North Korea's Fake Video Calls: Deepfake Scam Nets More Than $400 Million

What's going on

On November 12, 2026, the US Department of Justice and the FBI announced action against a North Korean hacking campaign that the FBI calls "FaceStealer." According to the FBI, state-backed North Korean hackers used it to steal more than $400 million in cryptocurrency over the past 18 months. The trick is fake video conferences where victims see faces they think they know. In reality, those faces are secretly recorded videos of earlier victims or AI-generated deepfakes: synthetic videos of real people that look convincingly real.

Acting on a federal court order, the FBI seized the campaign's cloud servers and recovered more than 900 webcam videos of victims. The FBI also published a report with protective recommendations and launched an information page: www.fbi.gov/facestealer. Alongside this, the Justice Department reported progress in a separate case: the multibillion-dollar theft from crypto exchange Binance in late October.

How the FaceStealer scam works

The group behind it goes by many names in the security world: Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. APT stands for "Advanced Persistent Threat," the label security researchers use for especially persistent hacking groups, usually state-directed.

The Justice Department and a report by Nextgov describe the attack in several steps:

1. An invite from a real account: The meeting invitation comes from an account the hackers previously stole from an earlier victim, for example on Telegram, LinkedIn, Slack or Discord. Because the attackers can read past conversations, their messages sound familiar, Jeremy Robertson, a leader at the FBI's Los Angeles field office, told reporters.
2. A fake meeting page: The link leads to a website that looks like Zoom or Microsoft Teams.
3. Familiar faces: In the meeting, the target sees a recording of someone they know. Sometimes the attackers add extra fake participants to make the call look more real. According to the Justice Department, they also use AI to create deepfake videos of well-known, influential people in the crypto and Web3 industry. (The press release literally refers to "super intelligence (SI)". It's an unusual term that probably just means AI tools. What exactly was used isn't clear.)
4. The staged glitch: Next, a supposed technical problem pops up, such as the victim not being audible. A link or set of instructions is offered to fix it, for example running a script or pasting commands into the terminal, the computer's command line.
5. The infection: The "fix" actually installs malware that logs keystrokes, takes screenshots and gives the hackers persistent access.

At the same time, the fake page records the new victim's webcam during the meeting. The attackers combine this footage with the stolen accounts and contact lists to go after the next acquaintance. The scam feeds itself: every victim provides the face for the next attack.

What makes it especially insidious is the waiting. In several cases, the attackers struck months or even more than a year after the initial infection, stealing cryptocurrency and hijacking communication accounts.

"This isn't something we can fix with a patch," the FBI's Robertson said, according to Nextgov. He called the scam "very, very convincing."

Patrick Grandy, head of the FBI's Los Angeles field office, put it this way:

"If you can't imagine a scenario in which you'd fall for this, you're not thinking creatively enough."

New target: open-source developers

The FBI says the hackers go after people in crypto and Web3 (blockchain-based internet services). But they're also increasingly targeting developers who maintain open-source software. These freely available code components end up in countless applications built by other companies. If attackers hijack a maintainer's account, they can slip malicious code into software that thousands of others download. That's known as a supply-chain attack: an attack through the software supply chain.

According to Nextgov, that has already happened. Earlier this year, a maintainer of a JavaScript library joined a fake Teams meeting with someone he knew, followed the instructions and infected his machine. The hackers then added malicious code to the software. The FBI says the attack was caught and stopped before it could spread widely. The sources don't say which library was affected.

Justin Moore of security firm Arctic Wolf, which is helping the FBI track the campaign, told Nextgov it has expanded significantly. Over the past six months, he said, the operation has grown sharply in scale and sophistication. Arctic Wolf has identified more than 677 targets in 58 countries. And the tactics now go well beyond fake meetings, reaching into document-sharing platforms, fake identity checks, media content and other familiar business workflows.

The separate case: $6.3 billion from Binance

Separately from FaceStealer, members of the North Korean military, whom the FBI calls "TraderTraitor," stole more than $6 billion in crypto assets from the Binance exchange on or around October 29. Nextgov and Gizmodo put the figure at about $6.3 billion. According to Nextgov, Binance said the attackers compromised an engineer's computer through a fake job interview, giving them access to systems used to approve transfers. Authorities believe the two campaigns are likely run by different North Korean groups.

Authorities and private companies have frozen more than $2.7 billion so far. The Justice Department has obtained court orders to seize or block more than $1.2 billion of that. That sum is part of the $2.7 billion, not on top of it. A senior official told Nextgov the government now holds these funds, and courts will have to decide how they get back to their owners. Further recoveries will be harder, the official said, because the hackers are splitting the money into small amounts:

"These actors have gotten very good at laundering money. They've learned from their previous attempts and from our countermeasures."

Laundering through throwaway memecoins

Blockchain analytics firm Elliptic looked into how the laundering works, Gizmodo reports. One method: the thieves create their own memecoins (joke cryptocurrencies with no real value) and pair them with another cryptocurrency in a liquidity pool, a kind of automated swap pot on a decentralized exchange. One group of wallets buys the token with stolen funds. A second group, also controlled by the thieves, sells it again. Since no money moves directly between the wallets, the sellers look like ordinary traders turning a profit.

On the NEAR blockchain, at least six such tokens appeared within three days, with names like FUK, MEILI and SINU. Each cost about $90 to create, and one featured an image of Elon Musk under an "Elon 2028 President" banner. Around 117,000 NEAR (about $430,000) passed through them, less than 0.01 percent of the haul. Overall, Elliptic says the laundering network spans more than 20,000 wallets on 16 blockchains and at least 36 services. Those include mixers like Tornado Cash, which blend transaction flows together, and the swap platform THORChain. The end goal appears to be Bitcoin: roughly 3,000 BTC (about $225 million) already sits at new addresses. The thieves lost about $3 billion almost immediately, though, because Tether, Circle and others froze the funds. According to Elliptic, Tether did so just 37 minutes after the funds arrived.

The bigger picture

FaceStealer shows how AI and stolen videos are changing social engineering, the practice of tricking people rather than machines. A video call with a familiar face long counted as a solid way to verify someone. Attackers are now exploiting that trust systematically. Even security-conscious developers fall for it, so the scam is also dangerous for companies that have nothing to do with crypto: compromised open-source projects can carry malicious code into many products.

The practical lesson is simple. Never run scripts or paste commands into your terminal because someone in a meeting tells you to, supposedly to fix audio or video problems. It doesn't matter who's on screen. If in doubt, verify the contact through a second, independent channel.

It's still unclear how much of the FaceStealer haul can be recovered; the sources give no figure. Nor do they say how much of the material was genuine AI deepfakes and how much was simply reused recordings. Seizing the servers will likely disrupt the campaign but probably won't end it. The FBI itself stresses that this kind of attack can't be "patched away."