BTC $63,799 
EQQQQ $655.75 Last updated 8 Nov 2026, 12:03 UTC
ETH $1,758 
MGLOEURO $111,813 
USDT $0.9995 
BNB $578.99 
USDC $0.9997 
XRP $0.9063 
SOL $69.69 
TRX $0.3065 Hacks & Security · Explained
FBI warns North Korean fake video calls tied to $400M crypto theft
The bureau says attackers hijacked social accounts and staged fake Zoom or Teams meetings to record webcams and install malware.
Key takeaways
- Fake meetings. Attackers used hijacked social accounts and imitation Zoom or Teams meetings to record webcam footage and push malware.
- Targets. The campaign focused on crypto, Web3, open-source and cybersecurity professionals, with an attempted compromise of a major JavaScript library stopped.
- Disruption. Authorities shut down cloud infrastructure and recovered over 900 victim videos; the FBI says the scheme netted about $400 million.
What happened
The FBI has issued a public warning about North Korean hackers who used fake video calls to record victims and install malware, in a campaign that reports say stole about $400 million in cryptocurrency over roughly 18 months. The Justice Department and the FBI said on Nov. 12 that authorities had shut down cloud infrastructure used in the operation and recovered more than 900 webcam videos belonging to victims, according to CoinGape and CryptoPotato.
According to the FBI account described by Jeremy Robertson, the special agent in charge of counterintelligence and cyber at the bureau's Los Angeles field office, the attackers contact targets through compromised social media accounts, including Telegram and LinkedIn, while posing as people the victims know or respect in the industry. Victims are then directed to imitation Zoom or Microsoft Teams meetings controlled by the hackers. While the victim waits for the meeting to begin, the attackers secretly record the webcam, Robertson said in a video posted on X.
Once the meeting starts, the victim sees recorded footage of the person who supposedly invited them, while the hackers introduce fake audio problems or technical errors and press the target to run an apparent update. That update installs malware that can give the attackers access to the victim's computer, phone, accounts and crypto wallets, the reports said. The FBI said the campaign targeted Web3 and crypto workers, open-source software developers and cybersecurity professionals, and that an attempt to compromise a major open-source JavaScript library earlier this year was stopped before it caused serious harm.
Why it matters
The scheme exploits trust between colleagues and familiar contacts rather than relying only on technical flaws. For developers, access to a device or software repository account could expose widely used projects to supply-chain attacks, which the FBI said was part of the risk. Robertson described the approach as highly effective social engineering and warned that experienced professionals should not assume they would recognize it. Brett Leatherman, director of the FBI's Cyber Branch Operations, said North Korea relies on large-scale crypto theft to fund its illegal weapons program, according to CoinGape.
What the data shows
Reported figures around the case include: about $400 million stolen over 18 months; more than 900 webcam videos recovered; over $2.7 billion frozen in connection with the separate Binance theft; over $1.2 billion restrained after court authorization; and a Binance loss reported as more than $6 billion by CoinGape and $6.3 billion by CryptoPotato. CoinGape also reported that Binance said it had covered 90% of the losses. The reports do not provide a breakdown of the $400 million by victim or asset.
Background
The FBI has previously attributed major crypto thefts to North Korean actors. CryptoPotato reported that the bureau linked last month's Binance breach, described as a $6.3 billion theft, to a DPRK cyber campaign known as TraderTraitor and said stolen assets were being converted into ETH and moved through DeFi platforms and instant swap services. CoinGape reported the Binance loss as more than $6 billion and said US authorities and private partners froze over $2.7 billion linked to the theft, while the department restrained over $1.2 billion after court authorization. The exchange said in October it had covered 90% of the losses, CoinGape reported. Pyongyang has denied the allegations, calling them "absurd rhetoric" and suggesting the United States stood to gain most from the theft, according to CryptoPotato.
What is still unclear
The reports do not use the same name for the campaign: CoinGape calls it FaceStealer, while CryptoPotato calls it FaceDealer. The Binance loss figure also differs between the two reports, at more than $6 billion and $6.3 billion. The reports do not identify the victims or give a detailed accounting of the $400 million.
What to watch
The FBI's public guidance is to verify any meeting invitation through a different communication or social media channel and to avoid installing software through unexpected prompts, according to CoinGape. Because the attackers collected webcam footage from prior victims, authorities have warned that the material could be used for follow-up impersonation attempts. The attempted compromise of an open-source JavaScript library also points to supply-chain risk for projects maintained by targeted developers. The dispute over attribution is likely to continue, with Pyongyang rejecting the US allegations.
Questions readers ask
What is the FaceStealer or FaceDealer campaign?
It is the name used in the reports for a North Korean social engineering operation that used fake video meetings to record victims and install malware, stealing about $400 million over 18 months. CoinGape calls it FaceStealer; CryptoPotato calls it FaceDealer.
How did the fake video call attack work?
Hackers took over social accounts, posed as trusted contacts, and invited targets to imitation Zoom or Teams meetings. They recorded the victim's webcam while the meeting appeared to be starting, then played footage of a previous victim and pushed a fake update that installed malware.
What should crypto and Web3 workers do?
The FBI advises verifying meeting invitations through a separate communication channel and avoiding software installations prompted unexpectedly during a call or message.
