U.S. authorities say North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months through a social-engineering operation that relied on secretly recorded webcam footage and AI-generated deepfakes.
The Justice Department said it seized infrastructure used in the campaign, while the FBI described the operation, known as “FaceStealer,” as a method for turning video conference calls into a delivery channel for malware and later theft.
How the scheme worked
According to the FBI, the attackers drew targets into video meetings by using accounts taken from earlier victims. Once a call began, the victim would be shown prerecorded webcam footage of a person they trusted, creating the impression that the contact was present in real time.
Investigators said the group also created deepfake videos of well-known people in the crypto and related industries to strengthen the deception. The aim was to gain enough confidence from the target to get malicious software installed or to otherwise open the door to later compromise.
What happened after access was gained
After the initial deception, the hackers could drain cryptocurrency wallets or abuse the victim’s access to other systems, authorities said. The FBI indicated that the operation was not always immediate, with attackers in some cases waiting months, or even more than a year, before carrying out the theft.
That delay suggests the campaign was not limited to quick wallet grabs. U.S. officials said the access obtained through these calls could also be used in broader intrusions, depending on what systems or credentials a victim controlled.
U.S. agencies link the operation to North Korea
The Justice Department attributed the scheme to North Korean hacking groups identified by several names, including Sapphire Sleet, BlueNoroff and APT38. The announcement accompanied the seizure of infrastructure that officials said supported the operation.
The total amount stolen over the last 18 months was put at more than $400 million. Authorities did not present the campaign as a single isolated incident, but as part of an ongoing effort using repeated impersonation and compromise of trusted accounts.
Broader concern around developer targeting
The DOJ warned that the same North Korean actors have increasingly targeted open-source software developers. Officials said the apparent objective is to create paths for supply-chain attacks, expanding the risk beyond direct theft from individual crypto workers or firms.
As part of the investigation, the FBI said it recovered more than 900 webcam recordings of FaceStealer victims under a federal warrant. That recovery points to the scale of the recording-and-reuse tactic at the center of the case and suggests investigators are still mapping the full scope of the campaign.
What comes next
The immediate confirmed step is the seizure of the operation’s infrastructure by U.S. authorities. Beyond that, officials have publicly highlighted the use of stolen meeting accounts, prerecorded video and deepfakes as the key mechanics of the scheme, as well as the risk to developers whose access could be leveraged for wider attacks.
While the DOJ and FBI have outlined the method and the amount allegedly stolen, the case also underscores that some compromises may remain dormant for long periods before funds are taken or systems are exploited.
Source: decrypt.co