AI-generated illustration
North Korean deepfake scam attacks have drained more than $400 million in crypto over about 18 months, the FBI said on 13 November 2026. The scheme, called FaceStealer, uses fake video calls to trick people into installing malware. Agents have seized the cloud servers behind it, along with more than 900 recorded victim webcam clips.
The FBI links the activity to BlueNoroff, a North Korean group also tracked as APT38, UNC1069, and Sapphire Sleet. Crypto and Web3 workers are the main targets.
How does the North Korean deepfake scam work?
It starts with a stolen chat account, usually Telegram. The attackers message the victim’s real contacts and pitch a Zoom or Teams call about an investment. If the target bites, they get a Calendly invite and, just before the call, a fake meeting link.
On the call, the hackers play old webcam clips of someone the target trusts. They mix in deepfake video so it looks like several people are present. Then an audio error pops up. The “fix” is a link or a command, and running it installs malware.
That malware steals wallets and seed phrases. It also records the new victim on video, so the cycle starts again with their contacts.
Who the hackers go after
Crypto and Web3 staff who hold funds, signing keys or exchange access are the top targets. Open-source developers are in the frame too. Breaking into one maintainer can poison software that thousands of people use, and a maintainer of the Axios npm package was targeted this year.
Arctic Wolf counted more than 400 victims in over 20 countries back in April. The campaign later grew to 677 targets across 58 countries, and over 80% were founders or senior executives. The attackers also study YouTube interviews and conference talks to build their deepfakes.
A separate fake-recruiter campaign
Do not mix this up with the fake job interview attacks. A joint advisory from Japan, the US, Australia and Germany in late September estimated at least 30,000 compromised devices in 100 countries from that campaign. It is a different operation, but it comes from the same wider North Korean playbook.
What you should do
- Check the call another way. If a friend invites you to an investment call, confirm by phone or another app before you join.
- Never run a “fix” from a call. An audio error that asks you to click a link or paste a command is the warning sign.
- Use a disposable virtual machine. For interview tasks or unknown downloads, never use your work laptop. This is the advice from JFrog researchers.
- Vet recruiters. Check how old the profile is and whether the company location matches across its pages.
- Keep crypto on a separate device. Do not hold seed phrases on the machine you use for video calls.
What happens next
The Justice Department also announced a separate seizure of over $1.2 billion in crypto stolen by TraderTraitor actors after the Binance hack. That is a different case. Whether the FaceStealer takedown slows the group down is still unclear.
Related on Technwz: Binance Heist: FBI Blames North Korea’s TraderTraitor
Sources: The Hacker News, FBI
