.png "Global Insight")
It starts with a meeting invite from someone you already know. You join the video call, and there they are — a colleague, a business contact, a familiar face in the crypto world. Except the person on screen is not really there. Their face is a recording stolen from a previous victim, or a deepfake built by AI. And by the end of the call, your computer is infected and your cryptocurrency is gone.
That is the scheme American authorities exposed on Thursday, when the US Department of Justice and the FBI announced they had disrupted a North Korean hacking operation they call "FaceStealer" — a social engineering campaign that has stolen more than $400 million in cryptocurrency in the last 18 months alone. The FBI says it seized the cloud infrastructure behind the scheme and more than 900 secretly recorded webcam videos of victims. It is one of the clearest pictures yet of how North Korea funds its weapons programme: not with missiles, but with meetings.
How the FaceStealer trap works
According to the Justice Department, the operation runs on stolen trust. The hackers, working for a North Korean group tracked in the private sector as Sapphire Sleet — also known as UNC1069, Stardust Chollima, APT38 and BlueNoroff — begin by compromising one victim, then use that person's accounts to invite the next target to a video meeting. The invitation arrives from a real contact, on a real-looking link, to what appears to be a Zoom or Microsoft Teams call.
Once the target joins, the trap closes in stages. The hackers secretly record the target's webcam video — footage they will reuse against the next victim. On screen, they play a prerecorded video of a previous victim, or of someone the target knows, simulating the participation of a trusted contact. In some cases they go further, using what the Justice Department calls "super intelligence" to build deepfake videos of well-known figures in the cryptocurrency and Web3 industries. The target sees familiar faces, hears nothing alarming, and has no reason to suspect the meeting is fake.
Then comes the hook. The hackers introduce a fake technical problem — they claim the target cannot be heard, or the audio is broken — and offer a fix: a link, or a prompt to download something. The "fix" quietly installs malware on the target's computer. From there, the attackers can reach wallets, credentials and, in at least one case, far more.
The target list went beyond wallets
The FBI says FaceStealer aggressively targeted people and companies in the cryptocurrency and Web3 sectors — the people who hold the keys to large digital wallets. But the operation did not stop there. The hackers also broke into the computer of a developer who maintains widely used open-source software, then used that access to add malicious code that could reach everyone who downloaded it. That is the part of the announcement that should worry people who have never owned a single coin: a supply-chain attack through a trusted developer can spread to thousands of machines that were never the original target.
The scale of the recording operation is striking in itself. Under a federal warrant, the FBI seized more than 900 webcam videos collected from victims around the world — a library of faces the group could deploy, victim by victim, to make each new call look real. Every person who joined one of those fake meetings became, without knowing it, the bait for the next one.
The $1.2 billion seizure is a different case — don't mix them up
The same Justice Department announcement also covered a second, separate action, and the two are easy to confuse. Prosecutors obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the exchange hit by a roughly $6.3 billion theft on October 29. The FBI attributed that attack to a different North Korean military-linked operation known as TraderTraitor. In total, authorities and private companies have now frozen more than $2.7 billion of the Binance haul. That $1.2 billion is part of the Binance theft, not money recovered from FaceStealer — the two schemes share a sponsor, not a wallet.
What they do share is a motive. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," the FBI's cyber operations director, Brett Leatherman, said in the announcement. The regime has turned hacking into a revenue stream, and the FaceStealer method — patient, personal, built on recordings rather than code-breaking — shows how far that model has evolved from the smash-and-grab ransomware of a few years ago.
How to spot a call that isn't real
The FBI's advice, published alongside the announcement, is practical rather than technical. Verify meeting invites through a second channel before joining — a message on a different app, a phone call, a question only the real person could answer. Be suspicious of any meeting where the other side's video never quite responds naturally, where the audio "breaks" at a convenient moment, or where a fix requires downloading software mid-call. Legitimate colleagues do not send you installers during a meeting.
For companies, the lesson is narrower and harder: the attack worked because it exploited the most trusted moment in remote work — a face you recognise, in a meeting you were invited to, by someone you know. The fix is not better video software. It is a habit — confirming identity out of band, every time, before anything is installed. North Korea's hackers spent 18 months proving that a familiar face is no longer proof of anything. The defence is to stop treating it as one.