FBI: North Korea Deepfakes Stole $400M Crypto in 18 Months

The FBI has confirmed that North Korean state-sponsored hackers used sophisticated deepfake video calls to steal more than $400 million in cryptocurrency over an 18-month period — a scheme the bureau has named FaceStealer. In a coordinated disruption announced on November 12, 2026, U.S. authorities seized cloud infrastructure and identified over 900 webcam recordings of victims worldwide, exposing one of the most advanced social engineering campaigns ever attributed to Pyongyang.

What Is the FBI FaceStealer Deepfake Crypto Scheme?

FaceStealer is the FBI's name for a North Korean social engineering operation that lures cryptocurrency professionals and Web3 employees into fake video meetings. Attackers linked to the North Korean hacking group Sapphire Sleet — also tracked as APT38, BlueNoroff and Stardust Chollima — send meeting invitations from hijacked accounts on Telegram, LinkedIn, Slack and Discord. The invitations point to convincing replicas of Zoom, Microsoft Teams or Google Meet hosted on North Korean-controlled servers.

Once a target joins, they see what appears to be a trusted colleague or industry contact. In reality, the video is either prerecorded webcam footage stolen from a previous victim or an AI-generated deepfake of a well-known crypto figure. The FBI says victims had no idea the images were fake.

How North Korean Hackers Executed the Deepfake Attack

The Fake Video Call Trick

During the call, the attacker sends a message claiming there is a problem with the victim's connection or audio. The message includes a link to a supposed fix. Anyone who clicks the link is digitally handed over to the hackers, who then gain access to crypto wallets, email accounts and chat messages.

Malware, Webcam Recording, and Account Hijacking

The malware also activates the victim's webcam, allowing attackers to record footage that will be used to impersonate the victim in future calls. Because hackers control the victim's communications, they can convincingly pose as that person when contacting the next target. In some cases, investigators say attackers monitored victims for more than a year before striking.

Who Was Targeted and How Much Was Stolen?

The FBI reports losses exceeding $400 million — more than €350 million — over 18 months. Hackers focused on large players in the crypto industry. 'This was a highly effective method that even the most experienced and cautious computer users fell for,' the FBI warned. 'If you can't imagine a scenario in which this happens to you, you are not thinking creatively enough.'

The scheme has also expanded to target open-source software maintainers, raising concerns about software supply chain security. A single compromised developer laptop with repository or API keys could poison code used by millions.

Impact on Crypto and Open-Source Software

The FaceStealer disruption came alongside a major update on the October 2026 theft of $6 billion from crypto exchange Binance. The FBI said it had already seized or restrained $1.2 billion of those funds, roughly half the breach, and attributed that hack to North Korea's TraderTraitor group. Officials say the regime uses stolen crypto to fund its weapons program. The Binance crypto exchange hack is being laundered rapidly, with a new wallet created about every 25 seconds, according to court filings.

FBI Warning and Recovery Tips for Victims

The FBI urges anyone who believes they may have been targeted by FaceStealer to act immediately:

• Move cryptocurrency to a new, uncompromised wallet or account.
• Log out of all devices and sessions everywhere.
• Change passwords and enable multi-factor authentication.
• Check for unfamiliar devices or account activity.
• Report the incident to the FBI's Internet Crime Complaint Center.

Authorities also advise verifying meeting URLs character by character and confirming contacts through a separate channel before installing any software.

FAQ: North Korea Deepfake Crypto Theft

What is the FBI FaceStealer deepfake crypto scheme?

FaceStealer is a North Korean social engineering campaign that uses fake video calls, stolen webcam footage and AI deepfakes to steal cryptocurrency from professionals in the crypto and Web3 sectors.

How much did North Korea steal using deepfakes?

The FBI says North Korean hackers stole more than $400 million in cryptocurrency over an 18-month period using the FaceStealer scheme.

How do the deepfake video calls work?

Attackers invite targets to fake versions of Zoom, Teams or Meet, show prerecorded or AI-generated video of trusted contacts, then send a malicious link disguised as a connection fix to install malware.

Is North Korea behind the Binance hack too?

Yes. The FBI attributes the October 2026 theft of $6 billion from Binance to North Korea's TraderTraitor group and has already seized or restrained $1.2 billion.

What should I do if I think I was a FaceStealer victim?

Move crypto to a new account, log out everywhere, change passwords, enable multi-factor authentication, and report the incident to the FBI.