North Korean hackers used fake video calls in $400M crypto hack, says FBI

The FBI says North Korean state-linked hackers stole more than $400 million in cryptocurrency from over 900 people in the past 18 months through a scheme dubbed FaceStealer. It targets workers in cryptocurrency and Web3, especially people developing or maintaining open-source software. US officials say cryptocurrency theft helps North Korea finance its weapons programme, which has depended on billions of dollars in stolen funds in recent years.

The hackers use fake or hijacked social-media accounts to invite targets to video calls on counterfeit versions of Zoom, Teams or Google Meet. They play prerecorded footage of someone the target knows, while making the call’s audio seem broken; a prompt to repair it leads the target to download malware. This gives the attackers access to contacts and apps, helping them reach further victims. They also secretly record calls and reuse the footage to make later scams more convincing. The FBI warns that the tactic can deceive even technically experienced people because it exploits trust in familiar services and personal relationships. The accusations come amid separate claims that North Korean-linked hackers stole $6.3 billion from Binance using fake job interviews; North Korea denies involvement in that breach.