North Korean state-sponsored hackers have reportedly stolen more than $400 million in cryptocurrency through a sophisticated online fraud scheme involving fake video calls and the impersonation of trusted individuals, according to US authorities.
The Federal Bureau of Investigation (FBI) disclosed that more than 900 people have fallen victim to the operation, identified as FaceStealer, over the past 18 months.
The scheme reportedly targets individuals working in the cryptocurrency and Web3 industries, using convincing online identities and fraudulent video conferencing platforms to gain access to victims’ devices and steal sensitive information.
According to the FBI, the hackers have become increasingly sophisticated in their methods, exploiting people’s trust in familiar contacts and widely used communication platforms to carry out their activities.
FBI Cyber Director Brett Leatherman said the stolen funds were part of a broader effort by North Korea to generate revenue for activities prohibited under international sanctions.
“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” Leatherman said.
The latest disclosure comes amid growing concerns about North Korea’s alleged involvement in major cryptocurrency thefts targeting international companies and digital asset platforms.
Just a week earlier, Binance, the world’s largest cryptocurrency exchange, reportedly disclosed a major security breach involving hackers who used fake job interviews to deceive employees and gain access to sensitive systems.
The incident was reported to have resulted in losses of approximately $6.3 billion, making it one of the largest cryptocurrency thefts ever recorded.
US law enforcement agencies attributed the attack to actors linked to North Korea, although Pyongyang has denied the allegations.
The FaceStealer operation represents another example of how cybercriminals are using social engineering techniques to exploit human relationships and technological vulnerabilities.
According to the FBI and the US Department of Justice, the hackers begin by creating fake social media profiles or taking control of existing accounts belonging to people who may be known to their intended victims.
They then use these accounts to establish contact and invite targets to participate in video conferences.
The invitations are designed to appear legitimate, with the hackers directing victims to fraudulent versions of popular video conferencing services, including Zoom, Microsoft Teams and Google Meet.
Once the victim joins the meeting, the attackers play pre-recorded videos featuring individuals the target recognises or trusts.
The recordings are intended to create the impression that the victim is participating in a genuine business or professional conversation.
However, during the call, the audio appears to malfunction, prompting the victim to believe that there is a technical problem that needs to be resolved.
A message subsequently appears on the screen instructing the individual to fix the audio by clicking on a link.
What appears to be a routine troubleshooting process is, in reality, part of the hackers’ attempt to gain access to the victim’s device.
Clicking on the link triggers the download of malicious software, allowing the attackers to access information stored on the device.
The malware can reportedly collect contact lists and information from applications, giving the hackers additional opportunities to identify and approach potential victims.
This allows the operation to expand beyond its initial targets, as information obtained from compromised devices can be used to identify other individuals within professional and personal networks.
US authorities also revealed that the hackers secretly record the fraudulent video calls and use the recordings as material for subsequent scams.
By capturing conversations and impersonating familiar individuals, the attackers are able to create more convincing approaches when targeting new victims.
The technique makes the operation particularly dangerous because it relies not only on technical manipulation but also on the trust people place in colleagues, business associates and personal contacts.
The FBI has described FaceStealer as a highly effective social engineering operation capable of deceiving even experienced technology professionals and individuals with strong cybersecurity awareness.
Patrick Grandy, Assistant Director in Charge of the FBI’s Los Angeles Field Office, said the scheme was particularly concerning because it exploits the widespread use of video conferencing platforms and established personal relationships.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” Grandy said in a statement on Thursday.
He further warned that individuals should not assume they are immune to such attacks simply because they have experience using digital platforms or understand basic cybersecurity practices.
“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” he added.
The latest revelations have renewed concerns about the growing threat posed by state-sponsored cyber operations, particularly those targeting the cryptocurrency industry.
Digital asset companies, software developers and professionals involved in maintaining open-source projects are increasingly attractive targets because of their access to valuable financial information, digital wallets and technological infrastructure.
The use of fake identities and manipulated video calls also demonstrates how cybercriminals are adapting their methods to overcome traditional security measures.
Rather than relying solely on technical vulnerabilities, attackers are increasingly exploiting human behaviour, professional relationships and the willingness of individuals to resolve what appear to be ordinary technical problems.
US authorities continue to warn cryptocurrency professionals and other potential targets to exercise caution when receiving unexpected meeting invitations, particularly those requiring them to download software or click on unfamiliar links.
The FaceStealer case highlights the need for stronger digital security practices, including independently verifying the identity of people participating in online meetings and confirming that video conferencing links originate from official platforms.
It also serves as a reminder that even familiar faces and seemingly legitimate conversations can be used as tools in sophisticated cybercrime operations.
