FBI says North Korean hackers stole over $400 million via fake video calls

As reported by BBC News, Deutsche Welle and Reuters. The allegations below are theirs, not Vocemundi's.

The FBI said on Thursday that North Korean state-backed hackers stole more than $400 million in cryptocurrency over the past 18 months. The scheme is built around video calls. The FBI calls it "FaceStealer". The BBC, DW and Reuters each reported the announcement.

According to US authorities, the hackers send video-call invitations from social media or other accounts they have taken over, including those of earlier victims. They play pre-recorded video of previous victims the target knows, so the call appears legitimate. They then stage a technical problem and offer a link to "fix" it. The link installs malware. The hackers also secretly record targets and use the recordings and contacts to reach new people.

US authorities say the scheme mainly targets people in cryptocurrency and web3 sectors, particularly open-source software developers.

According to the BBC, the calls ran on "imposter versions" of Zoom, Microsoft Teams and Google Meet, and the staged problem involved audio appearing to fail. According to DW, the Justice Department said it had seized cloud infrastructure used in the scheme. It also said the targeting of developers appeared intended to enable supply-chain attacks, DW reported. DW added that the FBI says the hackers are starting to use AI-generated deepfakes of well-known cryptocurrency figures.

The Binance hack

The exchange Binance was recently hacked for more than $6 billion, according to the FBI. The BBC and AP, as cited by DW, put it at about $6.3 billion, the largest crypto theft on record. US authorities attributed it to North Korea-linked actors. According to DW, the FBI said a group known as TraderTraitor carried it out on or around 29 October, and links FaceStealer to a separate cluster, Sapphire Sleet or UNC1069. DW reported that more than $2.7 billion connected to the hack had been frozen.

What is disputed

The BBC reported that, according to the FBI, more than 900 people have fallen victim to FaceStealer in 18 months. DW reported that the FBI seized more than 900 webcam videos of victims under a federal warrant. The accounts do not necessarily conflict.

What each side says

FBI cyber director Brett Leatherman said, according to the BBC: "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years". Patrick Grandy, who heads the FBI's Los Angeles field office, warned: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

North Korea denies involvement in the Binance hack. The reports reviewed by Vocemundi include no North Korean response on FaceStealer. They also do not describe the evidence behind the attribution or mention any arrests or charges.

Vocemundi note: this story relays allegations published by BBC News, Deutsche Welle and Reuters. Vocemundi did not have access to the underlying evidence or documents and has not independently verified these claims. The people and organisations named are presumed innocent; their response is included where it was available.

Analysis

The announcement points to a shift from technical intrusion towards exploiting personal trust, which may prompt companies and developers to review how they verify video calls and links. If the reported targeting of open-source developers was aimed at supply-chain attacks, the risks could extend beyond individual victims. However, the core allegations are attributed to US authorities, and the reports reviewed by Vocemundi do not indicate that the outlets independently verified them. How much of the $400 million, if any, can be recovered remains unclear. Future court filings or forfeiture proceedings could provide more detail on the evidence.

Produced by the Vocemundi newsroom with AI assistance.