North Korean FaceStealer scheme steals over $400 million in cryptocurrency

US authorities say a North Korean state-linked hacking operation known as FaceStealer has stolen more than $400 million in cryptocurrency by using fake video calls to impersonate victims and spread malware. The FBI reports that more than 900 people fell victim to the scheme in the last 18 months, and that the campaign targets professionals in the cryptocurrency and web3 sectors, including open-source software contributors.

According to the FBI and the US Justice Department, attackers use fake or hijacked social media accounts to lure targets into video calls hosted on impersonated versions of Zoom, Microsoft Teams, and Google Meet. In those calls, the hackers play pre-recorded footage of acquaintances while simulating audio problems, then prompt the target to click a link to “fix” the audio. That link delivers malware which gives the attackers access to contacts and applications on the compromised device, enabling them to expand their pool of victims.

Investigators say the hackers secretly record these interactions and later use the recordings to deceive further targets. The FBI described FaceStealer as a highly effective social engineering campaign capable of deceiving even experienced and security conscious users, and warned that it exploits trust in ubiquitous video-conferencing platforms and personal relationships.

Liberal News Analysis: What Does This Development Mean?

The reported FaceStealer campaign demonstrates how state-linked actors are adapting social engineering techniques to exploit everyday collaboration tools and personal networks for large scale financial gain. By combining realistic impersonation with malware delivery through familiar platforms, the operation increases its potential reach and bypasses many common user assumptions about the safety of video calls. The scale and reported financial impact underscore the persistent cyber threat facing the cryptocurrency ecosystem and the difficulty of defending against sophisticated trust-based intrusions.

Quick Glance: What You Need to Know

• FaceStealer has reportedly stolen more than $400 million in cryptocurrency using fake video calls and malware deployment.
• More than 900 victims were identified by the FBI over an 18 month period.
• Attackers allegedly use fake or hijacked social accounts and impersonated video‑conference platforms to lure targets.
• The campaign specifically targets professionals in cryptocurrency, web3, and open‑source software development.
• Malware delivered via a fake audio “fix” enables attackers to access contacts and apps and to record calls for further scams.