Crypto holders and open-source developers AI media incident
North Korean operators used deepfake video and audio in social engineering attacks to deceive crypto holders and developers into installing malware, resulting.
- Incident date
- Nov 12, 2026
- Source report date
- Nov 15, 2026
- Target
- crypto holders and open-source developers
On November 12, 2026, the U.S. Department of Justice announced a major disruption of a North Korean social engineering operation known as FaceStealer, which utilized deepfake technology to steal over $400 million from crypto holders and developers. The campaign targeted individuals by weaponizing trust in video calls to deploy malware and gain unauthorized access to digital assets and code repositories.
What happened
The FaceStealer operation, attributed to North Korean actors including Sapphire Sleet, BlueNoroff, and APT38, relied on sophisticated social engineering. Attackers initiated video meetings using accounts compromised from previous victims. Once a target joined, the operators recorded the victim's webcam feed and played back pre-recorded footage of known associates to simulate a trusted environment. To further enhance credibility, the attackers deployed AI-generated deepfake videos of prominent figures within the crypto and Web3 industries.
During these calls, the attackers would stage a fake technical fault, such as claiming the target's audio was not working, and provide a link to a "fix." This link was a delivery mechanism for malware. In many instances, the attackers maintained access for months or even over a year before draining wallets or hijacking accounts. They also leveraged the victim's own contact lists to expand the scope of their attacks.
Beyond individual crypto holders, the FBI noted a strategic shift toward targeting open-source developers. By compromising maintainers, the operators sought to plant malicious code upstream, creating a systemic risk for all downstream projects that rely on those shared libraries. The U.S. Attorney's Office for the Central District of California successfully disrupted the cloud infrastructure powering this campaign and recovered over 900 webcam videos of victims captured during the scheme. Authorities have advised professionals to treat any mid-meeting requests to install software as hostile and to verify meeting invitations through secondary, independent channels.