Key Notes
- The FBI links FaceStealer to more than $400 million in cryptocurrency theft over 18 months.
- The campaign mainly reuses stolen webcam recordings and hijacked accounts to persuade targets to install malware.
- The bureau warns that compromised software maintainers can expose wider supply chains, while the Binance theft is a separate operation.
North Korean hackers have stolen more than $400 million in cryptocurrency over 18 months by impersonating trusted contacts in fake video meetings, according to the FBI. The operation, called FaceStealer, turns recordings and hijacked accounts from earlier victims into tools for approaching new targets.
A November 12 FBI advisory describes a campaign aimed at cryptocurrency professionals and open-source software maintainers. Investigators identified and seized more than 900 victim webcam videos used in subsequent impersonation attempts.
A Familiar Face Hides a Malicious Meeting
Attackers send invitations through genuine accounts taken over from people the target knows, including accounts on Telegram, LinkedIn, Slack and Discord. Previous conversations help them tailor messages about collaboration, investment opportunities or simply catching up.
The invitation leads to a counterfeit meeting service resembling Zoom, Microsoft Teams or Google Meet. As Reuters reported, a familiar person appears on screen because the hackers replay footage recorded during an earlier compromise. The new target’s webcam is also recorded.
The impostors then claim the target’s audio is broken and offer a supposed repair. Following the instructions installs malware that can steal cryptocurrency, take over accounts or provide access to an employer’s systems.
Microsoft’s April technical analysis described a related Sapphire Sleet intrusion using a fake Zoom update on macOS. Users were persuaded to execute malicious scripts, after which the attackers harvested credentials and installed persistent backdoors.
Stolen Recordings Remain More Common Than Deepfakes
The FBI says the campaign still overwhelmingly relies on genuine footage stolen from victims. Attackers have also begun generating deepfakes of prominent crypto figures, adding apparent participants to make fraudulent meetings more convincing.
A compromise does not always produce an immediate theft. In several cases, hackers waited months to more than a year before stealing funds, monitoring wallet balances while retaining access to credentials or recovery information.
The bureau also describes attempts to compromise software maintainers. One attack reached a major JavaScript library’s maintainer and created malicious dependencies before detection interrupted the effort. The FBI did not name the library.
Authorities disclosed FaceStealer alongside Binance recovery efforts. The Justice Department describes the video-call campaign and the Binance theft as separate operations, rather than attributing that exchange attack to FaceStealer.
Verify the Invitation Through Another Channel
The FBI recommends joining meetings through official applications with an invitation code and confirming unexpected requests through a different communication channel. A message from an established account is insufficient reassurance when the account itself may be compromised.
Users should avoid running scripts or terminal commands presented as meeting updates. The advisory recommends updating applications separately, enabling multifactor authentication and login alerts, and keeping recovery phrases off connected devices.
People who suspect a compromise should secure assets using a clean device and a new wallet, revoke compromised account sessions, warn contacts and employers, and report the incident to the FBI’s Internet Crime Complaint Center using the keyword FaceStealer.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
