FBI says North Korean hackers stole more than $400 million
North Korean hackers stole over $400 million in cryptocurrency by using deepfake video calls and synthetic avatars to trick professionals into installing.
- Reported date
- Nov 14, 2026
- Target
- Cryptocurrency and Web3 sector professionals
The exact incident date was not established. This entry is dated by its source report.
The FBI has linked a sophisticated North Korean social engineering campaign, known as FaceStealer, to more than $400 million in cryptocurrency theft over an 18-month period. The operation targets professionals in the cryptocurrency and Web3 sectors by leveraging deepfake technology and compromised accounts to gain unauthorized access to digital wallets and sensitive systems.
What happened
The FaceStealer campaign functions as a self-spreading platform where each successful compromise facilitates further outreach. Attackers first gain control of a victim's device, harvesting wallet data, seed phrases, and contact lists from platforms like Telegram, LinkedIn, and Slack. Using these established relationships, they contact new targets to propose investment discussions, often sending links to fake meeting portals that mimic Zoom or Microsoft Teams.
During these video calls, the attackers use generative tools to display prerecorded webcam footage or synthetic avatars of trusted contacts to establish credibility. Once the target is on the call, the host claims the victim has an audio issue or requires a software update. This social engineering tactic, described as a ClickFix-style lure, pressures the victim into running commands or installing files that deliver malware. This malware grants the attackers persistent access to the victim's credentials and cryptocurrency assets.
Research indicates the campaign is highly targeted, with a significant majority of victims working in blockchain finance or investment roles, including many C-suite executives and founders. The FBI has seized over 900 victim webcam recordings that were intended for reuse in future impersonation attempts. The operation is attributed to the North Korean cluster BlueNoroff, also known as APT38, and has been observed using generative tools from various AI platforms to produce convincing lures and synthetic meeting content. U.S. authorities have since seized cloud infrastructure associated with the operation to disrupt these activities.