Experienced professionals in crypto AI media incident

North Korean hacking groups, including Sapphire Sleet, BlueNoroff, and APT38, orchestrated a sophisticated campaign that resulted in over $400 million in cryptocurrency theft over an 18-month period. The operation, identified by the FBI as FaceStealer, specifically targeted experienced professionals in the crypto, Web3, and cybersecurity sectors by leveraging hijacked social accounts and high-fidelity impersonations to gain unauthorized system access.

What happened

The attackers initiated contact through compromised Telegram or LinkedIn accounts, making the outreach appear to come from trusted industry contacts. Once a target agreed to a meeting, they were directed to attacker-controlled environments designed to mimic legitimate platforms like Zoom or Microsoft Teams. To build credibility, the hackers utilized AI-generated deepfakes of prominent industry figures and prerecorded webcam footage of previous victims. The FBI noted that attackers secretly recorded targets while they waited for meetings to begin, capturing their image and mannerisms to facilitate future impersonations.

During these video calls, the attackers manufactured technical issues, claiming that other participants could not hear the target. They then presented a fake error message prompting the victim to install a software update. This "fix" was actually a malicious payload that granted the attackers access to the victim's computer, crypto wallets, and social media accounts. The malware often remained dormant, with attackers waiting months or even over a year after the initial compromise before siphoning funds. By seizing control of the victim's social accounts, the hackers were able to further propagate the scam to the victim's professional network. On November 12, 2026, the U.S. Justice Department announced the seizure of the infrastructure supporting this operation, including over 900 seized webcam recordings used to fuel the impersonation scheme.