The US Federal Bureau of Investigation (FBI) and Department of Justice announced on November 12, 2026, the dismantling of FaceStealer, a cryptocurrency scam attributed to North Korean hackers. The scam, which used fake video calls to steal over $400 million in cryptocurrencies in 18 months, was operated through a network of compromised Telegram and LinkedIn accounts. Victims were tricked into downloading malware that gave hackers access to their computers, cryptocurrencies, and social media accounts.
The FaceStealer scam involved a sophisticated social engineering scheme, where hackers would first compromise a person's Telegram or LinkedIn account and then invite the target to a video conference. Once connected, the victim's webcam would record a video, which would then be used to simulate a conversation with a trusted contact. Hackers also used deepfakes of industry personalities to gain the victim's trust. According to Jeremy Robertson, a special agent at the FBI's Los Angeles office, the hackers would send a message posing as someone the victim knew or a sector expert, and then prompt them to download a software update that actually installed malware.
The FBI attributed the FaceStealer operation to the BlueNoroff group, also known as APT38, which has been targeting executives, developers, and cybersecurity experts in the cryptocurrency and Web3 sectors. The group has increasingly focused on open-source software developers, raising concerns about potential attacks on software supply chains. Patrick Grandy, assistant director of the FBI's Los Angeles office, emphasized the difficulty of protecting against such scams, stating that FaceStealer was a highly effective social engineering system that could deceive even the most security-conscious users.
As part of the operation, the FBI seized servers and over 900 videos of webcam recordings from victims. The authorities also warned that the North Korean regime relies heavily on cryptocurrency theft to fund its illicit weapons program, having stolen billions of dollars in recent years. Brett Leatherman, director of cyber operations at the FBI, stressed the agency's commitment to identifying and disrupting North Korean actors targeting the virtual asset community.
The FaceStealer scam highlights the growing threat of social engineering attacks in the cryptocurrency space. According to the FBI, the scam was designed to exploit users' trust in video conferencing platforms and personal relationships. The agency urged users to be cautious when receiving unsolicited video conference invitations and to be wary of software updates that could potentially install malware.
The dismantling of FaceStealer comes as part of a broader effort by US authorities to crack down on cryptocurrency-related crimes. On the same day, the Department of Justice announced the seizure of over $1.2 billion stolen in a separate hack of the Binance platform. The FBI and other agencies have been working to disrupt North Korean hacking operations, which have been linked to various high-profile cryptocurrency heists in recent years.
The FBI's success in dismantling FaceStealer demonstrates the importance of international cooperation in combating cybercrime. The agency worked with various partners to identify and disrupt the North Korean hackers behind the scam. As the cryptocurrency space continues to evolve, users and authorities must remain vigilant to the threats posed by sophisticated social engineering attacks like FaceStealer.
Key points
- The FaceStealer scam was attributed to the BlueNoroff group, also known as APT38, which has been targeting executives, developers, and cybersecurity experts in the cryptocurrency and Web3 sectors.
