FBI disrupts North Korean scheme stealing $400M in cryptocurrency through deepfake video calls

North Korean hackers have weaponized stolen video recordings of cryptocurrency workers to impersonate them in fraudulent video meetings, turning victims into vectors for fresh attacks on their contacts. The Justice Department’s disruption of the infrastructure supporting this scheme signals a major law enforcement action, but the cycle of account hijacking and credential theft remains difficult to interrupt at scale.

• More than $400 million in cryptocurrency theft over 18 months using FaceStealer, North Korea-attributed social engineering scheme.
• FBI seized over 900 victim webcam videos after disrupting cloud infrastructure on November 12 (Thursday).
• Attackers hijack real accounts on Telegram, LinkedIn, Slack and Discord, then schedule fake Zoom or Teams calls using stored victim footage.

• $400M Cryptocurrency stolen through FaceStealer in preceding 18 months before disruption
• 900+ Victim webcam videos seized by FBI under federal warrant during operation
• Nov 12 Date Justice Department announced disruption of cloud infrastructure
• 4 Communication platforms hijacked for initial contact invitations to targets

According to reporting by CryptoSlate, North Korean cyber actors are running a coordinated scheme that transforms each compromised victim into bait for attacking their professional contacts. The Justice Department announced November 12 that it had disrupted the cloud-based infrastructure supporting the operation, which the FBI attributes to Sapphire Sleet, the North Korean hacking group also known as UNC1069, Stardust Chollima, APT38 and BlueNoroff. The campaign has extracted more than $400 million in cryptocurrency over the 18 months preceding the disruption, and law enforcement seized over 900 webcam recordings of victims.

Hijacked accounts and fabricated meetings form the core attack vector

The scheme begins when attackers compromise genuine communication accounts on Telegram, LinkedIn, Slack and Discord belonging to earlier victims. The FBI’s FaceStealer resource page describes how threat actors then message the target’s existing contacts with seemingly legitimate meeting invitations, grounding the requests in prior conversations visible in the stolen chat histories. A real calendaring service handles the scheduling, making the invitation appear authentic.

When the target clicks the malicious meeting link moments before the scheduled call, their webcam begins recording without their knowledge.

The fake Zoom or Microsoft Teams interface displays pre-recorded video footage from an earlier victim, sometimes showing multiple supposed participants to establish legitimacy. The target believes they are joining a genuine video meeting with trusted colleagues, when in reality they are viewing stored footage controlled by the attackers.

Malware installation follows a fabricated technical support scenario

During the fake meeting, an attacker claims an audio or technical problem and directs the target to run an update, paste code into a terminal, or execute a script purportedly to fix the issue. The FBI’s November 12 FLASH advisory states that following these instructions installs malware capable of harvesting browser cookies, logging keystrokes, capturing screens and maintaining persistent backdoor access to the device.

This malware exposure creates multiple attack surfaces. Cryptocurrency wallets, exchange accounts and other financial credentials become accessible to the attackers. Browser cookies reveal logged-in sessions to sensitive services. The victim’s communication accounts, contact lists and newly recorded webcam footage then enter the attackers’ repository for targeting the next round of victims.

The cycle can remain dormant for months or more than a year after initial compromise, making it difficult for victims to connect suspicious meetings to later account takeovers or asset theft.

Emerging use of synthetic video alongside stored recordings

The FBI notes that FaceStealer operators still overwhelmingly rely on genuine stolen victim videos, but have begun incorporating artificially generated deepfake footage as an emerging supplementary technique. Genuine recordings remain more convincing and require no additional processing, but the introduction of synthetic video expands the attackers’ operational flexibility and reduces their dependence on a shrinking pool of viable victim footage.

The targeting priorities have also expanded beyond financial theft. The FBI reports that North Korean cyber actors are increasingly using FaceStealer to compromise open-source software developers and maintainers in order to gain access to software repository accounts. By infiltrating the credentials of trusted developers, attackers could potentially distribute malicious code through widely deployed open-source projects, affecting millions of downstream users dependent on those libraries.

The BlockWest read. The Justice Department’s infrastructure disruption removes operational capacity but not the fundamental vulnerability: account takeover and social engineering remain cheap at scale, and law enforcement cannot prevent the next wave of phishing or credential compromise. Crypto and software firms face a choice between accepting endemic account hijacking or deploying technical friction like hardware keys and out-of-band verification as non-negotiable defaults rather than optional additions.

The FBI recommends confirming meeting invitations through communication channels separate from the account the attacker may control, delaying webcam activation until the caller can be verified, and refusing to run scripts or terminal commands presented as video client updates. For users who suspect compromise, the bureau advises securing cryptocurrency in a newly created wallet on an unaffected device, securing communication and developer accounts, alerting contacts and employers, and filing a report with the Internet Crime Complaint Center using the keyword FaceStealer. Whether the November 12 disruption meaningfully reduces North Korean operational tempo or simply forces redeployment to new cloud infrastructure remains an open question.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.