FBI: North Korean Hackers Stole Over $400 Million in Crypto via Fake Video Calls

North Korean hackers stole more than $400 million in cryptocurrency from over 900 victims during the past 18 months using fake video calls, the FBI said in a disclosure reported by the BBC on November 13. The bureau attributed the campaign to a social-engineering method it identifies as "FaceStealer."

The tactic begins with account hijacking. Attackers compromise a victim's social media accounts, then impersonate a trusted contact and invite the target to a video meeting that mimics Zoom, Microsoft Teams or Google Meet. The FBI said the attackers play pre-recorded footage of an acquaintance to make the call appear legitimate.

How does the malware get installed?

The intruders stage an apparent audio malfunction during the fake call. They then prompt the victim to install software that is, in fact, malware. Once installed, the payload gives the attackers access to the victim's contacts and installed applications.

That access compounds the damage. Harvested contact lists let the attackers map additional targets and launch follow-on attacks, turning each compromised machine into a launching pad for the next infection. The FBI said the campaign concentrates on people working in the cryptocurrency and Web3 industries, with open-source software developers singled out as a primary target.

The scale places FaceStealer among the most productive crypto-theft operations attributed to Pyongyang. Brett Leatherman, the FBI's top cyber official, said North Korea is conducting large-scale cryptocurrency theft to fund its illicit weapons program. He added that the country has stolen billions of dollars in recent years — a figure that makes the $400 million from this single video-call campaign a subset of a much larger drain on the industry.

Why are developers the preferred target?

Open-source developers hold elevated access rights across repositories, build pipelines and contributor networks. Compromising one developer can expose codebases and the trust relationships around them, which extends the blast radius far beyond a single wallet. The FBI's warning implies that operational security for individuals — verifying meeting links, refusing unsolicited software installs, and treating audio-failure prompts as a red flag — now sits on the critical path for protocol security.

For crypto firms, the operational consequences are direct. A single infected developer machine can leak credentials, session tokens and internal contact graphs. Firms that rely on social-media-driven hiring and collaboration, common in Web3, face the highest exposure, since the attack chain starts with impersonation on those very platforms.

The FBI's disclosure gives the industry a concrete behavioral signature to defend against: a familiar face on a video call, a broken microphone, and an urgent request to install a fix. Firms and maintainers should expect further advisories, and potentially follow-on attribution or enforcement actions, as the bureau works through the 900-plus victim base.