North Korean Hackers Steal Over $400 Million Through FaceStealer Deepfake Attacks
FHN 
North Korean state-linked hackers have stolen more than $400 million in cryptocurrency over the past 18 months through a sophisticated social engineering campaign involving deepfake videos and fraudulent video meetings, according to the U.S. Federal Bureau of Investigation (FBI).
The campaign, identified as FaceStealer, primarily targets individuals and organizations in the cryptocurrency and Web3 sectors. As part of a coordinated law enforcement operation, U.S. authorities have seized the cloud infrastructure used to support the attacks.
The FBI also recovered more than 900 secretly recorded webcam videos that attackers allegedly used to impersonate victims and deceive additional targets.
How the FaceStealer Campaign Works
The attackers reportedly exploit compromised accounts belonging to previous victims on communication platforms such as Telegram, LinkedIn, Slack and Discord.
Using these accounts, they approach potential targets with invitations to video meetings, often pretending to be trusted professional contacts or industry acquaintances.
Victims are directed to fraudulent websites impersonating legitimate video conferencing services such as Zoom and Microsoft Teams. During these meetings, attackers use prerecorded webcam footage or AI-generated deepfake videos to imitate familiar individuals and establish trust.
Once the meeting begins, attackers introduce a fake technical issue, such as an audio or connection problem. Victims are then instructed to click a link, download an update or execute a command to resolve the supposed issue.
These instructions are designed to trigger malware installation and compromise the victim’s device.
Stolen Videos Help Attackers Target More Victims
One of the campaign’s most concerning features is its ability to reuse compromised victims’ identities to target additional individuals.
According to the FBI, attackers secretly record victims during video meetings and store the footage for use in subsequent impersonation attempts.
The seized infrastructure reportedly contained more than 900 webcam recordings. These videos can help attackers impersonate previously compromised individuals and approach their professional and personal contacts.
The campaign creates a self-propagating attack cycle: each compromised account provides access to additional contacts, increasing the pool of potential victims.
The attackers have also reportedly used AI-generated videos of influential individuals in the cryptocurrency and Web3 industries to make fraudulent meetings more convincing.
BlueNoroff Linked to the Campaign
The activity has been associated with BlueNoroff, a North Korean-linked threat group also tracked under names including APT38, Sapphire Sleet and Stardust Chollima.
The group is known for financially motivated cyber operations, particularly attacks targeting cryptocurrency businesses, blockchain organizations and individuals with access to digital assets.
Researchers have also identified connections between FaceStealer tactics and earlier campaigns involving fraudulent video meetings and social engineering.
Beyond stealing cryptocurrency, the attackers reportedly target software developers and open-source maintainers to gain access to development environments and software repositories, potentially enabling further supply-chain attacks.
U.S. Authorities Seize Attack Infrastructure
The FBI and U.S. Department of Justice announced coordinated actions to disrupt the campaign, including the seizure of cloud-based infrastructure associated with FaceStealer.
The FBI confirmed that more than 900 victim webcam videos were recovered during the operation.
Separately, the Department of Justice announced court-authorized action to seize or restrain more than $1.2 billion in cryptocurrency stolen in the recent Binance security incident, which U.S. authorities attribute to another North Korean-linked group known as TraderTraitor.
Investigators and private-sector partners have reportedly frozen more than $2.7 billion of the stolen Binance funds.
These actions highlight the growing focus of law enforcement agencies on disrupting the infrastructure and financial networks supporting state-linked cryptocurrency theft.
About the Author
