Somewhere between a friend's familiar face and a meeting invitation that seems entirely ordinary, a quieter kind of theft has taken root, one that relies less on breaking locks than on the human instinct to trust a known voice. US authorities say North Korean state-backed hackers have used this method, which they call FaceStealer, to take more than $400 million in cryptocurrency from over 900 people across roughly eighteen months. It arrives in the same season as a far larger heist against Binance, and both reveal the same uncomfortable truth: in the modern digital world, the most valuable thi
North Korean Hackers Used Fake Video Calls to Steal $400m in Crypto, FBI Says
More than 900 victims have reportedly been defrauded or compromised, with malware giving attackers access to their contacts and apps.
Each person who is compromised becomes bait for the people they know.
Mark
Why does this scheme stand out from other crypto thefts?
Mimi
It doesn't break into anything technical. It uses a call that looks like it comes from someone you know, on a platform you already use.
Mark
And the audio problem is the hook?
Mimi
Yes. The recorded video plays, the sound seems to fail, and a message offers a fix through a link. Clicking it downloads the malware.
Luke
Let me flag what we're actually leaning on. The $400 million and the 900 victims are the FBI's figures, attributed to the bureau. The article doesn't say how they were counted.
Mark
Fair. And the North Korea link?
Mimi
US authorities attribute FaceStealer to state-sponsored North Korean hackers. Leatherman's remarks tie such thefts to funding weapons programs.
Luke
That funding point is a general statement about the regime's thefts, not a traced figure for this scheme. And on Binance, the attribution is by US agencies, and Pyongyang denies it.
Mark
What spreads the scheme?
Mimi
The malware gives access to contacts and apps, and the recorded calls are reused to fool new victims.
Luke
What we don't know from this reporting is how many victims lost money versus were only compromised, or whether any funds have been recovered.
Le Pouls
- A routine video invitation from a trusted contact opens onto a silent call, and the stillness itself becomes the alarm.
- A pre-recorded face of a past victim plays back to simulate a conversation, turning ordinary trust into the trap.
- A helpful-sounding 'audio fix' link quietly installs malware that reaches every contact and app the victim holds.
- Hundreds of victims are already counted, and each compromised person becomes bait for the people they know.
- Investigators are tracing the trail toward North Korean state actors, while Pyongyang denies the links and watchers await new defences from platforms and the industry.
Somewhere between a friend's familiar face and a meeting invitation that seems entirely ordinary, a quieter kind of theft has taken root, one that relies less on breaking locks than on the human instinct to trust a known voice. US authorities say North Korean state-backed hackers have used this method, which they call FaceStealer, to take more than $400 million in cryptocurrency from over 900 people across roughly eighteen months. It arrives in the same season as a far larger heist against Binance, and both reveal the same uncomfortable truth: in the modern digital world, the most valuable thing to exploit is often not code but confidence.
The call begins without any warning. An invitation arrives from an account that seems to belong to someone you know, pointing to a video meeting on a platform you use every day. When you join, a familiar face appears, but the sound does not work.
According to the FBI and the US Justice Department, that silence is the moment the trap closes. The face is a pre-recorded video of an earlier victim, played back to imitate a real conversation, and the platforms are convincing imposters of the genuine ones. A message then offers to repair the audio if you click a link, and that link installs malware.
US authorities call the operation FaceStealer and attribute it to North Korean state-sponsored hackers, who have taken more than $400 million in cryptocurrency from over 900 people in the past eighteen months. Once inside a device, the attackers can reach contacts and apps, and secretly record calls, which become material for scamming the next people on the list. Each compromised person becomes a lure for the people around them.
The FBI warns that the scheme aggressively targets crypto and web3 workers, especially open-source developers, and that it can fool even the most security-minded users. Officials say it exploits trust in everyday video tools and in close personal relationships.
The announcement follows a week after Binance revealed a record $6.3bn theft carried out through fake job interviews, which US agencies have linked to North Korea. Pyongyang denies both attributions. The two cases share a method: a believable false pretext rather than a broken piece of software. What comes next will be further attribution and whatever defences the platforms and industry decide to build.
The call looks ordinary at first. An invitation arrives from a social media account that appears to belong to someone you know, and it points to a video meeting on what looks like Zoom, Microsoft Teams or Google Meet. When you join, a familiar face is on screen. But the audio doesn't work.
According to the FBI and the US Justice Department, that is the moment the trap closes. The familiar face is a pre-recorded video of a previous victim, played back to simulate a real conversation. The platforms are "imposter versions" of the real ones, and the invitations come from fake or hijacked accounts. A message then appears on screen offering to "fix" the sound if the target clicks a link. The link downloads malware.
US authorities call the scheme FaceStealer and say North Korean state-sponsored hackers are behind it. They put the haul at more than $400 million in cryptocurrency, taken from more than 900 victims over the last 18 months.
Once the malware is on a device, the attackers can reach the victim's contact lists and apps, which widens the pool of people they can approach. The hackers also secretly record the calls, and authorities say those recordings become raw material for scamming the next victims. Each person who is compromised becomes bait for the people they know.
The FBI says FaceStealer "aggressively targets" people who work in cryptocurrency and web3, particularly those who develop and maintain open-source software. The bureau describes it as a highly effective social engineering scheme, capable of deceiving even the most experienced technical and security-conscious computer user.
Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said in a statement on Thursday that the scheme exploits trust in ubiquitous video conference platforms and in valued personal relationships. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," he said.
FBI cyber director Brett Leatherman placed the case in a larger context. The North Korean regime, he said, relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, and has stolen billions of dollars in recent years.
The announcement comes a week after Binance, the world's largest crypto exchange, revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. That is thought to be the largest crypto hack to date. US law enforcement agencies attributed it to North Korea-linked actors, a claim Pyongyang has denied.
The two cases share a method: both rely on a convincing false pretext, whether a job interview or a call from a friend, rather than on breaking software directly. Further attribution and any new defences from the platforms or the industry are what to watch for next.
Citations marquantes
If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough.— Patrick Grandy, FBI Los Angeles field office
The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program.— Brett Leatherman, FBI cyber director
Envie de l'histoire complète ?
Lire l'original sur BBC News ↗