DOJ Disrupts North Korean Fake-Call Scheme That Stole $400 Million in Crypto

The U.S. Department of Justice said Thursday that it seized cloud infrastructure used in a North Korean video-call impersonation campaign that stole more than $400 million in cryptocurrency over the past 18 months.

The campaign, which the FBI has designated FaceStealer, relies on accounts stolen from earlier victims to invite their contacts to meetings, according to the department's Nov. 12 announcement. During these calls, attackers play secretly recorded webcam footage of people the target knows, or deepfake videos of prominent crypto figures, to make the meetings appear legitimate.

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office, in the announcement.

How the Scheme Works

During a call, attackers claim a technical problem has occurred—such as the target's audio not working—and provide a link or prompt to resolve it. That supposed fix installs malware on the target's computer, the DOJ said. The FBI's FaceStealer resource page describes the use of realistic imposter versions of video-conferencing platforms.

The exposure extends beyond an individual's crypto holdings. According to the DOJ, attackers can exploit a compromised user's access to other computer infrastructure and increasingly target open-source developers and maintainers to gain access to software repository accounts. That targeting appears intended to enable software supply-chain attacks, the department said—potentially reaching users of the affected software, according to the FBI. In practical terms, that assessment means the campaign's potential footprint reaches past the individuals directly compromised to anyone who relies on the affected software.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims, the DOJ said. Attackers also harvest victims' contact lists and communications accounts to approach the next set of targets. In several reported cases, crypto theft and account hijacking occurred months to more than a year after the initial compromise, the department said—a lag that shows how an intrusion can go unresolved for months while attackers work through a victim's harvested contacts and accounts.

The video-call lure builds on a pattern the FBI warned about in September 2024, when it flagged requests to run scripts to enable calls as a potential sign of North Korean social engineering. As The Defiant reported at the time, DeFi employees were among the targets. That earlier advisory recommended verifying contacts through separate, unconnected communication platforms and restricting which files company devices can download or execute. Both recommendations address the scheme's two stated entry points: impersonated identities on calls and the malicious fix prompt.

Separate Action Targets Stolen Binance Assets

In the same announcement, the DOJ said it had obtained court authorization to seize or restrain more than $1.2 billion in assets tied to a separate Binance theft. That amount forms part of more than $2.7 billion frozen through government and private-sector efforts, rather than an additional recovery on top of it.

The FBI attributed that theft of more than $6 billion, which occurred on or about Oct. 29, to North Korean activity it calls TraderTraitor. The DOJ explicitly distinguished TraderTraitor from FaceStealer. The distinction matters for tracking: FaceStealer describes the video-call impersonation campaign, while TraderTraitor covers the separate theft and its laundering trail.

Efforts to trace, freeze, seize, and forfeit the Binance assets remain ongoing as the attackers launder funds through bridges, mixers, and exchanges, the DOJ said.

Source: CryptoNewsNet