FBI Exposes North Korean FaceStealer Fake Video Call Scheme Behind $400 Million Crypto Theft

State-sponsored North Korean hackers have stolen more than 400 million dollars in cryptocurrency by deploying deceptive video calls to compromise victim identities, according to United States federal authorities. The Federal Bureau of Investigation reported that over 900 individuals have fallen victim to the social engineering campaign, designated as FaceStealer, over the past 18 months. FBI cyber director Brett Leatherman stated that the North Korean regime relies on proceeds from large-scale digital asset theft to finance its illicit weapons programs. Authorities noted that the operation aggressively targets professionals working across the cryptocurrency and Web3 sectors, particularly open-source software developers and maintainers.

According to the FBI and the US Department of Justice, FaceStealer operatives utilize fabricated or compromised social media profiles to invite targets into online meetings. These deceptive sessions are hosted on imposter versions of popular conferencing platforms including Zoom, Microsoft Teams, and Google Meet. During the calls, attackers play pre-recorded video footage of previous victims familiar to the target to simulate a legitimate conversation, while intentionally triggering an apparent audio malfunction. A deceptive prompt subsequently appears on screen instructing the user to click a link to repair the audio, which installs malware onto the victim's device. The FBI created a centralized website at www.fbi.gov/facestealer to provide resources and information on the FaceStealer scheme, according to U.S. Department of Justice.

Once installed, the malicious software grants attackers access to the target's contact lists and installed applications, enabling hackers to expand their pool of prospective targets. The threat actors secretly record the video calls and repurpose the captured footage as impersonation material to deceive subsequent victims, according to BBC. The FBI described FaceStealer as a highly effective social engineering campaign capable of deceiving even experienced technology professionals. The disclosure arrives one week after global cryptocurrency exchange Binance revealed that hackers exploited fake job interviews to steal a record 6.3 billion dollars. The FBI warned that FaceStealer actors target open-source software developers to infiltrate repository accounts and potentially distribute malicious code impacting millions of downstream users.

US law enforcement agencies attributed the historic Binance breach to North Korea-linked cyber groups, although Pyongyang has denied responsibility for that incident. The FBI attributed the FaceStealer activity to a cluster of North Korean hackers known as Sapphire Sleet or UNC1069, a separate group from those linked to the Binance hack, according to Reuters.

Background

Collective U.S. government and private sector efforts have resulted in the freeze of more than $2.7 billion in virtual assets stolen in the Binance hack, according to U.S. Department of Justice.

In late March 2026, Google discovered that North Korean affiliated group UNC1069 had placed malware within the Axios software package, according to Counsel Magazine.