State-sponsored hackers from North Korea have taken more than $400 million in cryptocurrency by using fake video calls to steal people's identities, U.S. authorities say, the BBC reported. More than 900 victims have fallen prey to the scheme, which the FBI calls FaceStealer, in the last 18 months, according to the bureau. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," FBI cyber director Brett Leatherman said. The warning comes a week after the world's largest crypto exchange, Binance, said hackers had used fake job interviews to steal a record $6.3 billion from the company. U.S. agencies attributed that hack to North Korea-linked actors. Pyongyang has denied the claim.
Authorities say FaceStealer "aggressively targets" people who work in cryptocurrency and web3, especially those who develop and maintain open-source software. According to the FBI and the Justice Department, the hackers use fake or hijacked social media accounts to invite potential victims into video calls hosted on "imposter versions" of Zoom, Microsoft Teams, and Google Meet. They then play pre-recorded videos of previous victims the target knows, to simulate a legitimate call, except that the audio appears to malfunction. A message pops up asking the target to "fix" the audio by clicking a link. That "fix" downloads malware, which lets the hackers reach contact lists and apps and widen the pool of potential victims. The attackers secretly record the calls and use those recordings to scam new targets, U.S. authorities said.
The FBI described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." "It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
The verified claim is the FBI's account of a large, identity-based crypto theft campaign, with a victim count and a dollar figure the bureau has attached to the last 18 months. It is separate from the Binance theft announced a week earlier, though U.S. officials have linked that attack to North Korean actors as well. North Korea has denied involvement in the Binance case. The BBC report does not independently audit the $400 million figure; it reports what U.S. authorities say they have found.