FBI: North Korea-linked FaceStealer operation stole more than $400 million
The FBI says North Korea-linked threat actors stole more than $400 million in cryptocurrency over the past 18 months through a social engineering operation known as FaceStealer. The U.S. government has seized cloud infrastructure used in the campaign, while the FBI says it recovered more than 900 webcam recordings that attackers used to impersonate victims in later approaches.
The operation targets people in cryptocurrency and Web3, using deceptive video meetings and malware to steal digital assets and gain access to victims’ devices and accounts. The Justice Department says proceeds from North Korean cryptocurrency theft help fund the regime’s illicit weapons program.
How the video-call deception works
Attackers use compromised accounts belonging to trusted contacts to invite targets to video meetings, often presenting the invitation as a discussion about an investment opportunity. The familiar account and apparent personal connection help make the request seem credible.
During a meeting, attackers can play previously recorded footage of a person known to the target, or use deepfake videos of recognizable figures in the cryptocurrency and Web3 industries. The Justice Department says these techniques are used to build trust. The attackers may also record the target’s webcam feed, potentially creating material for future impersonation attempts.
After the meeting begins, the target is told there is a technical problem, such as an audio issue. A link or other prompt is then presented as a fix. The supposed remedy is a ClickFix-style lure designed to persuade the victim to install malware or take another action that compromises the workstation. The resulting access can expose cryptocurrency-related information and provide a foothold in other systems for which the victim has privileges.
Research from JUMPSEC described FaceStealer as a victim-acquisition operation built around impersonation and compromised communications accounts. Attackers may take over accounts on services including Telegram, LinkedIn, Slack and Discord, then use contact lists and conversation histories to identify further targets. Repeating the process through trusted relationships allows each compromised account to help introduce the scheme to additional people.
Targets include developers and high-value account holders
The FBI says the campaign has aggressively targeted people in cryptocurrency and Web3. Reporting from Arctic Wolf also identified people in adjacent finance and investment sectors, including founders and senior executives, among those sought by the actors. The activity has expanded across countries, according to that company’s research.
Developers and open-source software maintainers are also of concern. Attackers seeking access to a developer’s device or repository account may be able to pursue sensitive credentials or create opportunities for software supply-chain abuse. The source material says FaceStealer was used to target the maintainer of the Axios npm package earlier in 2026, leading to the publication of a trojanized version that delivered a cross-platform remote access trojan.
The FBI’s seizure of more than 900 recordings could disrupt one part of the impersonation process, but the campaign’s broader use of compromised accounts and synthetic media highlights why a familiar face or voice is not, by itself, reliable proof of identity. The government action also included a separate Justice Department announcement concerning court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency stolen by North Korea-linked TraderTraitor actors following a hack of cryptocurrency exchange Binance. That amount is distinct from the more than $400 million attributed to FaceStealer.
Practical steps for organizations
For security teams, the operation is a reminder to treat unexpected meeting links, urgent requests to install an update, and unusual instructions from a trusted contact as potential warning signs. Employees should verify unusual requests through a separate, known channel rather than relying only on the account or video call that delivered them. Organizations can reinforce this guidance with targeted awareness training for executives, finance teams, developers and other staff with access to digital assets or sensitive systems.
Technical safeguards remain important alongside verification. Organizations should limit account and device privileges to what users need, protect cryptocurrency wallets and signing credentials, and have a process for quickly reporting suspected account takeovers. Development teams should also apply established controls for protecting repository access and reviewing changes before software is distributed. The FBI’s findings show how social engineering can connect stolen identities, convincing video, malware and access to valuable infrastructure in a single recurring operation.
