US Busts North Korean Deepfake Scam Behind $400m Crypto Theft

The United States Department of Justice (DOJ) has disrupted a North Korean cybercrime operation known as FaceStealer, which allegedly stole more than $400 million in cryptocurrency over the past 18 months using fake video calls and deepfake technology.

The department announced on Thursday, November 12, that it had seized cloud-based infrastructure used by the hackers to carry out the scheme, which targeted cryptocurrency holders, Web3 professionals and individuals involved in developing and maintaining open-source software.

According to the DOJ, the hackers tricked victims into joining online meetings through invitations sent from accounts previously compromised. During the calls, they used recorded webcam videos of people known to their targets, as well as deepfake videos of influential figures, to create the impression that trusted contacts were participating.

The attackers then introduced fake technical problems, such as claiming that a participant could not be heard, and instructed victims to click links or follow prompts to fix the issue. These actions secretly installed malware on victims’ computers, allowing the hackers to steal cryptocurrency, access accounts and target the victims’ personal and professional contacts.

The FBI also seized more than 900 webcam videos of victims during the investigation. Authorities warned that the campaign had increasingly targeted open-source software developers in an apparent attempt to gain access to software repositories and carry out wider supply-chain attacks.

In a separate operation, the DOJ obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, one of the world’s largest cryptocurrency exchanges. North Korean military hackers identified by the FBI as TraderTraitor reportedly stole more than $6 billion from the exchange on or around October 29, 2026.

The US government and private-sector partners have so far frozen more than $2.7 billion of the stolen assets, with efforts to trace and recover the remaining funds still ongoing. US authorities said North Korea uses proceeds from cryptocurrency theft to finance its government and illicit weapons programme.