WASHINGTON (dpa-AFX) - The U.S. Justice Department has announced the disruption of North Korean state-sponsored massive theft of cryptocurrency by using fake video calls to steal people's identities.
Thursday, the U.S. Attorney's Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean hackers in a highly effective social engineering scheme that the FBI is calling 'FaceStealer.' The scheme, which relies on surreptitiously recorded videos and artificial deepfakes, has resulted in the theft of more than $400 million worth of cryptocurrency in the last 18 months and the attempted compromise of individuals involved in the open-source software supply chain.
US authorities seized cloud-based infrastructure used in the FaceStealer social engineering scheme, and more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange.
'The Criminal Division, specifically the Computer Crime and Intellectual Property Section (CCIPS), and our law enforcement partners played the critical role in immediately freezing billions of dollars' worth of stolen Binance digital assets before they got beyond law enforcement reach,' said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division. 'As the Department's liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach.'
'The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,' said FBI Cyber Branch Operations Director Brett Leatherman. 'North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics.'
'North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user' said Assistant Director in Charge Patrick Grandy of the FBI's Los Angeles Field Office. 'It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough. The FBI is sounding the alarm to elevate awareness of this growing scheme, now aimed not only at crypto theft, but also the exploitation of the of the open-source software supply chain.'
North Korean hackers known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff, and Stardust Chollima have lured targets with invitations to video meetings delivered from accounts stolen from prior victims. Once a target joins the meeting, the hackers record the target's webcam video and play a prerecorded video of a previous victim or victims known to the target, thereby simulating the participation of trusted contacts in the meeting to gain the target's trust. The North Korean hackers also use artificial intelligence to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective. Here again, they use the deepfake videos in the meetings with targets to gain the target's trust, the Justice Department said in a press release.
During the meeting, the hackers then introduce a fake technical error into the meeting, such as claiming that the target cannot be heard, and provide a link or prompt to fix the error. The 'fix' surreptitiously installs malware on the target's computer. With the target's computer compromised, the hackers can steal cryptocurrency or exploit the target's access to other computer infrastructure. In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts several months to more than a year after the initial compromise. As part of the scheme the hackers also accessed the new victim's contact lists, social media, and communications apps to target the victim's personal and professional contacts.
Following up a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.
It also published a report providing greater detail on the mechanics of the FaceStealer scheme, including best practices to protect against this scheme and steps victims can take in the event of a compromise. Additionally, the FBI created a website, www.fbi.gov/facestealer, to serve as a centralized hub for resources and information on the scheme.
Copyright(c) 2026 RTTNews.com. All Rights Reserved
Copyright RTT News/dpa-AFX
© 2026 AFX News