.png){kind=logo}
The FBI has disrupted a North Korea-linked cryptocurrency hacking operation known as FaceStealer, allegedly responsible for stealing over USD 400 million through fraudulent video meetings. According to US authorities, the campaign targeted cryptocurrency professionals and software developers, exploiting trusted relationships to compromise devices and steal digital assets.
The FBI and US Department of Justice noted that attackers used compromised accounts on Telegram, LinkedIn, Slack and Discord to contact potential victims. Hackers directed targets toward counterfeit Zoom, Microsoft Teams and Google Meet websites, where prerecorded videos of familiar contacts created convincing meetings.
Victims then encountered fabricated audio problems and instructions to install supposed fixes. Instead, these actions downloaded malware capable of recording keystrokes, capturing screens and accessing sensitive information. Attackers also secretly recorded victims' webcams, using the footage to impersonate them during subsequent attacks.
US investigators seized infrastructure supporting FaceStealer and recovered more than 900 webcam recordings collected during the campaign. According to cybersecurity firm Arctic Wolf, researchers identified over 677 targets across 58 countries.
The FBI also uncovered an attack involving a JavaScript library maintainer whose compromised computer enabled malicious software modifications. Authorities stopped the threat before widespread distribution. “This is not something we can patch,” FBI official Jeremy Robertson said, describing the operation's sophisticated social engineering methods.
Separately, US authorities linked North Korean hackers to Binance's reported USD 6.3 billion cryptocurrency theft in October 2026. The Justice Department informed that court orders authorized the seizure or restraint of more than USD 1.2 billion connected to the attack.
Public and private interventions had already frozen over USD 2.7 billion, including the court-restrained assets. Investigators attributed the Binance incident to North Korea's TraderTraitor group, although officials believe FaceStealer involved different actors.
FBI cyber director Brett Leatherman said North Korea uses cryptocurrency theft proceeds to finance illicit weapons programs. The investigation highlights how attackers exploit human trust rather than relying exclusively on technical vulnerabilities.
For cryptocurrency businesses, stronger employee verification, restricted system permissions and independent confirmation of unexpected software instructions remain essential safeguards against increasingly sophisticated impersonation attacks.
Also Read: Binance Hack Shakes Crypto Confidence in India as 59% Support Complete Ban, Survey Finds