FBI Los Angeles warns of 'FaceStealer' scheme stealing over $400M in crypto in 18 months

The FBI's Los Angeles Field Office issued a warning Thursday about a social engineering scheme involving North Korean hackers that targets cryptocurrency and Web3 industry workers worldwide.

The scheme — referred to by the FBI as "FaceStealer" — uses fake versions of popular video conferencing platforms like Zoom and Microsoft Teams, webcam video recorded in secret and "computer intrusions," according to the agency.

In 18 months, the scheme has resulted in more than $400 million in crypto thefts and at least 900 impersonation victims, officials said.

"The FBI is sounding the alarm to elevate awareness of this growing scheme, now aimed not only at crypto theft, but also the exploitation of the open-source software supply chain," Assistant Director in Charge of the FBI Los Angeles Field Office Patrick Grandy said in part of a statement.

How the Scheme Works

In a video posted to X, Special Agent Jeremy Robertson, who leads cyber and counterintelligence at the FBI Los Angeles Field Office, broke down the scheme's typical cycle.

First, the hackers will hijack someone's Telegram and LinkedIn account and message their contacts, luring them to an imposter Zoom or Teams meeting, built and controlled by the hacker, Robertson said. Once a person joins the meeting, the hackers allegedly secretly capture the person's webcam video, which they can later use to impersonate them.

"When the meeting starts, you see the webcam video of the person who invited you, but they're not actually there. You're looking at a video of a prior victim," Robertson said, adding that there may be multiple fake participants in the meeting to add pressure.

The special agent says that's when the impersonator messages the victim about not being able to hear them before a fake error message pops up, directing the victim to run an update.

"When you run the update or follow the hacker's instructions to fix the problem, you're actually downloading malware that gives the hackers access to your computer, your crypto and possibly your social media and communication accounts," Robertson said.

By the end, the FBI says the hackers obtain what they need to impersonate the victim and repeat the cycle with their contacts.

Investigation and Victims

A cloud-based infrastructure believed to be used by FaceStealer hackers was disrupted, according to the FBI and the U.S. Department of Justice, leading to the discovery of more than 900 victim videos.

"The victims are all experienced crypto/Web3 executives, developers and even cybersecurity experts," Robertson said.

Officials say the hackers have also been reaching out to those involved in the development and maintenance of open-source software to try to access their devices and digital storage spaces where files and code are kept.

More information can be found on the FBI's website.

Related Local News

• Westlake — 2 hours ago
• Police shoot dog in Westlake, LAPD says — Crime and Courts, 3 hours ago
• SoCal district attorneys back legal challenge to Newsom's commutation decision — Crime and Courts, 3 hours ago

Get Los Angeles's latest local news on crime, entertainment, weather, schools, cost of living and more. Here's your go-to source for today's LA news.