State-backed hackers from North Korea have taken more than $400 million in cryptocurrency by using fake video calls to steal people’s identities, US authorities say. The FBI calls the scheme FaceStealer, and the bureau says more than 900 victims have fallen for it over the past 18 months.
FBI cyber director Brett Leatherman said the North Korean regime depends on profits from large-scale crypto theft to fund its illicit weapons programme. He said the regime has stolen billions of dollars in recent years.
How the FaceStealer scam unfolds
According to the FBI and the US Justice Department, the hackers use fake or hijacked social media accounts to invite targets into calls hosted on counterfeit versions of Zoom, Microsoft Teams and Google Meet. Once a call begins, they play pre-recorded clips of previous victims whom the target knows, so the meeting looks genuine, though the audio appears to break down.
A pop-up then asks the target to fix the sound by clicking a link. That link installs malware, giving the hackers access to the victim’s contacts and apps, which helps them find more people to target. Authorities add that the hackers secretly record these calls and reuse the footage to scam new victims.
Link to the record Binance breach
A week before the FaceStealer warning, the cryptocurrency exchange Binance disclosed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. US law enforcement agencies linked that breach, thought to be the largest crypto hack to date, to North Korea-linked actors. Pyongyang has denied this claim.
FBI warns crypto and web3 workers are at risk
Authorities say FaceStealer aggressively targets people working in the crypto and web3 sectors, especially those who develop and maintain open-source software. The FBI describes it as a highly effective social engineering scheme that can deceive even experienced, security-minded computer users.
Patrick Grandy, assistant director in charge of the bureau’s Los Angeles field office, said in a statement on Thursday that the scheme exploits trust in widely used video conference platforms and close personal relationships. He warned: “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”
