North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using fake video meetings, malware and compromised accounts, the Federal Bureau of Investigation (FBI) said on November 12. US authorities have launched an operation to disrupt the cybercrime network.

The campaign, identified as “FaceStealer”, uses hacked social media and communication accounts to send convincing video call invitations. Attackers impersonate people familiar to their targets, exploiting personal and professional relationships to gain access to their cryptocurrency holdings and computer systems.

The FBI said the hackers initially targeted people working in the cryptocurrency and Web3 industries. However, they have increasingly focused on individuals involved with developing and maintaining open-source software.

According to the US Justice Department's November 12 announcement, hackers send invitations using accounts they have previously compromised. During these meetings, they play prerecorded webcam footage of people recognised by the targets. This creates the impression that they are speaking with someone they trust.

The attackers then claim there is a technical problem, such as an audio malfunction. They ask victims to click on a link or follow troubleshooting instructions. These steps secretly install malware on the victim's computer, allowing hackers to steal cryptocurrency, access communication accounts and compromise connected systems.

Hackers also use stolen contacts and recorded webcam footage to identify and approach new targets. The FBI said it had seized more than 900 webcam videos of victims under a federal warrant. Investigators also found that attackers began using AI-generated deepfake videos of influential figures in the cryptocurrency and blockchain industries to make their scams more convincing.

The Justice Department said it had seized cloud-based infrastructure used in the FaceStealer campaign. Investigators linked the operation to hacking groups, including Sapphire Sleet and UNC1069.

FBI officials warned that the campaign had expanded beyond cryptocurrency theft. Hackers are increasingly targeting open-source software supply chains to compromise developers and repository accounts.

The FBI's November 12 cybersecurity advisory explains how the scheme works. It also gives individuals and organisations guidance on spotting suspicious video call invitations and avoiding malicious troubleshooting instructions.

The FaceStealer campaign is separate from another North Korean-linked cryptocurrency theft involving Binance. In that case, the FBI attributed a theft exceeding $6 billion to a group it calls TraderTraitor.

The Justice Department said US authorities had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency linked to the Binance breach. Efforts to trace and recover the stolen assets are continuing.