FBI: North Korean Hackers Stole $400M in Crypto via Fake Video Calls
The FBI's Los Angeles Field Office warned that North Korea-linked hackers have stolen more than $400 million in cryptocurrency over 18 months through a social engineering scheme dubbed "FaceStealer." Hackers hijack Telegram and LinkedIn accounts, lure crypto and Web3 workers into fake Zoom or Microsoft Teams meetings, secretly record webcam video, then use fake error messages to install malware. The FBI and DOJ disrupted the hackers' cloud infrastructure, uncovering over 900 victim videos. Separately, the FBI said it seized or restrained over $1.2 billion of the roughly $6.3 billion stolen from Binance, attributed to a different North Korean group, TraderTraitor.
IllustrationEditorial responsibility
- No named human review is recorded for this page.
- Reports are grouped by semantic similarity and deterministic rules. Language models may assist titles, summaries, translation and cross-source analysis; the page reads the event directly, while its address stays stable when the title changes.
- Summary covers the current reports
Cross-source coverage
Reporting timeline
FBI Los Angeles Warns of 'FaceStealer' Scheme Stealing $400M in Crypto
The FBI's Los Angeles Field Office issued a warning about a North Korean-linked social engineering scheme dubbed 'FaceStealer' that targets cryptocurrency and Web3 workers worldwide. Over 18 months, the scheme has stolen more than $400 million in crypto and produced at least 900 impersonation victims. According to Special Agent Jeremy Robertson, hackers hijack Telegram and LinkedIn accounts to lure contacts into fake Zoom or Microsoft Teams meetings, secretly record their webcam video, then use fake error messages to trick victims into downloading malware. The stolen footage is used to impersonate victims and repeat the cycle with their contacts. The FBI and DOJ disrupted cloud infrastructure used by the hackers, uncovering over 900 victim videos. Officials noted victims include experienced crypto executives, developers, and cybersecurity experts, and warned the scheme is expanding to target open-source software supply chains.
US seizes infrastructure behind North Korea's $400 million crypto scam, FBI says
The US Justice Department said it seized cloud infrastructure used by North Korea-linked hackers in a video-call scam dubbed 'FaceStealer' that stole more than $400 million in cryptocurrency over 18 months. According to the FBI, hackers hijacked meeting invitations from prior victims, recorded webcam video, and played prerecorded clips of known contacts, sometimes using AI-generated deepfakes of crypto figures, before staging fake technical errors that installed malware. The FBI seized over 900 victim webcam videos and tied the scheme to a cluster known as Sapphire Sleet or UNC1069, separate from the military hackers blamed for the Binance theft. In that case, the DOJ said it had court approval to seize or restrain over $1.2 billion of the more than $6 billion stolen around October 29, with over $2.7 billion frozen. North Korea denied involvement in the Binance hack.
Read sourceFBI: North Korean Hackers Stole $400m in Crypto via Fake Video Calls
The FBI says state-sponsored North Korean hackers have stolen more than $400 million in cryptocurrency through a scheme dubbed FaceStealer, in which fake video calls are used to steal identities. More than 900 victims are believed to have been targeted over the past 18 months. According to the FBI and US Justice Department, hackers use fake or hijacked social media accounts to lure cryptocurrency and web3 workers into calls hosted on imposter versions of Zoom, Microsoft Teams, and Google Meet, then play pre-recorded videos of acquaintances while prompting targets to click a link to 'fix' malfunctioning audio, which installs malware. FBI cyber director Brett Leatherman said the North Korean regime relies on large-scale crypto theft to fund its illicit weapons program. The disclosure follows Binance's report of a record $6.3bn hack, also attributed to North Korea-linked actors, a claim Pyongyang denies.
Read sourceShow 2 older updatesHide older updates
FBI Seizes $1.2 Billion in Crypto Stolen from Binance in North Korean Hack
The FBI announced Thursday that it has seized or restrained more than $1.2 billion in cryptocurrency stolen from Binance, the world's largest crypto exchange. The theft of approximately $6.3 billion is considered the largest crypto heist in history and has been attributed to a North Korean hacking group known as TraderTraitor. The U.S. government and private sector have combined to freeze over $2.7 billion of the stolen funds, and the Justice Department has obtained court authorization to seize or restrain more than $1.2 billion of that total. Typically, the U.S. government files a forfeiture claim with a judge to determine legitimate ownership of recovered funds. Separately, the FBI blamed North Korea for a social engineering scheme called FaceStealer that stole $400 million in cryptocurrency over 18 months through hijacked messaging apps and deepfake videos. U.S. officials have repeatedly accused North Korea of using cyber schemes to fund its regime and illicit weapons program.
Read sourceNorth Korean Hackers Steal Over $400 Million in Crypto, FBI Says
North Korean hackers have stolen more than $400 million using video images, according to the FBI. The U.S. has seized $1.2 billion worth of cryptocurrency stolen from Binance and detailed a $2.7 billion freeze related to the hack. The DOJ obtained court approval to seize the $1.2 billion tied to North Korea's Binance hack. Binance says it has replaced all $6.3 billion in crypto stolen in the record-breaking heist.