State-sponsored hackers from North Korea have taken more than $400 million in cryptocurrency by using fake video calls to steal identities, U.S. authorities say, in a scheme the FBI calls FaceStealer that has reached more than 900 victims in the past 18 months, the BBC reported. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," FBI cyber director Brett Leatherman said. Authorities say the scheme "aggressively targets" people who work in cryptocurrency and web3, especially those who develop or maintain open-source software. The FBI and the Justice Department say the hackers use fake or hijacked social media accounts to invite targets onto video calls hosted on "imposter versions" of Zoom, Microsoft Teams and Google Meet, then play pre-recorded videos of people the target knows and prompt them to click a link that supposedly fixes broken audio, which installs malware.
The malware, the bureau said, can open contact lists and apps and widen the pool of later victims; the calls themselves are secretly recorded and reused. The FBI has called FaceStealer "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." "It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Patrick Grandy, assistant director in charge of the Los Angeles field office, said in a Thursday statement. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough." The report is an official warning about a social-engineering campaign, not a technical manual for carrying it out.
The FaceStealer figures were announced a week after Binance, the world's largest crypto exchange, said hackers had used fake job interviews to steal a record $6.3 billion, or about 4.7 billion pounds, from the company. U.S. agencies have attributed that separate hack to North Korea-linked actors; Pyongyang has denied the claim. The Binance case is context for a broader pattern U.S. officials describe, not the same 900-victim FaceStealer tally, and the $400 million and $6.3 billion figures should not be added together as a single theft.
The verified news is the FBI's FaceStealer attribution, a $400 million estimate, more than 900 victims, and the public description of fake video-call invitations. It is not a court conviction of named individuals, and North Korea's denial in the related Binance case is part of the record.