North Korean hackers used fake video calls in $400m crypto hack, says FBI

What the report says

US authorities say state-backed hackers from North Korea have stolen more than $400 million in cryptocurrency by posing as contacts in fake video calls. The FBI says the campaign, which it calls FaceStealer, has affected more than 900 victims over the past 18 months. According to the bureau and the US Justice Department, the attackers have focused on people working in cryptocurrency and web3, especially those involved in open-source software development and maintenance.

The reported method relies on fake or hijacked social media accounts to draw targets into calls on imitation versions of platforms such as Zoom, Microsoft Teams and Google Meet. The hackers allegedly replay videos of people the victim knows to make the meeting seem genuine, then prompt the target to click a link to fix a supposed audio problem. That step can install malware, giving the attackers access to contacts and apps and helping them reach further victims.

The FBI described the scheme as highly effective social engineering, saying it can fool even experienced and security-conscious users. The warning follows another recent allegation by US authorities that North Korea-linked actors were behind a major crypto theft from Binance. The broader context, as the FBI notes, is that North Korea has long been accused of using cyber theft to help fund its weapons program, although Pyongyang has denied such claims.