North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says

The scheme, which the FBI calls 'FaceStealer,' turns video conference calls into a trap. Hackers lure targets into meetings using stolen accounts, then play prerecorded webcam footage of trusted contacts to simulate their presence and win the target's confidence.

The group also generates deepfake videos of well-known figures in the crypto industry, using AI to make the ruse more convincing. Once a target is at ease, the attackers manufacture a fake technical glitch and offer a link to 'fix' it, which instead installs malware.

Supply Chain Attacks

The DOJ tied the operation to North Korean groups known variously as Sapphire Sleet, BlueNoroff and APT38, and warned that hackers have increasingly targeted open-source software developers in an apparent bid to enable supply-chain attacks.

Binance Hack Update

The announcement came paired with an update on the record-breaking Binance hack. The DOJ said it has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from the exchange on Oct. 29, part of over $2.7 billion frozen so far.

The FBI attributed that theft to the North Korean group TraderTraitor, and the regime has been laundering the proceeds at speed, spinning up a new wallet roughly every 25 seconds. North Korea has denied involvement, calling the FBI's finding a political provocation.

Officials said efforts to trace and recover the stolen Binance funds are ongoing. The actions underscore how central crypto theft has become to Pyongyang's finances, with the U.S. recently sanctioning 11 people over a North Korean IT-worker scheme that moved millions in crypto.