North Korean Hackers Steal $400M via FaceStealer Scam

North Korean-linked hackers blamed for $400M crypto heist

U.S. authorities say sophisticated North Korean cyber actors have exploited fake video calls and stolen identities to steal more than $400 million in cryptocurrency. The FBI and Department of Justice have named the campaign "FaceStealer," warning that it specifically targets crypto and Web3 professionals, including open-source developers and maintainers who work on blockchain projects.

How FaceStealer works: social engineering meets malware

According to investigators, attackers use compromised or spoofed social media accounts to lure victims into what appear to be legitimate video calls. The fake sessions are staged on counterfeit versions of trusted platforms such as Microsoft Teams, Zoom and Google Meet. In many cases, prerecorded footage of acquaintances or colleagues is played to make the call seem authentic while the audio is intentionally disrupted.

Victims see a prompt on their screen asking them to click a link to "fix the audio problem." That seemingly innocuous link ultimately installs malware on the target's device. The malicious software harvests contact lists and scans installed applications, enabling attackers to expand their reach to additional victims across the victim's network.

U.S. officials say perpetrators also secretly record these engineered conversations and reuse the captured video to trick new targets, creating a vicious cycle of deception. The FBI has described FaceStealer as a "highly effective social-engineering operation" capable of deceiving even technically experienced users.

Connections to major crypto breaches and funding illicit programs

The FaceStealer alert follows public attribution by U.S. agencies that North Korea-linked groups were responsible for one of the largest recorded crypto thefts to date: a reported $6.3 billion breach of Binance that involved fake hiring interviews. While Pyongyang has denied such allegations, U.S. authorities assert that stolen crypto funds are used to finance prohibited weapons and other illicit programs.

This pattern highlights ongoing risks to decentralized finance (DeFi), blockchain projects and centralized exchanges alike. Attackers focus on Web3 developers, governance participants and anyone with privileged access to wallets, private keys or deployment systems.

Mitigation and best practices for crypto users and organizations

Security experts recommend several practical defenses against FaceStealer-style schemes:

• Verify caller identities through secondary channels before joining unsolicited video calls.
• Avoid clicking links during unverified meetings; use device-level protections and endpoint detection.
• Enable multi-factor authentication (MFA) and hardware security keys for exchange and wallet accounts.
• Isolate sensitive keys in hardware wallets and limit access to build and deployment tools.
• Educate teams about social-engineering tactics and run regular security drills.

As digital asset adoption grows, so does the sophistication of targeted attacks. Blockchain projects, exchanges and individual crypto holders should treat social engineering and malware risk as a central part of their security posture to protect funds, code and community trust.