North Korean state-backed hackers stole more than $400 million in cryptocurrency over the past 18 months through a social engineering campaign involving fake video meetings, according to an FBI disclosure reported by Reuters on November 12. The campaign, called FaceStealer, uses compromised contacts and familiar faces to persuade targets to install malware.
The figure covers accumulated theft across that period. Deepfakes are an emerging addition to a scheme that the FBI says still overwhelmingly relies on genuine webcam recordings stolen from previous victims.
For crypto businesses, the operational problem is specific: a recognizable person appearing on a call can no longer authenticate the instructions delivered alongside their image.
A familiar contact delivers the invitation
Reuters reports that invitations arrive from genuine communication accounts belonging to people the target has previously interacted with. Attackers have compromised those accounts and secretly recorded their owners.
Targets enter imitation versions of services including Zoom, Microsoft Teams and Google Meet. During the meeting, a supposed technical fault creates a reason to click a repair link. Following the instructions infects the computer, while the attackers record another face and gain access to another contact network.
Reuters identifies the hackers as Sapphire Sleet or UNC1069. Its report distinguishes them from the group associated with the separate Binance theft. Reuters' account describes the invitation and infection sequence.
The meeting provides social pressure as well as visual reassurance. Interrupting a scheduled conversation to question a colleague's identity is awkward. Fixing an apparent audio problem feels like completing an ordinary task. FaceStealer exploits that willingness to get the meeting moving.
This also changes the value of a stolen communication account. Beyond sending messages, the account lets attackers draw on an existing relationship to make the next request credible.
The fake update leads into the computer
Microsoft's earlier technical research shows how the repair pretext works. In a macOS campaign attributed to Sapphire Sleet, targets received an AppleScript file presented as a Zoom SDK update.
The file displayed apparently harmless instructions, then used thousands of blank lines to push malicious code out of immediate view. Executing it started a sequence that downloaded further components.
Microsoft also documented a counterfeit system password prompt. After the victim entered a password, the malware checked that it worked and transmitted it to attacker-controlled infrastructure. A separate completion message reinforced the impression that an update had finished successfully. These details come from Microsoft's investigation of the macOS intrusion.
That research predates the latest FBI disclosure. It explains the technical consequences of accepting a malicious update without attributing every FaceStealer theft to this particular implementation.
Participating in a conversation and authorizing software execution are separate decisions. A meeting invitation gives no reason to trust an attached script. The same applies when a recognizable face appears to approve it.
SpendNode's coverage of wallet software patched after reported thefts concerns another route to exposed funds. Here, the opportunity to intervene comes earlier, when a user is persuaded to run the supposed repair.
Stolen footage creates another round of targets
The FBI seized more than 900 victim webcam videos. Its advisory says attackers have begun generating deepfakes of influential crypto figures, but stolen recordings remain the dominant material.
The threat can persist after the meeting is forgotten. The FBI describes cases in which cryptocurrency theft and account hijacking occurred months to more than a year after initial compromise, with attackers waiting for wallet balances to grow.
The advisory also addresses open-source maintainers, whose compromised access can threaten software distribution. Its recommendations include joining through official applications with meeting codes, confirming invitations through another communication method, and refusing instructions to paste repair code into a terminal. The FBI's FaceStealer advisory contains the findings and response guidance.
The delayed theft changes the response calculation. A wallet balance that survives the first evening offers little reassurance if the computer or recovery material was exposed. Waiting for money to disappear would leave the attacker choosing the timing.
For businesses, verification should occur outside the conversation requesting the software change. An established phone number or separate contact method gives staff a way to interrupt the attack without having to judge whether a moving face looks synthetic.
Overview
FaceStealer combines stolen communication accounts, recorded faces and malicious meeting repairs. The FBI attributes more than $400 million in cryptocurrency theft over 18 months to the campaign, while identifying deepfakes as an expanding technique within it.
The practical boundary is the request to install or execute something. A familiar face does not authorize that request. The FBI recommends opening the official meeting application and joining with an invitation code.
