How North Korean hackers turned familiar faces into a $400 million heist
Imagine a video call invitation from a colleague you trust. You join, and there they are, but their audio is cutting out. A prompt offers a quick fix. You click, and the malware is in.
According to the FBI, that sequence has cost victims more than $400 million in cryptocurrency over the past 18 months, and it is the work of North Korean state-sponsored hackers. The bureau calls the scheme FaceStealer. More than 900 people have been caught by it.
The trap works because nothing about it looks unusual. The attackers start with a social media account that is either invented or taken over from a real person, and use it to invite a target to a meeting. The meeting is hosted on a fake copy of Zoom, Microsoft Teams or Google Meet. Once the target joins, the hackers don’t speak. They play back recordings of people the target knows, taken from earlier victims, which makes the call look real. Then the sound is made to fail, and a message appears on screen asking the target to repair it by following a link. The link installs malware.
That malware gives the hackers a way into the victim’s contacts and apps, so each compromised person becomes a source of new targets. The calls themselves are secretly recorded, and the footage is reused against the next person on the list.
US authorities say the campaign “aggressively targets” people in cryptocurrency and web3, especially those who build and maintain open-source software. The FBI describes it as capable of fooling even the most experienced and security-conscious technical user. Patrick Grandy, who leads the bureau’s Los Angeles field office, said the scheme exploits trust in video platforms and in personal relationships. His blunt warning: anyone who can’t picture themselves falling for it is “not thinking creatively enough.”
Brett Leatherman, the FBI’s cyber director, said the North Korean government depends on large-scale crypto theft to finance its illicit weapons programme, and has taken billions of dollars in recent years.
The announcement comes a week after Binance, the world’s largest crypto exchange, disclosed that hackers using fake job interviews had stolen a record $6.3 billion from the company. US law enforcement agencies blame actors linked to North Korea for that attack, which is believed to be the biggest crypto theft to date. Pyongyang denies it.
About The Author
