FaceStealer Crypto Theft: How Deepfake Calls Led to $400M Losses - Coin Gabbar
North Korean hackers used deepfake video calls in a scheme called FaceStealer to steal over $400 million in cryptocurrency over the past 18 months, according to U.S. authorities.
The U.S. Department of Justice and the FBI issued a warning on November 12, 2026, revealing that North Korean hackers executed a sophisticated social engineering campaign called FaceStealer, resulting in losses exceeding $400 million in cryptocurrency. The scheme relies on deepfake technology and pre-recorded videos to impersonate trusted contacts during video conferences.
The attackers use compromised meeting accounts to invite targets to fake sessions on platforms like Zoom, Microsoft Teams, and Google Meet. Once connected, they play prerecorded videos of known individuals or deepfakes of prominent figures in the crypto industry, creating a false sense of trust before introducing technical issues that lead to malware installation.
The Attack Pattern
The FaceStealer scheme follows a specific sequence: victims receive meeting invites from stolen accounts, join imposter versions of legitimate meeting platforms, encounter deepfake videos of trusted individuals, experience fabricated technical problems, and unknowingly install malware through supposed fixes. This compromise allows attackers to steal funds and access other systems.
The attackers also reached the victim's contact lists, social media and messaging apps to target friends and coworkers next, which keeps the cycle going.
Who Is Behind It
U.S. officials attribute these attacks to North Korean state-sponsored groups operating under multiple aliases including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. These groups primarily target professionals in the cryptocurrency and Web3 sectors, with increasing focus on open-source software developers.
A senior cyber official stated that North Korea relies on large-scale cryptocurrency theft to fund its illicit weapons program. The targeting of software developers suggests an attempt to enable software supply-chain attacks that could affect numerous users through compromised open-source projects.
Authorities' Response
Federal prosecutors in the Central District of California disrupted the hackers' cloud-based infrastructure. Under federal warrant, the FBI seized more than 900 webcam videos of victims. Authorities have also published detailed reports and created a central website with protection tips and resources for potential victims.
Related
