WASHINGTON — North Korean state-backed hackers used fake video meetings, secretly recorded webcam footage and malicious “technical fixes” to steal more than $400 million in cryptocurrency during the past 18 months, the FBI and Justice Department said Thursday.
Federal authorities call the social-engineering operation “FaceStealer.” The campaign allegedly exploited trusted personal and professional relationships by taking over real communication accounts, inviting new targets to fraudulent video calls and showing prerecorded or AI-generated images of people the victims recognized.
How the FaceStealer scheme worked
According to the Justice Department, targets received meeting invitations from genuine accounts belonging to contacts who had already been compromised. The meeting websites were designed to resemble widely used video-conferencing services.
During the fake call, hackers allegedly created an audio or technical problem and directed the target to click a link, paste a command or install a supposed repair. The “fix” instead installed malware capable of recording keystrokes, capturing screens, stealing cryptocurrency and giving the attackers continuing access to accounts and devices.
The newly compromised victim’s webcam footage, messages and contact lists could then be reused to approach another person. Reuters reported that the FBI identified and seized more than 900 victim webcam videos connected to the operation.
Hackers also targeted software developers
Authorities said the campaign initially concentrated on cryptocurrency and Web3 professionals but increasingly targeted developers and maintainers of open-source software. Investigators believe the goal was to gain access to software repositories and potentially insert malicious code into programs used by many other people and organizations.
The FBI attributed FaceStealer to a North Korean hacking cluster known by several names, including Sapphire Sleet and UNC1069. These remain allegations by U.S. authorities; North Korea has repeatedly denied accusations that it sponsors cryptocurrency theft and other cyberattacks.
U.S. seizes infrastructure and stolen cryptocurrency
Federal agents seized cloud infrastructure allegedly used to operate FaceStealer. In a separate action announced the same day, the Justice Department obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen during the recent $6.3 billion Binance breach.
The Associated Press reported that U.S. officials believe different North Korean groups were involved in the Binance theft and the FaceStealer campaign. Authorities say North Korea uses proceeds from cryptocurrency crime to support the government and weapons programs.
Warning signs and protective steps
- Do not install software or paste computer commands to repair an unexpected video-call problem.
- Verify unusual meeting invitations by contacting the sender through a separate, trusted method.
- Be suspicious when a familiar person cannot speak normally or suddenly asks you to run a download.
- Use multifactor authentication and unique passwords on messaging, email and financial accounts.
- If a device may be compromised, disconnect it from the network and contact a qualified security professional.
The FBI has created a FaceStealer information hub with additional guidance and reporting resources. The investigation and efforts to recover stolen assets remain ongoing.
