North Korean Hackers Steal $400M in Crypto

The FBI has released an advisory on a campaign it calls FaceStealer, which targeted cryptocurrency industry figures.

Updated on Nov. 13, 2026 in Cybersecurity

Bold flat-color editorial illustration of a closed laptop lid split by a single thin fracture line, set in a deep red and cream palette. — North Korean state-sponsored hackers stole more than $400 million in cryptocurrency over 18 months, the FBI said, using a campaign it calls FaceStealer. AI Illustration. Upload story photo >

Live Poll

Do you trust video call invitations from people you know?

North Korean state-sponsored hackers stole more than $400 million in cryptocurrency over 18 months, according to the FBI. The FBI released an advisory on Thursday naming the campaign FaceStealer and said it had seized more than 900 webcam recordings the hackers secretly made.

Why it matters

The campaign shows how state-linked hackers can exploit trust in familiar contacts and video meetings to infiltrate cryptocurrency and work accounts. For people and companies in the industry, the case underscores the risk of joining calls with unverified invitations.

The FBI's advisory describes a campaign that used hijacked accounts to send meeting invitations and played recordings of previous victims to make contacts appear present. Some thefts occurred more than a year after the initial breach, and the hackers have begun using AI-generated videos of prominent cryptocurrency figures.

The players

Federal Bureau of Investigation (FBI)

The FBI is the principal federal law enforcement agency of the United States, responsible for investigating cybercrime and national security threats.

North Korean state-sponsored hackers

North Korea has been linked by U.S. authorities to state-sponsored cyber operations that steal cryptocurrency to fund the country's government.

The details

The hackers used hijacked accounts to send meeting invitations that appeared to come from people targets knew. The fake meetings infected computers with malware, giving the hackers access to cryptocurrency and work accounts. The campaign primarily targeted people and companies in the cryptocurrency industry.

Over the past 18 months, the hackers stole more than $400 million in cryptocurrency.
On Thursday, the FBI released an advisory naming the campaign FaceStealer.
Earlier this year, the hackers breached an open-source software library downloaded tens of millions of times a week.

Roadmap

The FaceStealer campaign extends a pattern of North Korean-linked cryptocurrency theft attributed by U.S. authorities. It marks a shift toward impersonation through hijacked accounts, recorded victim footage, and AI-generated videos.

Anyone who joins video calls or accepts meeting invitations from known contacts could be targeted if those accounts have been hijacked. Users should verify unexpected meeting requests through a separate channel before joining or installing software.

The takeaway

Treat unexpected meeting invitations, even from familiar contacts, as potential threats and confirm them through a separate channel. Avoid installing software requested during calls, since that step is how the malware reached victims.