North Korean Hackers Steal More Than $400 Million in Crypto Using Fake Video Calls, FBI Reveals

A sophisticated cybercrime operation allegedly linked to North Korea has stolen more than $400 million in cryptocurrency by exploiting fake video calls and impersonating trusted individuals, according to US authorities. The FBI says the operation, known as FaceStealer, has targeted more than 900 victims over the past 18 months, raising fresh concerns about the growing threat posed by state-sponsored cybercriminal networks.

The latest revelations highlight how cybercriminals are increasingly using advanced social engineering techniques to deceive professionals in the cryptocurrency and Web3 industries. Rather than relying solely on traditional hacking methods, the perpetrators reportedly exploit personal relationships, professional networks and familiar online meeting platforms to gain victims’ trust before stealing their digital assets.

FBI Cyber Division Director Brett Leatherman said North Korea relies on proceeds from large-scale cryptocurrency theft to support its illicit weapons programme, adding that the regime has stolen billions of dollars through cyber operations in recent years.

The disclosure comes just one week after cryptocurrency exchange Binance revealed a massive security breach involving fake job interviews. The incident reportedly resulted in losses of $6.3 billion (£4.7 billion), making it one of the largest cryptocurrency thefts ever reported. US law enforcement agencies have attributed the attack to North Korea-linked cyber actors, although Pyongyang has rejected the allegations.

According to the FBI and the US Department of Justice, the FaceStealer operation aggressively targets people working in cryptocurrency and Web3, particularly developers and professionals involved in maintaining open-source software. These individuals can have access to valuable digital assets, sensitive systems and important technical infrastructure, making them attractive targets for sophisticated cybercriminal groups.

Investigators say the hackers use fake or compromised social media accounts to approach potential victims and invite them to video meetings. The invitations appear legitimate and are designed to resemble ordinary professional interactions. Victims are then directed to fraudulent versions of familiar platforms, including Zoom, Microsoft Teams and Google Meet.

Once the meeting begins, the attackers reportedly play pre-recorded videos featuring people known to the intended victims. The recordings are used to create the impression that the participants are familiar colleagues, professional contacts or trusted associates. During the interaction, the audio may appear to malfunction, creating an opportunity for the attackers to manipulate the victim into following further instructions.

The operation demonstrates how artificial intelligence-era impersonation techniques and increasingly convincing digital identities are creating new challenges for cybersecurity professionals and cryptocurrency businesses. As digital finance continues to expand, the ability to distinguish genuine professional communications from sophisticated impersonation attempts is becoming increasingly important.

With cryptocurrency theft remaining a major source of concern for international law enforcement, the latest FBI findings underline the growing intersection between cybercrime, geopolitical tensions and digital financial security. Authorities are urging greater vigilance across the technology sector as attackers continue to develop more convincing methods of deception.