FBI Warns of North Korean FaceStealer Scam, $400M Stolen in 18 Months

North Korean hackers running a fake video call campaign called FaceStealer have stolen $400 million in cryptocurrency over more than 18 months, the FBI has warned, using the calls to push malware onto victims' devices.

The US Department of Justice, working with the FBI, announced on November 12 that authorities had shut down cloud infrastructure used in the campaign. The FBI also recovered more than 900 webcam videos belonging to victims. The footage had been used to impersonate those victims in follow-up attacks.

How the scam works

Attackers hijack social media accounts and use them to contact people connected to earlier victims. They then arrange a video meeting on an imitation of a platform such as Zoom, where the victim sees recorded footage of someone they know.

Next come fake audio or technical problems, followed by instructions that lead the victim to install malware. That malware gives access to the victim's phone and accounts, and potentially to crypto wallets.

Developers in the crosshairs

Targets include Web3 and crypto workers and open-source developers. Access to a developer's device or repository account could expose widely used projects to supply-chain attacks, in which malicious code is inserted into software that many others depend on.

The FBI said hackers nearly compromised a major open-source JavaScript library through the campaign earlier this year. The attempt was stopped before it caused severe harm.

FBI Cyber Branch Operations Director Brett Leatherman said North Korea relies on large-scale crypto theft to fund its weapons program.

The bureau advises verifying meeting invitations through a different channel and avoiding software installs from unexpected prompts.

Link to the Binance case

The warning arrived alongside new figures on the Binance theft of more than $6 billion. US authorities and private partners froze over $2.7 billion, and the DOJ restrained over $1.2 billion with court authorization.

Earlier, the FBI attributed the $6.3B Binance hack to North Korea's TraderTraitor group. North Korea rejected that attribution, and Kim Yo-jong called it a "political provocation." Binance said the attackers used a fake job interview in a months-long social engineering campaign. Like FaceStealer, that method relied on impersonation and trust.

What it means

FaceStealer targets people rather than code. The near-miss at a major JavaScript library shows the exposure extends beyond individual wallets to the open-source software that crypto projects share.