Got a Video Call Invite From a Crypto Contact? FBI Says It Could Be North Korea

The FBI is warning crypto holders about FaceStealer, a scheme North Korean hackers use to drain funds via fake video calls. The bureau says it has taken more than $400 million over the last 18 months.

Anyone who owns crypto, works in Web3, or maintains open-source code is a potential target, the FBI adds.

How the FaceStealer Scheme Works

The Justice Department ties the campaign to groups known as Sapphire Sleet, BlueNoroff, and APT38, among other names. Each FaceStealer lure starts with a meeting invite sent from an account stolen from an earlier victim.

Once the target joins, the attackers secretly record the target’s webcam. Meanwhile, they play prerecorded clips of past victims the target knows, so trusted contacts appear to be on the call. The DOJ says the group also uses deepfakes of well-known crypto figures.

Next, the North Korean hackers fake a technical error, such as claiming the target cannot be heard. The “fix” they send installs malware. In several cases, the theft came months or even more than a year after the first compromise.

The FBI is warning the public about FaceStealer, a highly effective social engineering scheme used by North Korean cyber actors to steal cryptocurrency and target the software supply chain. FaceStealer uses imposter versions of video conference platforms, secretly recorded web… pic.twitter.com/3UuMRgBajt

— FBI Cyber Branch (@FBICyberBranch) November 12, 2026

The FaceStealer tactic is not new. Reports last year already tied fake Zoom meetings to $300 million in North Korean crypto theft. Google’s Mandiant team also flagged similar AI-enabled Zoom lures earlier this year.

FBI Seizes 900 Victim Webcam Videos

The FBI says it disrupted cloud-based infrastructure behind FaceStealer and seized more than 900 webcam videos of victims. Its Los Angeles field office led the probe.

It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.

Patrick Grandy, Assistant Director in Charge, FBI Los Angeles Field Office

Open-source developers are a growing focus. By hijacking trusted maintainer accounts, North Korean hackers could slip malicious code into widely used software, the FBI warns.

Each new FaceStealer victim also becomes a launchpad. The hackers comb contact lists, social media, and chat apps to find the next targets, the DOJ says.

Alongside the FaceStealer disruption, the DOJ moved to seize $1.2 billion from the Binance hack. Overall, North Korean hackers have stolen $7.61 billion in crypto this year, BitOK data shows.