FBI: North Korean hackers used fake video calls to steal over $400m in crypto
US authorities say state-sponsored North Korean hackers stole more than $400 million in cryptocurrency from over 900 victims using fake video calls. The FBI calls the scheme FaceStealer.
The US Federal Bureau of Investigation (FBI) and the Justice Department say state-sponsored hackers from North Korea have stolen more than $400 million in cryptocurrency over the past 18 months using fake video calls. According to the bureau, more than 900 people have fallen victim to the scheme, which the FBI calls FaceStealer. It is the latest crypto theft campaign linked to North Korea.
FBI cyber director Brett Leatherman says the North Korean regime relies on the proceeds of large-scale crypto theft to fund its illicit weapons programme, and has stolen billions of dollars in recent years.
How the scheme works
Authorities say FaceStealer aggressively targets people working in the cryptocurrency and web3 sectors, particularly those who develop and maintain open-source software. The hackers use fake or hijacked social media accounts to invite potential victims to video calls hosted on imposter versions of Zoom, Microsoft Teams and Google Meet.
During the call, pre-recorded videos of earlier victims whom the target knows are played to make it look genuine, but the audio appears to malfunction. A message then asks the target to "fix" the sound by clicking a link. The "fix" downloads malware onto the device, giving the hackers access to contacts and apps and widening the pool of potential victims. The hackers secretly record these calls and use the recordings to deceive new victims.
Link to the Binance hack
The announcement comes a week after Binance, the world's largest crypto exchange, revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. US law enforcement attributed that attack, thought to be the largest crypto hack to date, to North Korea-linked actors. Pyongyang has denied the claim.
Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said in a statement on Thursday that the scheme exploits trust in widely used video conferencing platforms and valued personal relationships. The FBI describes it as a highly effective social engineering scheme capable of deceiving even experienced, security-conscious users.
