DOJ Says North Korean Hackers Stole $400 Million Via Deepfake Video Calls

The U.S. Justice Department said Thursday that North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months through "FaceStealer," a social-engineering operation that used secretly recorded webcam footage and AI-generated deepfakes to impersonate trusted contacts on video calls. The announcement coincided with the seizure of the infrastructure behind the operation.

The FBI's designation of the scheme as FaceStealer describes a specific and repeatable attack pattern rather than a novel exploit. Hackers lure targets into video meetings using accounts stolen from previous victims. Once the call begins, they play prerecorded webcam footage of people the target already trusts, simulating those individuals' presence and manufacturing credibility before any credential or fund transfer is requested.

The $400 million figure covers an 18-month window, which translates to an average of roughly $22 million stolen per month, or more than $700,000 per day, sustained across the campaign. That scale places FaceStealer among the more productive cryptocurrency theft operations attributed to North Korean state-linked groups, and it was achieved without breaching protocol code or smart contracts. The attack surface is human.

What does this change for developers and crypto firms?

For practitioners, the DOJ's account shifts the threat model. The attack does not depend on a malformed transaction or a vulnerable wallet library. It depends on a video call in which the counterparty looks and sounds correct. Verification practices that treat a live camera feed as proof of identity no longer hold.

The Justice Department also flagged a sharpening focus on open-source developers, a targeting choice it said appears intended to enable supply-chain attacks. The operational logic is direct: a compromised maintainer can push malicious code into a widely used repository, and every downstream project inherits the compromise. In an ecosystem where DeFi protocols and exchanges routinely import open-source dependencies, one developer's stolen session can propagate into dozens of production environments.

The consequence for security teams is that identity assurance must extend beyond the meeting itself:

• Treat video presence as unauthenticated by default, regardless of how familiar the face appears.
• Verify fund movements and credential grants through a second, out-of-band channel.
• Treat developer accounts on code repositories as high-value targets warranting hardware-backed authentication.

The Binance connection: $1.2 billion authorized for seizure

The FaceStealer announcement ran alongside a second, larger enforcement action. The DOJ has obtained authorization to seize more than $1.2 billion tied to the Binance hack. That amount forms part of $2.7 billion in funds already frozen in connection with the case.

The combined picture is one of escalating recovery and disruption capacity. Seizing command infrastructure and freezing $2.7 billion in stolen assets imposes real friction on North Korea's cryptocurrency revenue pipeline, which U.S. agencies have repeatedly described as a funding source for the country's weapons programs. For victim firms, the existence of a $1.2 billion seizure authorization also signals a realistic, if slow, path toward partial recovery of stolen funds through the forfeiture process.

What comes next

Expect the FBI and DOJ to expand attribution and seizure actions against the individuals and wallets behind FaceStealer in the coming months, and expect open-source foundations and major exchanges to tighten verification requirements for maintainer accounts and high-value transaction approvals. Firms that have not yet rehearsed a deepfake-in-the-loop social-engineering scenario now face a documented, quantified adversary that has already monetized it to the tune of $400 million.