FBI Says North Korean Hackers Stole Over $400 Million in
North Korean hackers known as BlueNoroff have stolen over $400 million in cryptocurrency by using deepfakes and social engineering to compromise high-value.
- Reported date
- Nov 13, 2026
- Target
- individuals in the cryptocurrency and Web3 sectors
The exact incident date was not established. This entry is dated by its source report.
The North Korean-linked threat actor group BlueNoroff has orchestrated a sophisticated, multi-year social engineering campaign known as FaceStealer, resulting in the theft of more than $400 million in cryptocurrency. By leveraging deepfake technology and compromised communication accounts, the attackers have successfully targeted founders, C-suite executives, and developers within the cryptocurrency and Web3 sectors to gain unauthorized access to digital assets and infrastructure.
What happened
The FaceStealer campaign operates as a self-propagating attack chain that begins by compromising a victim’s social media or communication accounts, such as Telegram, LinkedIn, or Discord. Once an account is hijacked, the attackers impersonate the victim to contact their professional network, proposing video meetings on platforms like Zoom or Microsoft Teams to discuss investment opportunities.
To build trust, the attackers utilize a combination of stolen webcam recordings from previous victims and high-quality deepfake videos of influential figures in the industry. These synthetic assets are presented during video calls to simulate multiple participants. The attackers also use generative AI to create static avatars and artwork to enhance the credibility of the fake meetings.
During these calls, the attackers trigger a mock technical error, such as a fake audio issue or a deprecated software SDK, and provide the target with a link to a malicious update. This ClickFix-style lure is designed to install malware on the victim's workstation, allowing the attackers to steal cryptocurrency wallets, seed phrases, and sensitive access credentials. The compromised device is then used to further propagate the attack to the victim's own contacts. The FBI has seized over 900 webcam recordings used in these impersonation attempts, highlighting the scale of the operation. The campaign has expanded globally, with hundreds of targets identified across dozens of countries, underscoring the group's focus on individuals with significant financial decision-making authority.