The FBI says it has disrupted a North Korean crypto theft scheme that worked through fake video calls, and the scale is hard to ignore. The bureau announced on 12 November 2026 that it disrupted cloud-based infrastructure used in the scheme, which it calls FaceStealer, and seized more than 900 webcam videos of victims. The scheme stole more than $400 million in cryptocurrency over the last 18 months, according to the FBI. The victims work in the cryptocurrency and Web3 industries around the world, and the FBI says the hackers are now using artificial intelligence to build deepfake videos of well-known people in the industry.
Read Also: Binance Confirms Breach, Estimates $6.3 Billion Impact. A separate North Korean operation, announced at the end of October, not connected to FaceStealer.
How the scam works
The trap starts with a video call invite that looks entirely normal. The target is lured onto an imposter version of video meeting software such as Zoom, Microsoft Teams or Google Meet, according to Reuters. The invitation comes from a genuine contact the target has spoken to before, but that contact’s social media and communication accounts have been compromised, and their image has been secretly recorded.
Once the target joins the call, and is also being recorded, a mock technical error appears. The call tells the target to fix it by clicking a link, and that link installs malware on the target’s computer. The target’s accounts are hijacked after the compromise, in some cases months to more than a year later. The target’s own contacts are then used to find the next victims. Meeting invitations often move through hijacked Telegram, LinkedIn, Slack or Discord accounts, according to the FBI’s FLASH advisory, and the FBI seized the 900-plus webcam videos under a federal warrant.
The FBI describes the scheme as a five-step lifecycle:
- Threat actors compromise a victim’s device and secretly record the victim’s webcam.
- They hijack the victim’s Telegram or WhatsApp account and message the victim’s contacts.
- They send a convincing fake video link to a new target.
- They lure the target into a realistic imposter video chat.
- They impersonate the original victim with the recorded video and trick the target into infecting their own computer.
About $730,000 a day
The headline figure is more than $400 million, but the rate is what shows how the scheme worked. Our calculation from the FBI’s two figures: more than $400 million over 18 months works out to roughly $22 million a month, or about $730,000 a day, as a straight-line average. No source gives a monthly or daily breakdown, so this is an average, not an observed rate.
The comparison with the Binance heist shows the difference in shape. The FaceStealer haul is about 6% of the roughly $6.3 billion impact Binance reported, but where Binance was one huge theft in October, FaceStealer was 18 months of slow, person-by-person social engineering. Two different shapes of North Korean crypto theft, both covered in the Justice Department’s 12 November announcement.
Each victim also supplied the raw material for the next attack. A compromised contact hands over a webcam recording and a contact list, and both become bait for the next round. The 900-plus seized videos were not just evidence. Each one is a recording that could be reused to impersonate its victim, and the FBI’s advisory says the pool of victims grows exponentially.
Who is behind it, and what is still unknown
The FBI attributes FaceStealer to a North Korean hacking group that the private sector calls Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Stardust Chollima, APT38 and BlueNoroff. The FBI lists all seven names for the same group, and Reuters attributes the activity to Sapphire Sleet or UNC1069. The hackers are starting to use artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency and blockchain industries, the FBI said.
The scheme also reached into the software supply chain. The hackers broke into the computer of a developer who maintains a widely used JavaScript library, then used that access to add malicious code that could reach people downloading it, according to Nextgov. The attack was detected and stopped before it spread widely. The FBI says the group is increasingly targeting open-source software developers and maintainers to gain access to their devices and software repository accounts, with the objective of compromising the software supply chain. Infiltrating trusted developers could let the group push malicious code through widely used software, potentially reaching millions of downstream users.
Some things are still not known. The FBI has not given a total victim count. The 900-plus videos are a count of seized recordings, not a total victim count, since the sources do not establish one video per person. No arrests or charges have been announced in the FaceStealer case; the action announced so far is the disruption of cloud infrastructure and the seizure of more than 900 videos pursuant to a federal warrant. The JavaScript library in the supply-chain case has not been named, and the Justice Department’s release quotes the FBI’s Brett Leatherman saying North Korea has been stealing billions of dollars in recent years, but that figure covers the wider campaign, not FaceStealer.
Not the Binance heist
FaceStealer and the Binance heist are separate operations by separate groups, and the numbers must not be mixed. The Binance breach was announced at the end of October; the 12 November announcement was the Justice Department’s seizure action for Binance, in the same release as FaceStealer. The Justice Department obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, part of a freeze of more than $2.7 billion, according to The Block. The Binance theft was more than $6 billion, on or about 29 October 2026, according to the Justice Department, which attributes it to North Korean military hackers known as TraderTraitor. Binance itself put the impact at about $6.3 billion. FaceStealer is the work of Sapphire Sleet and its aliases, not TraderTraitor, and the $400 million figure belongs to FaceStealer alone.
How do I spot a FaceStealer video call?
Treat any video call invite from a crypto or Web3 contact as suspect until you verify it another way. FaceStealer invites arrive from real accounts the hackers have taken over, so the sender name alone proves nothing. Never install a fix from inside a call, and hang up if the call shows a fake error.
- Check any video call invite with the sender through a second channel before you click the link.
- Refuse to install software or open a fix link that a video call tells you to download.
- Treat a call that shows a fake audio or technical error as a warning sign, and end it immediately.
- Call the person back on a number you already have instead of trusting the invite.
- Report a suspicious invite to the FBI at IC3 at www.ic3.gov, using the keyword FaceStealer, then check the FBI’s FaceStealer page for its guidance.
What to watch next
The FBI issued a FLASH advisory on the scheme on 12 November 2026, which carries the best practices, and posted a public hub page as a central place for resources and information. The FBI’s Cyber Branch posted a public warning the same day. The hub page is the place to check for the FBI’s latest guidance.
Three things are worth watching. Whether anyone is arrested or charged in the FaceStealer case, since the action so far has been disruption and seizure, not arrests. Whether the FBI names the JavaScript library in the supply-chain case, or says how many people the scheme reached in total. And whether the deepfake element grows, since the FBI says the group is already using artificial intelligence to build fake videos of well-known people in the crypto industry.
The disruption removes the cloud infrastructure the FBI identified and the 900-plus videos it seized. The method, though, is a fake call, a recorded face and a fix link, and that is the part worth remembering the next time a meeting invite arrives out of nowhere.
