FBI Disrupts FaceStealer Scheme Behind $400 Million in Crypto Theft

Fake Video Calls Drain Crypto Wallets

The FBI warned crypto holders on November 12 about FaceStealer, a social engineering scheme run by North Korean hackers that has drained more than $400 million from victims over the last 18 months. The bureau, together with the Justice Department, says anyone who owns digital assets, works in Web3 or maintains open-source code is a potential target. The attack opens with a meeting invite sent from an account stolen from an earlier victim. Once the target joins, the attackers secretly record their webcam while playing prerecorded clips of people the target knows, so trusted contacts appear to be on the call. The Justice Department states the group also deploys deepfakes of well-known figures in the digital asset industry. Next, the hackers invent a technical error, for example claiming the target cannot be heard, and the “fix” they send installs malware. In several documented cases the theft itself came months, or even more than a year, after the first compromise, which makes the intrusion hard to trace back to the call that started it. The DOJ ties the campaign to North Korean units tracked under names including Sapphire Sleet, BlueNoroff and APT38. The tactic is not new: reports published last year already connected fake Zoom meetings to $300 million stolen by North Korean actors, and Google’s Mandiant team flagged similar AI-enabled Zoom lures earlier in 2026.

900 Webcam Videos Seized

Federal investigators say they have disrupted the cloud-based infrastructure behind FaceStealer and seized more than 900 webcam videos of victims, in a probe led by the FBI’s Los Angeles field office. Patrick Grandy, Assistant Director in Charge of that office, described the scheme as an exploitation of trust in ubiquitous video conference platforms and valued personal relationships, adding that anyone who cannot imagine falling for it is not thinking creatively enough. Open-source developers are a growing focus: if North Korean hackers hijack trusted maintainer accounts, they can slip malicious code into widely used software, the bureau warns. Every new victim also becomes a launchpad, because the attackers comb contact lists, social media and chat apps to find the next targets. Alongside the FaceStealer action, the DOJ moved to seize $1.2 billion connected to the hack of the crypto exchange Binance, and on-chain analytics data shows North Korean hackers have stolen $7.61 billion in digital assets this year overall.

The Justice Department announcement is the load-bearing document here, and its two numbers frame the threat precisely: $400 million taken through FaceStealer lures in 18 months, and $7.61 billion attributed to North Korean actors across 2026. COINOTAG’s reading is that this campaign runs on trust rather than FOMO, which is why it cuts across every phase of the cycle, bull market or bear market alike. The delayed theft pattern, months after the initial call, means holders should treat any meeting invite from a crypto contact as unverified until confirmed through a second channel, and the seizure of 900 victim videos suggests the bureau now holds direct evidence of how identities were laundered between attacks.