North Korean hackers stole $400m in cryptocurrency using fake video calls, FBI says

State-sponsored hackers from North Korea have reportedly siphoned over $400 million in cryptocurrency by employing deceptive video calls to hijack identities, according to US authorities. The FBI stated that this operation, known as FaceStealer, has impacted more than 900 victims throughout the past 18 months.

FBI cyber director Brett Leatherman noted that the North Korean regime depends on the earnings from such extensive cryptocurrency thefts to finance its illicit weapons programme, having stolen billions of dollars in recent years. This report follows an announcement from Binance last week, where the world's largest crypto exchange claimed hackers used fake job interviews to steal a record $6.3bn (£4.7bn). While US law enforcement attributed the Binance breach to North Korea-linked actors, Pyongyang has rejected these allegations.

Officials stated that the FaceStealer operation specifically targets individuals within the cryptocurrency and web3 sectors, particularly those engaged in developing or maintaining open-source software. According to the FBI and the US Justice Department, the hackers utilise fraudulent or compromised social media profiles to lure victims into video calls using imposter versions of Google Meet, Microsoft Teams and Zoom.

During these calls, the perpetrators play pre-recorded footage of people known to the target to create an appearance of legitimacy, often feigning audio issues. A message then appears prompting the victim to click a link to resolve the audio problem, which instead installs malware on their device. This malware grants the hackers access to contact lists and applications, allowing them to expand their network of targets while secretly recording the calls for future scams.

The FBI has labelled FaceStealer a highly effective social engineering tactic capable of tricking even security-conscious users. Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday: "It exploits our trust in ubiquitous video conference platforms and valued personal relationships." He added: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."