North Korean Hackers Stole More Than $400 Million in Crypto Using Fake Video Calls, FBI Says
North Korean state-backed hackers stole more than $400 million worth of cryptocurrency over an 18-month period using a sophisticated online deception campaign involving fake video meetings, stolen accounts, and artificial intelligence-generated deepfakes, according to the U.S. Federal Bureau of Investigation (FBI).
The campaign, identified by investigators as "FaceStealer," targeted people working in the cryptocurrency and Web3 industries. It also increasingly focused on open-source software developers, raising concerns that attackers could use compromised accounts and computers to reach larger technology networks.
On November 12, 2026, the U.S. Department of Justice (DOJ) announced actions to disrupt infrastructure associated with the operation. The FBI also said it had identified and seized more than 900 webcam videos belonging to victims.
The case highlights how cybercriminals are combining social engineering with AI-generated media to make online scams more convincing.
How the FaceStealer Cryptocurrency Scam Works
Unlike traditional hacking attempts that rely primarily on breaking into computer systems, FaceStealer uses deception to persuade victims to compromise their own devices.
According to the FBI and the Justice Department, attackers first gain access to legitimate communication or social media accounts. They then use those compromised accounts to send meeting invitations to people who already know and trust the account owners.
The invitations may appear to come from colleagues, professional contacts, or familiar people in the cryptocurrency community.
When a target joins the meeting, the attackers use prerecorded video footage of a person the target recognizes. In some cases, AI-generated deepfake videos of influential individuals in the cryptocurrency and blockchain industries are also used to make the meeting appear authentic.
The attackers then introduce a fake technical problem, such as an audio or microphone issue. The target is told that a link or software instruction will fix the problem.
However, the supposed solution is actually a way to install malicious software on the victim's computer.
Once the device is compromised, attackers may gain access to sensitive information, communication accounts, and cryptocurrency-related systems.
Why Fake Video Meetings Are So Dangerous
Video meetings are widely used by businesses, software developers and financial professionals. People often feel more comfortable accepting an invitation when it appears to come from someone they recognize.
FaceStealer exploits that sense of trust.
The use of familiar faces makes the deception more difficult to identify. A victim may believe that a colleague or business partner is participating in a legitimate meeting, even though the video is prerecorded or artificially generated.
The problem becomes more serious when attackers combine video impersonation with compromised email and messaging accounts.
After gaining access to one victim's communications, criminals can identify additional contacts and use the same approach to reach new targets. This creates a chain of potential victims across personal and professional networks.
The FBI has warned that the campaign can deceive even people with considerable technical knowledge and security awareness.
AI Deepfakes Make Cybercrime More Convincing
Artificial intelligence has made it easier to create realistic synthetic images, voices, and videos.
While these technologies have legitimate applications in entertainment, education, and business, criminals can also misuse them to impersonate real people.
In the FaceStealer campaign, U.S. authorities said hackers had increasingly used AI-generated videos of recognizable figures in the cryptocurrency and Web3 industries.
This development creates a serious challenge for organizations that rely on video calls as a way to verify someone's identity.
A familiar face on a screen should no longer be treated as sufficient proof that a person is genuine.
Businesses may need stronger verification procedures, especially when meetings involve financial transfers, access to digital assets, software credentials, or confidential company information.
Open-Source Software Developers Become New Targets
The campaign is not limited to cryptocurrency investors and traders.
According to the U.S. Justice Department, hackers have increasingly targeted people who develop and maintain open-source software.
Open-source projects are important parts of modern technology. Many websites, applications and business systems depend on software libraries and tools maintained by independent developers and communities.
If attackers compromise a developer's computer or software repository account, they may gain opportunities to interfere with software that other organizations rely on.
This type of threat is known as a software supply-chain attack. Instead of attacking every organization separately, criminals attempt to compromise a trusted component or development process that is used by many downstream users.
The FBI said the targeting of open-source developers appeared designed to create opportunities for this type of broader attack.
FBI Seizes More Than 900 Webcam Videos
As part of its investigation, the FBI obtained a federal warrant and seized more than 900 webcam videos associated with FaceStealer victims.
The videos are significant because they demonstrate how the attackers collected footage that could potentially be reused to impersonate victims and approach their contacts.
The U.S. government also announced the seizure of cloud-based infrastructure used in the operation.
These actions were intended to disrupt the hackers' ability to conduct further attacks, although disrupting infrastructure does not automatically mean that every victim's compromised account or device has been secured.
People who believe they may have been targeted should follow official cybersecurity guidance and seek assistance from appropriate security professionals.
Is the FaceStealer Campaign Connected to the Binance Hack?
The November 12 announcement also included a separate development involving a major cryptocurrency theft from Binance.
The Justice Department said North Korean-linked actors known as TraderTraitor stole more than $6 billion in virtual assets from the cryptocurrency exchange in a separate incident.
U.S. authorities and private-sector partners had collectively frozen more than $2.7 billion worth of the stolen assets. The Justice Department also obtained court authorization to seize or restrain more than $1.2 billion.
These figures relate to the separate Binance theft, not the $400 million FaceStealer campaign.
The distinction matters because the two operations involve different reported hacking activity and should not be combined into a single theft figure.
The Justice Department said efforts to trace and recover the Binance-related assets were continuing.
How to Protect Yourself From Fake Video Call Scams
The FaceStealer case shows that cybersecurity is not only about using strong passwords. People must also be careful about the links, meeting invitations, and technical instructions they receive.
Here are several practical precautions:
1. Verify unexpected meeting invitations
If someone you know sends an unusual video meeting invitation, contact them through a separate trusted channel before joining or following instructions.
2. Never install software from an unexpected meeting link
Do not download applications, run scripts, or paste commands into your computer's terminal simply because someone in a video call says it will fix an audio or camera problem.
3. Use multi-factor authentication
Enable multi-factor authentication on email, social media, cryptocurrency exchanges, and other important accounts. This adds another layer of protection if a password is stolen.
4. Keep devices and applications updated
Install security updates from official software providers. Avoid downloading updates or meeting applications from unfamiliar websites.
5. Protect cryptocurrency wallets
Keep recovery phrases and private keys confidential. Never share them during a video meeting, through email, or in response to an unexpected message.
6. Confirm financial requests independently
Before approving a cryptocurrency transfer or changing payment details, verify the request through a separate communication channel.
7. Report suspicious activity
If you suspect that your computer or account has been compromised, disconnect affected devices from sensitive systems where appropriate, contact your organization's security team, and report the incident to the relevant authorities or service provider.
Why North Korea-Linked Cryptocurrency Theft Remains a Global Concern
The FaceStealer operation illustrates the growing connection between cybercrime, cryptocurrency, and national security.
U.S. officials have repeatedly accused North Korean state-linked actors of using cyber operations to obtain funds for government activities and prohibited weapons programs.
Cryptocurrency theft can be particularly attractive to sophisticated criminal groups because digital assets can move across international networks. Tracing and recovering stolen funds may require cooperation among law enforcement agencies, cryptocurrency exchanges, and other service providers.
The growing use of AI-generated impersonation adds another layer of difficulty. As deepfake technology becomes more accessible, organizations may need to rethink how they verify identities during online meetings and approve sensitive transactions.
For cryptocurrency companies and software developers, security procedures must cover not only technical vulnerabilities but also the human relationships that attackers attempt to exploit.
Conclusion
The FBI's warning about FaceStealer reveals how North Korean-linked hackers allegedly stole more than $400 million in cryptocurrency by combining fake video meetings, compromised accounts, and AI-generated deepfakes.
The campaign also shows that open-source software developers and professional contacts can become targets, potentially exposing wider technology networks to additional risks.
Although U.S. authorities have taken action to disrupt the operation's infrastructure, the incident serves as a reminder that online trust must be supported by strong security practices.
As AI-generated media becomes more realistic, verifying identities, avoiding suspicious downloads, and protecting sensitive account information will become increasingly important for individuals and businesses worldwide.
Frequently Asked Questions
1. How much cryptocurrency did North Korean hackers steal through FaceStealer?
The FBI said the FaceStealer campaign resulted in more than $400 million worth of cryptocurrency theft over the previous 18 months.
2. What is FaceStealer?
FaceStealer is the name used by the FBI for a social-engineering campaign that uses fake video meetings, secretly recorded footage, and AI-generated deepfakes to trick victims into installing malicious software.
3. Did hackers use AI deepfake videos?
Yes. The U.S. Justice Department said the hackers increasingly used AI-generated videos of well-known people in the cryptocurrency and Web3 industries to gain victims' trust.
4. Were Zoom and Microsoft Teams hacked?
The reported scheme used fake versions of familiar video meeting services and deceptive meeting invitations. This does not establish that Zoom, Microsoft Teams, or Google Meet themselves were hacked.
5. How many victim videos did the FBI seize?
The FBI said it seized more than 900 webcam videos associated with victims of the campaign.
6. Is the $400 million theft the same as the Binance hack?
No. The FaceStealer campaign and the separate Binance cryptocurrency theft are distinct incidents. The Justice Department reported more than $400 million in FaceStealer-related theft and separately discussed the Binance incident involving more than $6 billion in stolen assets.
Editorial Transparency
This article is an independently written news overview based on public statements from the U.S. Department of Justice, the FBI, and established news reporting. Allegations and attribution are presented as statements by U.S. authorities and are not presented as independently proven findings about every individual incident. Information reflects reports available on November 13, 2026.
Sources and Further Reading
U.S. Department of Justice: Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency
Reuters: North Korean hackers steal more than $400 million using video images, FBI says
Nextgov/FCW: FBI disrupts intricate North Korean fake-call scheme tied to $400M in crypto theft
FBI FaceStealer Information: Official FBI resources
0 Comments