U.S. authorities have disrupted a sophisticated North Korean cyber operation that stole more than $400 million in cryptocurrency over the past 18 months by luring victims into fabricated video conference calls. The Federal Bureau of Investigation and Department of Justice announced the seizure of cloud-based infrastructure supporting the campaign, known as FaceStealer, along with more than 900 secretly recorded webcam videos of victims.

The operation targeted individuals in the cryptocurrency and Web3 sectors as well as maintainers of open-source software. Officials linked the activity to North Korean actors tracked under names including Sapphire Sleet, BlueNoroff, APT38, UNC1069 and Stardust Chollima.

How the Scheme Operated

Hackers first compromised communication accounts belonging to earlier victims on platforms such as Telegram, LinkedIn, Slack and Discord. Using those accounts and access to prior chat histories, they contacted the victims’ professional and personal contacts with invitations that appeared legitimate. Messages often proposed a catch-up conversation or discussion of an investment opportunity, sometimes scheduled through Calendly.

Meeting links directed targets to lookalike domains designed to mimic Zoom, Microsoft Teams or Google Meet. Once a target joined, attackers played prerecorded webcam footage of people the target knew, occasionally combined with clips of other apparent participants. In some instances they also deployed artificial intelligence-generated deepfakes of well-known figures in the cryptocurrency industry. Officials noted that the quality needed only to be sufficient to pass as ordinary webcam video.

During the call, attackers introduced a simulated technical problem, typically claiming the target’s audio was not working. They then provided instructions or a link to “fix” the issue. Following those steps caused the installation of malware that included cookie harvesters, keyloggers, screen-capture tools and backdoors. The victim’s own webcam was recorded from the moment the malicious link was clicked, generating fresh material for subsequent attacks.

In multiple cases, the attackers waited months or more than a year after the initial compromise before draining cryptocurrency wallets, allowing balances to grow. Compromised devices also yielded contact lists and access that expanded the pool of potential new targets.

Supply-Chain Targeting

Beyond direct cryptocurrency theft, the group increasingly focused on open-source software maintainers. In one case earlier this year, attackers drew the maintainer of a widely used JavaScript library into a fake Microsoft Teams call that included at least one recognizable participant. The individual executed the provided “fix,” giving the hackers access that was then used to prepare malicious dependencies. That effort was detected and halted before the modified packages could reach the library’s large user base. Similar attempts against npm package maintainers and, more recently, maintainers of Rust crates have also been observed.

Officials described the approach as calculated to enable broader software supply-chain compromises.

Separate Binance Action

In a distinct but concurrent announcement, the Justice Department obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from the Binance exchange in late October. That theft, attributed to a different North Korean group known as TraderTraitor, totaled more than $6.3 billion. Combined public- and private-sector efforts have so far frozen more than $2.7 billion of those funds. Officials stated the FaceStealer and Binance operations involved different actors.

Protective Measures

The FBI advised crypto and Web3 professionals as well as open-source maintainers to keep webcams disabled until they can clearly see, hear and converse with the person who issued the invitation. Users should join meetings only through official applications using verified invite codes and confirm details through a separate channel, such as a phone call. Authorities strongly cautioned against running scripts or pasting commands to resolve purported technical problems during calls.

Additional recommendations include limiting funds held in browser-extension wallets and ensuring recovery phrases or private keys are never stored on internet-connected devices. Anyone who suspects compromise is advised to create a new wallet on a clean device and transfer assets immediately.

The FBI has published detailed guidance and established a dedicated resource page for information on the FaceStealer campaign.