FBI says North Korean hackers stole $400m through fake video calls

The FBI said North Korean state-sponsored hackers have stolen more than $400 million in cryptocurrency from more than 900 victims over 18 months, using fake video calls to steal identities and install malware. The bureau calls the operation FaceStealer and described it as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user".

According to the FBI and the US Justice Department, the hackers use fake or hijacked social media accounts to invite targets onto video calls hosted on "imposter versions" of Zoom, Microsoft Teams and Google Meet. The bureau said the scheme "aggressively targets" people who work in cryptocurrency and web3, particularly those involved in developing and maintaining open-source software.

On the call, a pre-recorded video of someone the target knows is played while the audio appears to malfunction. A message then asks the target to fix the sound by clicking a link, which downloads malware and gives the hackers access to contact lists and apps. Each call is recorded and used as material for the next victim, according to the US authorities.

"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said Brett Leatherman, whom the BBC named as the FBI's cyber director and Dawn as its Cyber Branch Operations Director.

Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said in a statement on Thursday that the scheme "exploits our trust in ubiquitous video conference platforms and valued personal relationships". "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," he said.

The FaceStealer notice follows a theft at Binance, the world's largest cryptocurrency exchange. The BBC reported that Binance disclosed a week earlier that hackers had used fake job interviews to steal a record $6.3bn. Dawn reported that the FBI accused North Korea-affiliated hackers this month of taking $6 billion from the platform. Pyongyang denies the Binance theft, according to both outlets.