FBI Uncovers $400 Million North Korean Crypto Theft Using Deepfake Video Calls

The FBI has established that threat actors linked to the Democratic People’s Republic of Korea (DPRK) have stolen more than $400 million in cryptocurrency through a sophisticated social engineering campaign codenamed FaceStealer. The operation has targeted individuals within the cryptocurrency and Web3 sectors over the last 18 months.

The scheme utilises generative AI technology to create convincing deepfake videos of well-known and influential industry figures, which are used during fraudulent video calls to build trust with victims.

The FaceStealer Attack Mechanism

The campaign is attributed to the North Korean-linked threat cluster BlueNoroff, which is also tracked under names such as APT38, CageyChameleon, and CryptoCore. The attackers typically begin by hijacking communications accounts on platforms including Telegram, LinkedIn, Slack, and Discord.

Once an account is compromised, the attackers use the hijacked profile to invite trusted contacts to video meetings, often under the pretext of discussing investment opportunities. When victims join these fraudulent Zoom or Microsoft Teams meetings, the attackers play pre-recorded webcam footage of previous victims or use deepfake videos to simulate a professional environment with multiple participants.

A few seconds into the call, the attacker simulates a technical issue, such as a broken audio connection, and provides a link to resolve the problem. This link serves as a “ClickFix” style lure designed to install malware on the victim’s workstation. Once infected, the malware can steal cryptocurrency, capture sensitive data, or allow the attacker to abuse the target’s credentials to access further infrastructure.

Targeting Executives and Developers

Research from Arctic Wolf indicates that the scope of these attacks has expanded to include 677 identified targets across 58 countries. The majority of these targets, over 80%, are founders and C-suite executives. This focus reflects the attackers’ objective to gain access to individuals with authority over cryptocurrency assets, wallet infrastructure, and exchange platforms.

Beyond financial executives, the group targets software developers and open-source maintainers to facilitate software supply chain attacks. In one recent instance, the FaceStealer scheme was used to target a maintainer of the Axios npm package to distribute a trojanised version of the software containing a remote access trojan (RAT).

Wider Impact and Government Response

This discovery coincides with a coordinated effort by the US government to disrupt North Korean cyber operations. The US Department of Justice (DoJ) has announced the seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen by the North Korean-linked TraderTraitor group following the hack of the Binance exchange. Authorities stated that these stolen assets are used to fund the North Korean weapons programme.

Security researchers have also identified a related campaign known as “Contagious Interview.” This method involves attackers posing as recruiters on LinkedIn to send technical assessments that contain malicious code. In some cases, attackers use weaponised VS Code workspace settings files that automatically trigger malicious payloads when a developer opens a project.

To mitigate these risks, security experts advise that interview assignments involving downloads should only be executed within disposable virtual machines rather than on primary work laptops. Additionally, employees should be instructed to verify the credentials of recruiters and remain highly suspicious of any unexpected requests to download software or run scripts during video calls.