DOJ Says North Korean Hackers Stole $400M Using Deepfake Video Calls
The U.S. Justice Department said North Korean hackers stole more than $400 million in crypto over 18 months using a scheme called FaceStealer, which combines recorded footage and AI deepfakes in video calls. The DOJ also said it has sought court authority to seize over $1.2 billion of the funds stolen in the October Binance hack, which it attributes to North Korea.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The FaceStealer Scheme
North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months, according to the U.S. Department of Justice, which announced the seizure of infrastructure tied to the operation on Thursday. The FBI calls the scheme "FaceStealer."
According to the DOJ, attackers lure targets into video conference calls using accounts taken from earlier victims. They then play prerecorded webcam footage of trusted contacts and use AI-generated deepfakes of well-known figures in crypto and adjacent industries to build confidence. Once a target is at ease, the attackers stage a fake audio problem and send a link to "fix" it, which instead installs malware. From there, they can drain wallets or use the victim's access to other systems, in some cases waiting more than a year before acting. The FBI said it seized more than 900 webcam recordings of FaceStealer victims under a federal warrant.
Attribution and Targets
The DOJ linked the operation to North Korean groups known as Sapphire Sleet, BlueNoroff and APT38, among other names. The department warned that these hackers have increasingly targeted open-source software developers, an approach it said may be aimed at enabling supply-chain attacks.
Binance Hack Update
The announcement was paired with an update on the Binance theft. The DOJ said it has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from the exchange on October 29. The FBI attributes that theft to the North Korean group TraderTraitor, and says over $2.7 billion has been frozen so far. The FBI said the regime has been moving the proceeds quickly, creating a new wallet roughly every 25 seconds. North Korea has denied involvement and called the FBI's finding a political provocation.
Broader Context
The U.S. recently sanctioned 11 people over a North Korean IT-worker scheme that moved millions in crypto. Officials said efforts to trace and recover the stolen Binance funds are ongoing.
Why It Matters
For Traders
Frozen and seized Binance-linked funds are being tracked, so watch for official recovery updates, though no trading action is implied by this report.
For Investors
State-linked theft at this scale keeps custody and exchange security central to sector risk, and government seizure powers are expanding.
For Builders
Video-call social engineering and malicious developer targeting mean teams should harden meeting-link verification and open-source dependency review.
This article is for information only and is not financial advice. Read the full disclaimer.
