North Korean hackers used accounts stolen from previous victims to invite new targets to video calls, where they played back secretly recorded webcam clips of people those targets knew, according to the U.S. Justice Department.

The scheme, tracked by the FBI under the name FaceStealer, stole more than $400 million in cryptocurrency over an 18-month period, the department said Thursday. Authorities said they took down FaceStealer's cloud infrastructure, and the FBI seized more than 900 webcam videos of the scheme's victims under a federal warrant — recordings of the kind the scheme used to impersonate trusted contacts on later calls.

Fake audio glitch tricked targets into installing malware

In its release, the DOJ said the crews behind the operation target people working in crypto and web3. When a target joins a call, the hackers record that person's own webcam while playing back prerecorded footage of a known contact, faking the presence of a trusted colleague on the call.

The hackers also produce deepfake videos of influential figures in crypto and web3 — what the department called “super intelligence” — and run them in the same meetings.

Partway through the call, a bogus technical fault appears — for example, a claim that the target is not being heard. A link or prompt offering to “fix” the problem then follows; opening it silently installs malware on the victim's machine.

Once the computer is compromised, the hackers can steal cryptocurrency or make use of the target's access to other systems. In some instances, the thefts and account takeovers took place months to more than a year after the initial break-in.

The hackers also hunt through each new victim's contact lists, social media, and messaging apps. Personal and professional contacts discovered there become the next targets.

“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” said Patrick Grandy, the FBI Los Angeles Field Office's assistant director in charge.

Open-source developers targeted as DOJ restrains $1.2 billion

Open-source software developers are increasingly in the crosshairs. The hackers target their devices and the code repository accounts they control, which the DOJ said appears designed to enable supply-chain attacks — a technique that uses one compromised developer's systems or code to reach the projects and users that depend on it.

The department linked the FaceStealer campaign to North Korean groups it named as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.

In February, Cryptopolitan reported that UNC1069 hijacked a crypto executive's Telegram account to lure a target into a fake Zoom call. The attackers then feigned audio issues and had the victim run troubleshooting commands, mirroring the audio-fault pretext described in the DOJ's FaceStealer release.

The FBI published a report on how the scheme works, including protective steps and advice for victims, and set up a dedicated FaceStealer website as a resource hub.

The DOJ coupled the FaceStealer seizure with a second action: it won court approval to seize or restrain more than $1.2 billion that had been stolen from Binance, part of more than $2.7 billion that has been frozen so far.

The department blamed North Korean military hackers it calls TraderTraitor for siphoning more than $6 billion from the exchange around Oct. 29. North Korea has denied any involvement in the thefts.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security.

TraderTraitor is still laundering the Binance funds via crypto bridges, mixers, and exchanges. Efforts to trace, freeze, seize, and forfeit them continue.