North Korean Hackers Stole More Than $400 Million in FaceStealer Campaign
Key Facts
The FBI said the FaceStealer campaign, linked to North Korean hackers, targeted workers in the cryptocurrency and Web3 sectors and resulted in the theft of more than $400 million during the previous 18 months. The U.S. Justice Department announced coordinated action against North Korean schemes on 12 November 2026, including the seizure of cloud infrastructure used in the campaign. The case reflects attackers’ reliance on luring professionals through seemingly familiar communication channels before installing malware on their devices. The department said the campaign was carried out through social engineering, while an FBI alert said stolen videos and, at times, AI-generated fake videos were used. The announcement combines disruption of part of the scheme’s operational infrastructure with a warning about tactics targeting individuals and their professional networks.
According to the Justice Department, some luring attempts begin with invitations to video meetings sent from accounts stolen from previous victims. During the meeting, attackers impersonate people known to the target, then invent an audio or video technical problem and present a link or prompt to fix it. But the “fix” secretly installs malware on the target’s device instead of resolving the connection problem. The FBI said scammers sometimes use AI-generated fake videos of well-known figures in the cryptocurrency and Web3 sectors, broadening their targeting options. Even so, the campaign relies primarily on real videos stolen from victims, according to the bureau’s warning.
The risk is not limited to the immediate theft of assets after a device is compromised. In reported cases, department officials said cryptocurrency was stolen and communication accounts hijacked months after the initial breach, and sometimes more than a year later. After taking control of the accounts, the attackers used victims’ contact lists to reach and target their acquaintances in turn. The FBI said threat actors used new or compromised accounts on Telegram, LinkedIn, Slack and Discord to begin contact with their targets. This approach expands the pool of targets from a wallet owner to their colleagues and acquaintances, taking advantage of the trust associated with familiar accounts.
The targeting also extended to open-source software developers and maintainers, in an attempt to access their devices and software repository accounts in preparation for supply-chain attacks. The FBI said the attackers tried to exploit maintainer privileges to add malicious dependencies to a JavaScript library that receives tens of millions of downloads each week. The attempt was thwarted after the breach was detected and addressed, the bureau said. The alert added that, without the swift detection and response, the failed attack could have led to “a very large number of victims being infected.” The incident shows how compromising a single developer’s account can open a path to users of widely used software.
The FBI said it identified and seized more than 900 videos stolen from victims’ webcams. The footage illustrates some of the material the bureau says attackers exploited to impersonate trusted people during video meetings. The Justice Department announcement named several groups or threat actors linked to the activities, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. An FBI official said the North Korean regime relies on cryptocurrency theft proceeds to fund its illicit weapons program. The department did not say the funds were linked to any specific individual; it described them as funding the regime and its weapons program.
The warning comes amid a broader pattern of cryptocurrency thefts attributed to North Korean hackers. A Chainalysis report said they stole at least $2.02 billion during 2025, up 51% year over year, despite a decline in the estimated number of attacks. That raised the cumulative minimum estimate of funds stolen and attributed to North Korea to $6.75 billion by the end of 2025. In a separate announcement on 12 November 2026, the Justice Department said it had obtained court authorization to seize or restrict the use of more than $1.2 billion in funds stolen from Binance; an Associated Press report put the value of the original theft at about $6.3 billion. The Binance case is separate from the FaceStealer campaign, though both announcements highlight U.S. action against funds linked to different thefts.
The FBI issued guidance to reduce the risk of being lured, urging video-meeting participants to use the official app and invitation code instead of clicking links to join web versions. It also recommended against running scripts or pasting commands into a terminal to install an update requested by someone during a video meeting. For anyone who suspects they have been compromised, the bureau recommended moving crypto assets to a new wallet with new recovery phrases, using a device that has not been used to communicate with the attackers. The guidance also included securing accounts and notifying contacts, given the possibility that victims’ contact lists could be used to target others. Chainalysis said it would continue tracking stolen funds linked to the Bitget case over the following weeks, tagging new addresses and coordinating with exchanges, token issuers and law enforcement to disrupt the movement of funds.