FBI Warns Of $400 Million North Korean Crypto Heist Using Stolen Webcam Videos - Tampa Free Press

Federal investigators have uncovered a massive cybercrime operation where North Korean state-sponsored hackers secretly recorded more than 900 tech workers on their webcams and used the footage to steal over $400 million in cryptocurrency. In a public security alert released on November 12, 2026, the FBI detailed the social engineering campaign, which the agency tracks under the name 'FaceStealer.'

According to the FBI, the operation has unfolded over the past 18 months and is linked to state-backed North Korean hacking groups known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.

The FaceStealer Method

The scheme relies on turning one victim's digital identity into bait for the next. Hackers begin by hijacking legitimate accounts on platforms like Telegram, LinkedIn, Slack, and Discord. Using these stolen accounts, they message the victim's contacts to set up video calls under familiar pretexts, such as wanting to 'catch up,' 'discuss collaboration,' or 'talk about investment opportunities.'

Once a target agrees to talk, the hackers often send a legitimate calendar invite through services like Calendly. Just before the meeting starts, they send a link to what looks like a standard Zoom, Microsoft Teams, or Google Meet room. In reality, the link leads to a lookalike website hosted on a North Korean server, using slightly misspelled web addresses like 'uu01webzoom.us' or 'teams.livemeet.us.'

When the target clicks the link and enters the fake lobby, the hackers quietly begin recording the target's own webcam. Once the call begins, the attackers play prerecorded webcam loops of previous victims—and sometimes multiple fake participants at once—to make it look like a real group meeting is underway.

Financial and Code Damage

Following the instructions installs hidden malware capable of logging keystrokes, capturing screenshots, harvesting browser cookies, and creating a permanent backdoor into the machine. The FBI confirmed it has identified and seized over 900 of these stolen victim videos used to keep the chain of compromises running.

The financial toll has been steep, though the hackers are often patient. In several cases documented by the bureau, the attackers waited months—and sometimes more than a year—after infecting a computer before draining any funds, watching blockchain activity until a victim's cryptocurrency wallet balance grew larger.

Beyond personal crypto wallets, the hackers have also used FaceStealer to target open-source software maintainers in an effort to poison widely used code. Earlier this year, attackers lured the maintainer of a major JavaScript library into a fake Teams call using the same video-loop trick. After the maintainer ran the fake audio fix, the hackers used his credentials to plant malicious code into the library, which gets tens of millions of downloads every week.

Prevention Measures

To help tech workers and developers avoid the trap, the FBI advises joining meetings directly through official apps using a meeting ID rather than clicking links, and keeping webcams turned off until the other person on the call actually speaks and interacts. Investigators also urge users never to run terminal commands or scripts to fix video chat glitches, to verify meeting requests through a second method like a phone call or text message, and to store large cryptocurrency holdings on offline hardware wallets rather than browser extensions.

Anyone who suspects they have been targeted is asked to move their funds to a clean wallet, alert their contacts and employers, and file a report at IC3.gov using the keyword 'FaceStealer.' The bureau also warned that the attackers have begun experimenting with super intelligence to generate deepfake videos of prominent figures in the cryptocurrency and web3 spaces.