram, Slack, Discord) for suspicious activity, such as sending shortened or typosquatted links.
Regularly update videoconferencing software and disable automatic recording features that could be abused.
Educate teams about the existence of deepfakes and the need to confirm participant identity through independent means.
By adopting these practices, organizations can significantly reduce the attack surface exploited by FaceStealer and derived campaigns.
Frequently Asked Questions
Who is the group responsible for the FaceStealer scheme?
The FBI attributed the crime to the North Korean hacker group known as BlueNoroff, also referenced as APT38 and CageyChameleon.
How does the FaceStealer attack work?
Attackers send videoconference invitations, play deepfakes of trusted contacts, and send malicious links that install malware to steal credentials.
What was the total amount stolen in the FaceStealer scheme?
The FBI disclosed that actors linked to North Korea stole over US$ 400 million in cryptocurrencies over the past 18 months.
Who are the main targets of the campaign?
About 80% of the targets work in cryptocurrency finance or adjacent sectors, with nearly half being CEOs or founders.
