A North Korea deepfake crypto theft scheme allegedly stole more than $400 million in 18 months, the U.S. Justice Department said on November 12, 2026, while announcing the seizure of infrastructure used in the operation. The FBI calls the scheme FaceStealer.

Attackers allegedly ran a fake video call crypto scam using stolen social accounts, prerecorded webcam footage and AI-generated impersonations to persuade crypto workers to install malware during video meetings. Their targets included experienced professionals in crypto, Web3 and cybersecurity.

North Korea Deepfake Crypto Theft: $400 Million in 18 Months Through Fake Video Calls

The DOJ tied more than $400 million in cryptocurrency losses to the operation, according to Decrypt. Attackers allegedly contacted targets through accounts taken from earlier victims, making the invitations look as though they came from familiar industry contacts.

During the calls, prerecorded footage made it appear that someone trusted by the target was present. The group also allegedly produced AI deepfakes of prominent figures in crypto and related industries to make the impersonation more credible.

The setup turned into computer access when the attackers created a fake technical problem. A supposed repair or update installed malware, opening a path into wallets and other systems available through the target’s computer.

Over 900 Recordings Seized Under a Federal Warrant

The FBI said it seized more than 900 webcam recordings under a federal warrant. The footage allegedly helped attackers use one victim’s image and mannerisms while approaching another target.

Jeremy Robertson, the FBI Los Angeles field office’s special agent in charge of counterintelligence and cyber, described targets being secretly recorded while waiting for meetings to start. The attackers ran realistic-looking meeting environments and used that waiting period to gather footage for later impersonations.

Fake participants sometimes joined the calls, adding to the illusion. When targets were told that other attendees could not hear them, the apparent audience increased the pressure to install the offered update quickly.

More Than a Year Could Pass Before a Theft

Under the DOJ’s account, attackers sometimes waited months or more than a year after gaining access before taking funds. A compromised meeting could leave behind an opening that remained useful long after the call ended.

The malware allegedly enabled wallet theft and access to other systems through the victim’s permissions. It also exposed social accounts, giving the attackers another way to reach people who recognized the account holder.

November 12 Disruption Targets FaceStealer Infrastructure

The DOJ’s November 12 announcement said authorities seized infrastructure supporting the operation. The Defiant also identified the disrupted scheme as FaceStealer, tying its fake calls to the alleged losses over the preceding 18 months.

The department attributed the operation to North Korean groups including Sapphire Sleet, BlueNoroff and APT38. It also warned that hackers were increasingly targeting open-source software developers, apparently to enable supply-chain attacks.

That focus reaches beyond individual wallets. The DOJ warning indicates that attackers were seeking access to software used by others, while the announced intervention targeted the infrastructure and recordings behind the impersonations.

FAQ

Which messaging accounts and video-meeting platforms did the attackers impersonate?

The FBI said invitations arrived through hijacked Telegram or LinkedIn accounts. Targets were then sent to attacker-controlled environments designed to look like Zoom or Microsoft Teams meetings.

How did the fake audio problem lead targets to install malware?

Attackers told targets they could not be heard and displayed an error message that called for an update. Running the supposed fix downloaded malware capable of exposing the computer, crypto wallets and social accounts.

How did recordings of earlier victims help attackers approach new targets?

Footage from an earlier target could substitute for a trusted contact in a later meeting. Robertson said the covert recording began while people waited for calls to start, before the staged conversation began.

Which North Korean hacking groups did the DOJ link to the operation?

The Justice Department named Sapphire Sleet, BlueNoroff and APT38 among the groups associated with the operation. Those links are government allegations described in the November 12 coverage.

Why were open-source software developers among the targets?

The DOJ warned that the increased focus on these developers appeared intended to enable supply-chain attacks. Access through a developer could give attackers a route into other systems, extending the damage beyond that person’s wallet.

This article is for information only and is not financial advice.

Related Articles

Crypto Hacks Hit Record 207 Incidents in First Half, Data Shows

Crypto hacks hit a record 207 incidents in the first half of 2026, even as total stolen funds fell...

Top 5 Most Common Cryptocurrency Scams: How to Avoid Crypto Fraud in 2026

Right now, digital money gives people more control over their finances – yet it’s also opened...

Cysic Halts Bridge After Unauthorized Mint of 10 Million CYS

The Cysic bridge exploit led to 10 million unauthorized CYS and a bridge halt, with some tokens...

Tangem Bitcoin Wallet Cards Face Physical Attack Risk, Ledger Says

A Ledger security team says Tangem Bitcoin wallet cards can be broken with a laser attack that lets...

Trezor Orders CryptoBilis Buyers to Move Funds After Safe 5 Implant Report

The Trezor CryptoBilis warning urges buyers to move funds after a Safe 5 buyer reported a suspected...

ZachXBT Accuses KuCoin of Pressuring Hack Victim and Using Fake KYC Accounts

On-chain sleuth ZachXBT is once again highlighting injustice in the crypto industry. This time, he...