North Korean Hackers Used Fake Video Calls and Deepfakes to Steal $400M
The DOJ says a North Korea-linked group used stolen accounts, prerecorded footage and AI impersonations to trick crypto workers into installing malware on video calls.
What happened: The U.S. Justice Department announced on November 12, 2026, that it had seized infrastructure behind a scheme it calls FaceStealer, tied to North Korean hacking groups accused of stealing more than $400 million in cryptocurrency over roughly 18 months. Attackers allegedly used hijacked Telegram and LinkedIn accounts to arrange video calls that looked like ordinary meetings with familiar industry contacts, then used prerecorded footage and AI-generated impersonations of well-known crypto figures to convince victims the person on screen was real. The FBI says it recovered more than 900 webcam recordings under a federal warrant, evidence of how extensively the group filmed targets.
Why it matters: This wasn't random phishing: experienced professionals in crypto, Web3 and cybersecurity were fooled by what looked like routine video meetings. The theft also wasn't instant. The DOJ says attackers sometimes waited more than a year after gaining computer access before draining a wallet, meaning one compromised call could keep paying off long after the victim forgot about it. Investigators also flagged a newer worry: the same groups are increasingly targeting open-source software developers, which could let a single intrusion spread through code used by far more people than the original victim.
How it works, plainly: Invitations came from accounts already stolen from a previous victim, so they appeared to be from someone the target actually knew. On the call, prerecorded webcam footage stood in for a real participant, sometimes backed by AI-generated deepfakes of recognizable industry figures, and fake extra attendees joined to make the meeting feel legitimate. Partway through, attackers staged an audio glitch and pushed an 'update' to fix it. Running that file installed malware exposing the victim's crypto wallets, computer and social accounts, sometimes capturing footage that was reused on the next target.
The response: The November 12 action seized infrastructure supporting the operation, and DOJ attributed it to North Korean groups known as Sapphire Sleet, BlueNoroff and APT38. FBI Los Angeles described victims being secretly filmed while waiting for meetings to start, footage later reused to impersonate them against new targets. Officials are also warning open-source developers specifically, since compromising one could open a path into software used downstream by many others. No arrests of individuals were announced alongside the infrastructure seizure.