FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
FBI: North Korea’s FaceStealer campaign used deepfake video calls to steal over $400M in crypto from founders and executives. Infrastructure seized.
What’s new: The FBI says North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months through FaceStealer, a hard-to-detect social engineering campaign. Attackers use deepfake video calls that impersonate trusted contacts to lure victims into installing malware that compromises their devices and crypto wallets. The activity has been linked to the BlueNoroff threat cluster.
Government action
- The FBI seized the cloud-based infrastructure used in the campaign.
- The FBI also seized more than 900 victim webcam recordings that were used to impersonate victims.
- Separately, the DoJ announced the court-authorized seizure and restraint of over $1.2 billion in crypto stolen by TraderTraitor actors after the Binance hack.
Who’s affected
Targets are people in cryptocurrency and Web3, especially founders and executives with access to funds or wallets, plus software developers and open-source maintainers. An April 2026 Arctic Wolf report counted more than 400 victims in over 20 countries; a later update identified 677 targets across 58 countries, more than 80% of them founders or C-suite executives. The maintainer of the Axios npm package was reportedly targeted in an attempt to push a trojanized release.
What to do
- Verify unexpected video-call requests through a separate, known channel before joining or acting on them, even when the caller looks familiar.
- Run interview assignments or any files received during hiring in a disposable virtual machine, never on a work laptop (JFrog’s recommendation).
- Warn staff, especially executives and maintainers, about unknown files, even from seemingly trusted sources.
