FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
North Korean hackers stole over $400M in crypto using deepfake video calls.
The FBI has revealed that North Korean threat actors, operating under the codename FaceStealer, have stolen over $400 million in cryptocurrency in the past 18 months. This social engineering scheme utilizes recorded videos and deepfakes to trick targets into installing malware that steals crypto and compromises their systems. The U.S. government has seized the infrastructure used in this campaign and also announced the restraint of over $1.2 billion in crypto stolen by the TraderTraitor actors.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonNorth Korean threat actors used AI-generated deepfake video calls and recorded videos to impersonate trusted individuals, convincing targets to install malware that stole cryptocurrency credentials and compromised systems. The root failure is a lack of security awareness: targets were unable to distinguish synthetic media from authentic communications and were socially engineered into executing malicious software. This matters because deepfake-enabled social engineering bypasses traditional technical defenses entirely, exploiting human judgment rather than software vulnerabilities. Organizations and individuals holding high-value crypto assets are prime targets, and a single successful deception can result in catastrophic, often irreversible financial loss.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Deception and honeypots
An attacker who gets in quietly can explore the network for weeks before any alarm goes off.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FaceStealer
- malware — GhostCall
- malware — ClickFix