FBI: North Korea's FaceStealer stole over $400 million in crypto
Original title: FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
U.S. authorities seized the campaign's cloud infrastructure and restrained more than $1.2 billion tied to a Binance theft by TraderTraitor.
The FBI says North Korea-linked actors stole more than $400 million in cryptocurrency over 18 months through FaceStealer, a social-engineering scheme aimed at crypto and Web3 individuals. Victims are lured from hijacked accounts into fake Zoom or Teams calls that play recorded or deepfake video, then pushed into a ClickFix-style malware install. The Justice Department also announced seizure and restraint of more than $1.2 billion recently stolen from Binance by TraderTraitor actors, which it says funds Pyongyang's weapons program.
Unconfirmed: Overlap with Kaspersky's GhostCall is described as partial, and the $400 million and $1.2 billion figures are U.S. government statements.
- BlueNoroff, also tracked as APT38 and UNC1069, is linked to the activity.
- Fake meeting domains cited include uu01webzoom.us and teams.livemeet.us.
- Malware harvests wallets and seed phrases and hijacks Telegram and other accounts.
- JUMPSEC described a self-propagating chain that reuses victims' contact lists.
- Some activity overlaps a campaign Kaspersky called GhostCall in October 2025.
Impact: Cryptocurrency theft and takeover of victims' accounts
- ATT&CK
- T1566.002 Spearphishing LinkT1204.001 Malicious LinkT1059 Command and Scripting InterpreterT1586.001 Compromise Accounts: Social Media AccountsT1036 Masquerading
- Products
- ZoomMicrosoft TeamsTelegram
- Threat actors
- BlueNoroffAPT38TraderTraitorUNC1069
- Malware
- FaceStealer
- Victims
- Binance
- Organizations
- FBIU.S. Department of JusticeKasperskyJUMPSEC
- Countries
- North KoreaUnited States
- AI models
- ChatGPT
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | livemeet.us | meeting URL for Zoom ("uu01webzoom[.]us") or Teams ("teams.livemeet[.]us"). Exploit recorded videos: When the target joins the fak |
| domain | uu01webzoom.us | osquatted link that masquerades as a meeting URL for Zoom ("uu01webzoom[.]us") or Teams ("teams.livemeet[.]us"). Exploit recorded vide |
From the original article
9 min read at thehackernews.com
The U. S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering scheme codenamed FaceStealer in the last 18 months.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.