North Korean Hackers Steal $400m Via Fake Calls
FBI says a scheme called FaceStealer targeted over 900 crypto workers with pre-recorded video clips.
By Nadia Rahman ·
More than 900 workers in the cryptocurrency and web3 sectors lost their identities to North Korean hackers who used fake video calls. US authorities state the group stole more than $400 million in cryptocurrency through this method. The FBI labels the operation FaceStealer. The attacks targeted individuals involved in developing and maintaining open-source software.
The scheme began by using fake or hijacked social media accounts to invite victims to video calls. These calls were hosted on imposter versions of Zoom, Microsoft Teams, and Google Meet. During the call, hackers played pre-recorded videos of people the target already knew. The audio in these clips would appear to malfunction. A message then popped up on the screen asking the user to click a link to fix the sound. Clicking the link downloaded malware that gave hackers access to the victim's contact lists and applications.
Hackers recorded these compromised calls to gather material for future scams. This allowed them to widen their pool of potential victims. Brett Leatherman, the FBI cyber director, stated that the North Korean regime uses proceeds from these thefts to fund its illicit weapons program. He noted that the regime has stolen billions of dollars in recent years.
This disclosure comes one week after Binance revealed a separate hack. That incident involved fake job interviews and resulted in the theft of $6.3 billion. US law enforcement attributed the Binance hack to North Korea-linked actors, though Pyongyang denied the claim. The FaceStealer operation has been active for the last 18 months. Authorities describe it as an aggressive targeting strategy for technical professionals.
Patrick Grandy, assistant director of the FBI's Los Angeles field office, issued a statement on Thursday. He said the scheme exploits trust in common video conference platforms and personal relationships. Grandy warned that the tactic can deceive even experienced and security-conscious users. He advised that if a person cannot imagine falling prey to such a scheme, they are not thinking creatively enough.
The FBI and US Justice Department released the details on Thursday. The malware installed via the fake audio fix allowed remote access to devices. This access enabled the theft of cryptocurrency. The operation is considered one of the most effective social engineering efforts against the crypto sector in recent years. The money stolen helps sustain the North Korean weapons program.
