North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months by luring victims onto fake video calls, the FBI said on Thursday.
The scheme, which the FBI calls ‘FaceStealer’, works like this: targets are invited to video meetings on fake versions of Zoom, Microsoft Teams or Google Meet. The invitation appears to come from a genuine contact the target has dealt with before, but that person’s social media and messaging accounts have been compromised and their image secretly recorded.
Once on the call, the target is also recorded. The hackers play back prerecorded footage of the known contact to make the meeting look real, then stage a fake technical problem – for example, saying the target cannot be heard – and send a link or prompt to fix it. Clicking it infects the target’s computer and social media accounts, and the victim’s own contacts are then used to target more people.
The FBI said it has identified and seized more than 900 webcam videos of victims under a federal warrant, according to its advisory issued on Wednesday. The bureau also warned that the hackers are now using artificial intelligence to create deepfake videos of well-known figures in the cryptocurrency and blockchain industries.
The FBI attributed the operation to a cluster of North Korean hackers known as ‘Sapphire Sleet’, also tracked as UNC1069. It is a separate group from the North Korean hackers linked to the recent $6.3 billion hack of cryptocurrency exchange Binance.
Source: Reuters – https://www.reuters.com/world/asia-pacific/north-korean-hackers-steal-more-than-400-million-using-video-images-fbi-says-2026-11-12/
