US says North Korean hackers stole more than $400 million using fake video calls, and moves to seize $1.2 billion of Binance loot
November 12, 2026 (November 12, 2026)
On November 12 the US Justice Department announced action against a North Korean social-engineering scheme the FBI calls FaceStealer, which it says has stolen more than $400 million in crypto over about 18 months. The attackers invite targets to video meetings from accounts stolen from earlier victims, play secretly recorded webcam footage of people the target trusts and use AI deepfakes of well-known figures in crypto. Once the target is at ease they fake a technical problem, such as not being heard, and send a link to "fix" it, which installs malware. They then drain wallets or use the victim's access to other systems, sometimes months later. The Justice Department seized the infrastructure behind the scheme, the FBI seized more than 900 webcam recordings of victims, and the department links it to North Korean groups tracked as Sapphire Sleet, BlueNoroff and APT38, among others. It says the attackers increasingly target open-source software developers, apparently to set up supply-chain attacks. The same day it obtained court authorization to seize or restrain more than $1.2 billion of the funds stolen from Binance on October 29.
Why it matters
A familiar face on a video call is no longer proof of who you are talking to. The scheme targets people with access to wallets or code, and the payoff can come long after the call.
What defenders can take from it
- Never install software or click a "fix" link during a video call, even if the caller looks and sounds like someone you know.
- Confirm unexpected meeting invitations through a second channel you already use with that person.
- Keep wallets and code-signing keys on a separate device from the one used for calls and email.