Hackers linked to North Korea have stolen more than $400 million in cryptocurrency over the past 18 months through a sophisticated social engineering operation that relies on fake video calls and AI-generated deepfakes, according to U.S. law enforcement officials. The FBI, which has dubbed the campaign “FaceStealer,” says the scheme demonstrates how cybercriminals are combining artificial intelligence with trusted online connections to target cryptocurrency holders and Web3 professionals.

On November 12, the U.S. Department of Justice (DOJ) announced the disruption of cloud-based infrastructure tied to the campaign. According to investigators, the attackers have also increasingly targeted open-source software developers, a shift that raises concerns about the security of widely used digital platforms.

How the FaceStealer Crypto Hack Operates

According to the DOJ, North Korean hackers relied on compromised communication accounts, covertly recorded webcam footage and AI-generated deepfakes to make their impersonations credible.

The campaign typically begins when attackers compromise a person’s computer and covertly record webcam footage of the user. They then take over the victim’s communication accounts and use them to reach out to the person’s professional and personal contacts.

The hackers send persuasive invitations to video meetings, frequently posing as people their targets know. During these calls, they build trust by displaying prerecorded footage of earlier victims or AI-generated videos of prominent cryptocurrency and Web3 figures. In practical terms, the technique undermines the common assumption that a familiar face on a live video call confirms the caller’s identity.

The attack becomes more dangerous when the hackers introduce a fake technical issue, such as an audio malfunction, during the call. Targets are then instructed to click a link or follow troubleshooting steps that secretly install malware on their computer.

Once a device is compromised, attackers can access sensitive information, steal cryptocurrency and potentially take control of additional communication accounts.

The FBI said authorities seized more than 900 webcam recordings of victims during the investigation, a figure that points to the operation’s scale. In multiple reported instances, hackers stole cryptocurrency from victims months, or in some cases more than a year, after initially compromising their devices. That delay means a compromised device can quietly expose accounts and funds long after the initial infection.

FBI Assistant Director in Charge Patrick Grandy warned that the campaign exploits people’s trust in familiar online platforms and professional relationships, describing it as a “highly effective social engineering scheme.”

Open-Source Developers Face a Growing Security Threat

The FaceStealer campaign extends beyond cryptocurrency theft. The FBI reported that North Korean hackers have increasingly targeted open-source software developers and maintainers to gain access to their devices and software repository accounts.

The activity has raised concerns about potential software supply-chain attacks. Attackers who compromise trusted developers may be able to introduce malicious code into widely used software projects, potentially exposing downstream users to security risks.

That development broadens the threat beyond individual cryptocurrency holders, with potential consequences for businesses, software platforms and wider digital infrastructure.

North Korea’s Expanding Cryptocurrency Theft Operations

The latest campaign adds to North Korea’s history of cryptocurrency-related cyberattacks. A historical assessment published by TRM Labs shows that cryptocurrency theft attributed to North Korea reached approximately $790 million in 2022, compared with around $205 million in 2023.

Although individual theft totals can fluctuate considerably from year to year, these figures illustrate the scale of the country’s cryptocurrency theft operations. The more than $400 million attributed to FaceStealer over the past 18 months further highlights the financial impact of these targeted attacks.

FBI Disrupts Infrastructure Behind the FaceStealer Crypto Hack

The DOJ confirmed that the coordinated operation resulted in the seizure of cloud-based infrastructure supporting the campaign. The FBI also published a technical report detailing how the scheme works and outlining security measures for potential victims, along with a dedicated resource page on FaceStealer.

The investigation highlights the importance of stronger verification procedures during online meetings, heightened caution when opening unfamiliar links and better protection of communication and software development accounts.

As AI-generated impersonations become increasingly convincing, the FaceStealer campaign demonstrates that cybersecurity threats are no longer limited to technical vulnerabilities. Exploiting human trust has become another effective way of gaining access to valuable cryptocurrency holdings and digital infrastructure.