North Korean hackers used fake video calls to steal $400m in crypto
The FBI says a scheme called FaceStealer has targeted people in the cryptocurrency sector. The campaign follows a separate record theft from the exchange Binance.
Key points
- US authorities say North Korean hackers took over $400 million in cryptocurrency
- The FBI calls the scheme FaceStealer and says more than 900 victims have been hit in 18 months
- Hackers used fake video calls that imitated trusted contacts and installed malware
- The scheme mainly targets people working in crypto and web3, especially open-source developers
- Pyongyang has denied links to a separate $6.3bn Binance hack
According to BBC News, US authorities say the scheme has allowed hackers acting for the North Korean state to obtain over $400 million in digital currency. The FBI reports that more than 900 people have been affected over the last 18 months. The bureau calls the operation FaceStealer.
The FBI considers the method a strong social engineering tactic that can trick even seasoned technical users. Officials say the campaign aggressively singles out people working in the cryptocurrency and web3 industries, particularly those who build and maintain open-source code.
Read also: Pyongyang rejects blame for $6.3bn Binance crypto theft
How the fake calls work
Based on information from the FBI and the US Justice Department, the attackers first contact targets through fake or hijacked social media accounts. They then send invitations to video meetings hosted on imitation versions of popular platforms, including Zoom, Microsoft Teams and Google Meet.
During the call, the attackers play pre-recorded clips of people the target already knows, so the meeting looks genuine. The sound then seems to break down. A pop-up message asks the target to repair the audio by clicking a link.
That link installs malware on the device. The software gives the hackers access to contact lists and apps, which helps them locate more people to target. US authorities also say the hackers secretly record these calls and reuse the footage to scam new victims.
A link to the Binance hack
The FaceStealer findings came roughly a week after Binance, the world’s largest crypto exchange, disclosed a record theft. The exchange said the thieves made use of bogus job interviews to take $6.3bn, or £4.7bn. That attack is thought to be the largest crypto hack so far.
US law enforcement agencies have linked the Binance attack to actors connected with North Korea. Pyongyang has rejected that claim. The FBI statements on FaceStealer do not mention Binance directly, so this article treats the two cases separately.
Why the story matters
US officials say North Korea uses money from large-scale crypto theft to fund its weapons programme. The FBI cyber director, Brett Leatherman, said the regime has stolen billions of dollars in recent years. He linked these thefts to the funding of illicit weapons work.
Patrick Grandy, assistant director in charge of the FBI’s Los Angeles field office, said the scheme exploits trust in common video platforms and personal relationships. He made the remarks in a statement issued on Thursday. He added that people who cannot picture themselves falling for such a scheme may not be thinking widely enough about the risk.
Related: Cyber incidents rise as UK agency warns of more attacks
Frequently asked questions
What is FaceStealer?
The FBI uses the name FaceStealer for a scheme in which hackers use fake video calls to steal peopleu0026#039;s identities. The bureau says more than 900 victims have been affected in the last 18 months.
How much cryptocurrency has been stolen?
According to US authorities, hackers have taken more than $400 million in cryptocurrency through this scheme. Separately, the Binance hack involved a record $6.3bn.
Has North Korea denied the claims?
Pyongyang has denied US law enforcement claims that actors linked to North Korea were behind the Binance hack. The source reports do not give a separate response to the FaceStealer findings.
Sources
This article was written with the help of AI from reports by the outlets listed above. See our Editorial Policy. Spotted a mistake? Tell us.
