North Korean cyber actors have stolen more than US$400 million in cryptocurrency over the past 18 months through a sophisticated online scam that uses fake video meetings to deceive victims, the Federal Bureau of Investigation (FBI) has disclosed.
The scheme, identified by the FBI as “FaceStealer”, targets people working in the cryptocurrency and Web3 industries, as well as developers and maintainers of open-source software.
According to the US Department of Justice, the hackers pose as trusted professional contacts and invite their targets to video conferences using compromised accounts. Once victims join the meetings, the attackers secretly record their webcam footage and play pre-recorded videos of people the targets know or recognise to make the meetings appear genuine.
In some cases, the hackers also use deepfake videos of influential personalities in the cryptocurrency and Web3 industries to strengthen the deception and gain their victims’ confidence.
The attackers then introduce what appears to be a technical problem, such as claiming that a participant cannot hear the victim, before directing them to a link or prompt to resolve the issue.
However, the supposed fix secretly installs malicious software on the victim’s computer, giving the hackers access to the device and potentially enabling them to steal cryptocurrency or compromise other systems and accounts.
The FBI says the attackers can exploit this access long after the initial intrusion, with some reported cases involving cryptocurrency theft and the hijacking of communication accounts several months or even more than a year after the victim’s computer was first compromised.
The operation also allows the hackers to access victims’ contact lists, social media accounts and messaging applications, which they can use to identify and target more people within their professional and personal networks.
FBI disrupts hackers’ infrastructure
In an operation announced on November 12, 2026, the FBI said it had disrupted cloud-based infrastructure used to facilitate the FaceStealer scheme.
The bureau also disclosed that, under a federal warrant, it seized more than 900 webcam videos of victims from around the world.
The investigation was led by the FBI’s Los Angeles Field Office, alongside the US Attorney’s Office for the Central District of California.
The FBI has identified several names associated with the North Korean cyber actors behind the scheme, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
Authorities say the attackers have increasingly turned their attention to open-source software developers and maintainers, seeking access to their devices and software repository accounts.
Such access could allow them to compromise software development systems and potentially introduce malicious code into software used by other individuals and organisations, creating wider supply-chain security risks.
The FBI has warned that anyone who owns cryptocurrency, works in the Web3 sector or maintains open-source software repositories could be a potential target.
It has also published a cybersecurity advisory outlining how the scheme operates and offering guidance on how individuals and organisations can protect themselves.
Separate $1.2bn Binance asset seizure
In a separate operation announced on the same day, the US Department of Justice disclosed that it had obtained court authorisation to seize or restrain more than US$1.2 billion in cryptocurrency stolen from Binance, a virtual currency exchange.
The theft, which the FBI attributed to North Korean military-linked cyber actors known as TraderTraitor, involved more than US$6 billion in virtual assets on or about October 29, 2026.
The Justice Department said coordinated efforts involving US law enforcement agencies and private-sector cryptocurrency service providers had helped freeze more than US$2.7 billion of the stolen assets.
Efforts to trace and recover the remaining funds are ongoing, as investigators say the attackers continue to move the assets through cryptocurrency bridges, mixers and exchanges.
US authorities say the two operations form part of broader efforts to disrupt North Korea’s use of cybercrime and cryptocurrency theft to generate funds for its government and illicit weapons programmes.