FaceStealer Crypto Theft: How Deepfake Calls Led to $400M Losses
FaceStealer Crypto Theft: How North Korean Deepfake Calls Work
On November 12, 2026, the U.S. Department of Justice and the FBI revealed a new warning for the digital asset industry.
They say North Korean hackers used a scheme called FaceStealer to steal more than $400 million in cryptocurrency over the past 18 months.
The trick is simple but dangerous: a video meeting that looks real, with faces you trust.
This report explains how FaceStealer crypto theft works, who is behind it, and what authorities have done so far.
Source: Post on X
What Is the FaceStealer Scheme?
FaceStealer is the name the FBI gives to a social engineering campaign, which means a scam that tricks people rather than breaking into systems.
According to the Justice Department announcement, it relies on secretly recorded videos and AI-made deepfakes.
They are used to copy people the victim knows and trusts.
Key fact | Details |
Amount stolen | More than $400 million in cryptocurrency |
Time period | The last 18 months |
Blamed on | North Korean state-sponsored hackers |
Announced | November 12, 2026 |
Webcam videos seized | More than 900 |
A detailed FLASH report was also published, along with a central FBI page with resources on the scheme.
How the Fake Video Call Works
The official description of FaceStealer crypto theft follows a clear pattern:
The invitation. The target gets a meeting invite from a real account that hackers stole from an earlier victim, so it appears to come from a known contact.
The fake meeting. The report says the attackers use imposter versions of popular meeting tools such as Zoom, Microsoft Teams and Google Meet.
The trust trick. Once the target joins, the group records their webcam and plays a prerecorded video of a past victim or other known person. They also use deepfake videos of well-known figures in the crypto and Web3 world.
The fake error. A technical problem is introduced, such as claiming the target cannot be heard, along with a link or prompt to fix it.
The malware. The “fix” quietly installs harmful software on the computer.
With the device compromised, the attackers can steal funds or use the target’s access to other systems.
The Justice Department says some victims lost funds and had accounts hijacked several months to more than a year after the first compromise.
The attackers also reached the victim’s contact lists, social media and messaging apps to target friends and coworkers next, which keeps the cycle going.
Who Is Behind It and Who Is Targeted
Officials attribute the activity to North Korean state-sponsored groups, known publicly by several names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.
A senior cyber official says North Korea relies on large-scale cryptocurrency theft to fund its illicit weapons program.
The main targets are people working in the crypto and Web3 industries. The campaign has also increasingly targeted people who build and maintain open-source software, which are public code projects that many apps depend on.
The group tried to reach their devices and the software repository accounts they control.
According to the announcement, this looks calculated to enable software supply-chain attacks, where one compromised project can affect many users.
This shows FaceStealer crypto theft is not only about stealing coins.
What Authorities Have Done So Far
Officials announced several steps:
Federal prosecutors in the Central District of California disrupted cloud-based infrastructure the hackers used.
Under a federal warrant, the FBI seized more than 900 webcam videos of victims.
A detailed report was published, which includes protection tips and steps for victims.
A central website was created with resources on the scheme.
FBI Los Angeles official Patrick Grandy warned that the scheme can fool even experienced, security-minded users, because it exploits trust in video platforms and personal relationships.
He added that anyone who cannot imagine falling for it is “not thinking creatively enough.”
How to Stay Safe
The full best practices are in the FLASH report. The tips below are general ideas based on how the scheme works, not a copy of that list:
Confirm an unexpected meeting request through a different channel, such as a phone call to a number you already have.
Check the meeting link carefully, since imposter versions of meeting tools are used.
Never run a “fix” or install anything offered during a call.
Keep crypto accounts and wallets on a separate, well-protected device where possible.
If you suspect a compromise, read the victim steps in the report right away. Because theft can come months later, act even if nothing has gone wrong yet.
Conclusion
To sum up, FaceStealer crypto theft shows that attackers now target people, not only wallets or smart contracts.
More than $400 million has been stolen, and authorities have seized infrastructure and 900-plus webcam videos. Read the official FBI and Justice Department pages for updates.
Disclaimer
This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.
