North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using fake video calls, the FBI warned on Thursday.
The scheme, which the FBI calls "FaceStealer," lures targets to video chats on imposter versions of Zoom, Microsoft Teams and Google Meet. Invitations come from genuine contacts whose social media accounts have been compromised and whose images were secretly recorded. Once on the call, victims encounter a mock audio error. A message prompts them to click a link to "fix" the sound, which installs malware on their devices.
The malware gives hackers access to victims' contact lists and applications, allowing them to target additional people. More than 900 people have fallen victim to the scheme over the past 18 months. The FBI has seized more than 900 webcam videos of victims from around the world. The hackers secretly record the calls and use the footage to deceive new targets.
The FBI attributes the activity to a North Korean cluster known as "Sapphire Sleet" or UNC1069. The group aggressively targets workers in the cryptocurrency and Web3 industries, particularly open-source software developers. The FBI warned that anyone who holds cryptocurrency or works in the industry could be a target. Brett Leatherman, the FBI's cyber operations director, said the regime uses the stolen funds to finance its illegal weapons program.
The FBI also disrupted the cloud infrastructure the hackers used during the operation. The hackers use artificial intelligence to create deepfake videos of well-known figures in the cryptocurrency industry for use during video calls. Patrick Grandy, deputy director of the FBI's Los Angeles office, said the attack exploits trust in video platforms and personal relationships.
"If you cannot imagine a scenario where you could fall victim to such a scam, you do not have enough imagination," Grandy said. The warning comes one week after hackers stole $6.3 billion from the Binance exchange, an attack also blamed on North Korea. North Korea has not commented on the accusations.
