North Korean hackers stole $400M through fake video calls, FBI says

North Korea-linked hackers stole more than $400 million in cryptocurrency over the past 18 months by using fake video calls to take over people's identities, according to US authorities. The FBI calls the scheme FaceStealer, and says more than 900 victims have been caught up in it.

According to the report, the method targets trust directly. Hackers use fake or hijacked social media accounts to invite targets to video calls hosted on imposter versions of Zoom, Microsoft Teams and Google Meet. During the call, pre-recorded footage of someone the target knows is played, except the audio appears to be malfunctioning.

A message then appears asking the target to click a link to fix the audio. That link installs malware, giving hackers access to contact lists and apps and widening the pool of potential victims. FBI cyber director Brett Leatherman says the North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program.

The article notes the announcement came a week after Binance, the world's largest crypto exchange, revealed that hackers had used fake job interviews to steal a record $6.3bn. US law enforcement attributed that hack to North Korea-linked actors, a claim Pyongyang denies.

Patrick Grandy, an FBI assistant director, described FaceStealer as a social engineering scheme capable of deceiving even the most experienced and security-conscious computer users. Calls are also recorded and reused as material for new victims, which keeps the cycle growing. For people in crypto and web3, especially those maintaining open-source software, the risk is concrete: a familiar face and a broken-sounding audio line can be enough to get malware onto a device.