A November 12 advisory published through the FBI's Internet Crime Complaint Center (IC3), the bureau's channel for collecting internet crime complaints and issuing public alerts, describes delays of months to more than a year between the initial intrusion and the theft of cryptocurrency in several reported cases involving FaceStealer, a North Korean operation that uses hijacked communication accounts and fake video meetings to trick targets into installing malware. The warning is directed at people who may have followed malicious troubleshooting instructions long ago: the absence of unauthorized transfers, the bureau cautions, does not establish that their wallet credentials remained private.

Why a wallet can look normal after the phrase is stolen

A recovery phrase allows compatible wallet software to reconstruct the private keys used to authorize transactions. With a standard recovery-phrase wallet, anyone holding the phrase can restore access on another device without removing the owner's access, meaning both parties can then hold the means to spend the funds.

Copying the phrase does not move cryptocurrency. A block explorer can display deposits and transfers, but it cannot reveal that another person has acquired the information needed to authorize a future withdrawal. An owner may therefore continue using the wallet normally while an attacker waits for a larger balance to appear.

The November 12 advisory describes attackers doing exactly that. It offers no average waiting period and no estimate of how often a compromise leads to delayed theft. Its finding is narrower: several reported cases involved theft and communication-account hijacking months to more than a year after the intrusion.

The scope of exposure depends on what the attackers could access. A recovery phrase stored on an infected computer presents a different risk from a phrase that was never available to that device, and a computer infection alone does not mean that every wallet the owner uses has lost its keys.

How a familiar contact delivers the fake fix

FaceStealer operations begin with access to a previous victim's communication account. Attackers use that genuine account to approach the victim's contacts about a catch-up, a collaboration or an investment opportunity, then send a link to an imitation meeting service.

Inside the fake meeting, they play stolen webcam recordings so that recognizable people appear to be participating. They then claim that the target has an audio problem or needs an update. The proposed solution asks the target to download a file, run a script or enter a command that installs the malware.

The campaign still relies predominantly on genuine stolen recordings, although the advisory also describes synthetic video. The deception does not require an invented face: authentic footage is used in a conversation that the recorded person is not directing.

Authorities seized more than 900 victim webcam recordings during the disruption of FaceStealer infrastructure. The FBI attributes more than $400 million in cryptocurrency theft over 18 months to the scheme.

Cleaning the computer does not restore wallet control

Removing malware can stop software from continuing to operate on a device, but it cannot retrieve a recovery phrase that has already been copied elsewhere. Reinstalling a wallet application, changing its local password or restoring the same phrase on another computer leaves the underlying wallet credentials unchanged.

For an exposed recovery-phrase wallet, replacement means creating a wallet with a fresh phrase and moving the assets. A standard recovery-phrase wallet has no issuing party that can invalidate a phrase once it has been copied, which is why replacement, rather than repair, is the available route. Phantom's migration guidance explains that its existing recovery-phrase wallets cannot simply be assigned a new phrase, and it advises checking tokens, collectibles, staked assets and DeFi positions, some of which require additional steps before they can be moved.

A migration therefore has to account for more than the balance shown on the wallet's opening screen. The owner must identify the assets and positions still controlled by the exposed credentials and stop directing future payments to the old addresses.

Stolen accounts put the next contact at risk

Wallet access is only one use for the compromised device. FaceStealer attackers also obtain contact lists and chat histories, which allows them to tailor an approach around an earlier conversation. A message about an investment or a meeting can arrive from the expected account and refer to a real relationship.

Recovering the account can interrupt that route to further victims, but contacts may already have received invitations or seen the owner's recorded face. They need a warning through another established channel. Employers also need to know when a work device or work information may have been exposed, even if no cryptocurrency has disappeared.

For future meeting invitations, the recommended practice is to open the official application independently and join with the meeting code, to confirm unusual requests through another established contact channel, and to obtain updates separately rather than running scripts or commands supplied in chat.

Anyone who followed a suspicious "fix" months ago should reassess the credentials and accounts that were accessible at the time. Because the cases the advisory describes involve theft occurring months to more than a year after the intrusion, that reassessment has to reach back past recent activity to every period in which the device may have been compromised. That review determines whether funds need to move, account sessions need to end and contacts need a warning.