FBI Exposes North Korean Video-Spoofing Crypto Heist Scheme
The FBI revealed that North Korean hackers stole over 400 million dollars in crypto using covert video recordings and deepfakes to impersonate victims and spread malware.
North Korean state-sponsored hackers have stolen over 400 million dollars in cryptocurrency over the past 18 months using a sophisticated video-spoofing attack method, the FBI revealed. The scheme relies on covertly recorded footage of targeted individuals to impersonate them and compromise their professional networks.
According to an alert issued by the Federal Bureau of Investigation, the operation—dubbed "FaceStealer"—leverages advanced social engineering. Victims receive video conference invitations from genuine contacts whose social media and communication accounts have been compromised. These links direct targets to malicious clones of popular platforms such as Zoom, Microsoft Teams, and Google Meet.
Once a target joins the call, a staged technical glitch appears on screen. To resolve the manufactured issue, the victim is prompted to click a link that infects their computer and social accounts with malware. During its investigation, the FBI recovered and seized more than 900 webcam recordings of victims captured through this method.
The FBI noted that hackers have begun integrating artificial intelligence into their attacks, generating deepfake videos of prominent crypto and blockchain figures to enhance credibility. The activity is attributed to a North Korean hacking collective known as Sapphire Sleet or UNC1069, distinct from groups previously linked by authorities to major exchange breaches.
