FBI attributes $400M crypto theft to North Korean-linked deepfake video-call campaign
U.S. authorities attribute a $400 million cryptocurrency theft to North Korean-linked actors using deepfake video calls, stolen accounts and malware lures. The campaign exploits trust in video meetings and self-propagates through compromised communication platforms. It matters because it shows how identity impersonation can bypass technical defenses and directly endanger digital assets.
The scheme, called FaceStealer, lured crypto and Web3 users into video meetings using stolen accounts belonging to prior victims, according to the FBI and Justice Department. Participants had their video streams recorded while attackers showed a prerecorded or deepfake webcam image of a known contact to build trust. After a few seconds, the meeting displayed a fake audio or technical error and offered a link to fix it.
The fix link used a ClickFix-style lure, telling victims to paste or download a supposed fix, to install malware, harvest cryptocurrency wallets and seed phrases, the recovery phrases that unlock wallets, and abuse access to other computer infrastructure, the reports said. U.S. officials attribute the campaign to North Korea, while private researchers track it as BlueNoroff, also known as APT38. The Justice Department said the stolen proceeds fund Pyongyang's illicit weapons program, and separate private reporting linked overlapping tactics to Kaspersky's GhostCall.
The pattern matters because it turns trust itself into the attack surface. JUMPSEC described FaceStealer as a victim acquisition platform that hijacks Telegram, LinkedIn, Slack and Discord accounts, then mines contact lists and chat histories to recruit the next target. That makes the campaign self-propagating: each compromised person becomes a credible sender for future meetings. The use of deepfakes is not a novel malware trick so much as a cheap way to make stolen identities look live and familiar.
The exposure is concentrated in crypto and Web3, where a single video call can unlock wallets, exchange accounts or enterprise systems. For ordinary users, the practical effect is that a familiar face and voice on a call no longer prove who is on the other end. The U.S. action shows authorities can disrupt infrastructure, but the underlying method remains low-cost: impersonate a trusted person, fake a technical problem, and make the victim install the malware themselves.
It affects anyone who uses video calls to verify identity, especially crypto users, because a familiar face can be fabricated or replayed to trick them into installing malware and surrendering wallets.
Sources (1)
- [1]Original source(https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html)