North Korea-linked cybercriminals have stolen over $400 million in cryptocurrency during the past 18 months, using advanced tactics that combine fake video calls and AI-generated deepfakes to target individuals and companies across the Web3 sector.
AI-Powered Attacks Target the Crypto Industry
The operation, known as FaceStealer, involves hackers infiltrating victims’ computers, recording webcam footage without consent, and seizing communication accounts. Attackers then initiate video meetings with victims’ contacts, posing as someone known to the target and displaying either prerecorded footage or convincing AI-generated videos.
During these interactions, the hackers often claim technical issues such as audio malfunctions, directing targets to click links or perform troubleshooting steps that secretly install malware. Once a system is compromised, the attackers can access sensitive information and transfer cryptocurrency funds without authorization.
The Federal Bureau of Investigation (FBI), responsible for investigating threats to national security in the United States, reported that its probe led to the seizure of more than 900 webcam recordings of victims. Authorities stated that hackers sometimes waited several months or over a year after the initial compromise before moving stolen assets, demonstrating patient and calculated tactics.
FBI Assistant Director in Charge Patrick Grandy cautioned that the FaceStealer group exploits trusted professional relationships and common online platforms, calling the campaign a highly effective social engineering scheme.
The United States Department of Justice (DOJ) revealed on November 12 that law enforcement had successfully disrupted the cloud-based infrastructure used by the criminal network, dealing a blow to their operations.
Rising Threat to Open-Source Software Developers
Beyond individual crypto investors, FaceStealer has intensified its focus on open-source software developers. The FBI found that hackers increasingly target those who maintain digital platforms and repositories, aiming to gain access to software projects at the source.
This tactic raises the risk of supply-chain attacks, where malicious code could be inserted into widely used applications. Such attacks would not only endanger developers but also place businesses and end users relying on popular software at risk.
Mini dictionary: Supply-chain attacks involve targeting trusted components or parties in the software development process, such as libraries or tools, to spread malware or exploit vulnerabilities through otherwise legitimate software updates or integrations.
Observers warn that such campaigns extend the threat well beyond digital currency holders, potentially impacting the security of entire software ecosystems and critical infrastructure.
North Korea’s Expanding Cryptocurrency Theft Campaigns
TRM Labs, a blockchain intelligence firm specializing in detecting illicit financial activity, reported that North Korea’s cryptocurrency theft operations have spanned several years, with $790 million in digital assets stolen in 2022 and $205 million in 2023.
The FaceStealer campaign, responsible for more than $400 million in losses over the last 18 months, fits within a broader pattern of North Korean cyberattacks that threaten both individuals and industry-wide digital assets.
| Year | Estimated Crypto Stolen by North Korea |
|---|---|
| 2022 | $790 million |
| 2023 | $205 million |
| FaceStealer (18 mos.) | $400 million |
Amounts can fluctuate as tactics evolve, but authorities consider these sums evidence of the scope and persistence of North Korea’s digital asset operations.
Security Recommendations and Response
The DOJ and FBI have issued technical guidance on the FaceStealer scheme, recommending robust identity verification during video calls, caution when handling suspicious links, and enhanced protection of communication and software accounts.
The FaceStealer operation demonstrates that attackers are increasingly bypassing technical security defenses by manipulating trusted relationships and human interactions, making social engineering a serious concern for protecting digital assets.
Authorities urge crypto holders, developers, and organizations to remain alert as AI-generated impersonations become more sophisticated, warning that the human element can now be as vulnerable as software code.
