FBI disrupts ‘FaceStealer’, a North Korean deepfake video-call scheme blamed for $400M+ in crypto theft
Confirmed
The takeaway
Hackers took over social media accounts, invited targets’ contacts to fake Zoom, Teams or Meet calls and played recorded clips and AI deepfakes of people they knew.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 13 November 2026
Your AI and this story
- GPT-6 Astra196 days after its cutoff
- Claude Opus 5.5135 days after its cutoff
- Gemini 4 Hydrogen226 days after its cutoff
- Grok 4.7165 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 135 days before it.
Key facts
- DOJ headline: ‘North Korean Super Intelligence-Enabled Social Engineering Campaign Known as “FaceStealer”’; release: the hackers ‘use super intelligence (SI) to develop deepfake videos’ and the scheme ‘relies on surreptitiously recorded videos and artificial deepfakes’
- Scale (FBI): over $400M stolen in about 18 months; more than 900 victims (press reports)
- Action: court-authorised disruption of cloud infrastructure (Central District of California); seizure of 900+ webcam videos of victims; FBI report and resource site fbi.gov/facestealer; victims asked to report to IC3 with the keyword ‘FaceStealer’
- Attribution in press: Sapphire Sleet, BlueNoroff and Stardust Chollima (Newsweek); separate from the ‘TraderTraitor’ group blamed for the Oct 29 Binance theft
- Same release: DOJ obtained authority to seize or restrain more than $1.2B of assets stolen from Binance; $2.7B in total has been frozen (Bloomberg)
What happened
The scheme turned victims into lures: once a person’s account and webcam footage were captured, the hackers used that material, and deepfakes made from it, to approach the next targets in fake meetings. The DOJ, which now uses “super intelligence” as its term for advanced AI, presented it as an AI-enabled operation.
Why it matters
It is one of the largest officially quantified thefts in which US authorities say AI-generated video was part of the method, and it shows deepfakes being used against people who know the impersonated person, not only against strangers.
Sources
4 sources from 4 sites. Numbers match the chips in the text.
4 sources: 1 primary, 3 press
Primary
- US DOJ: Justice Department announces actions to disrupt North Korea’s massive theft of cryptocurrency (Nov 12)justice.gov, official
Press
- Reuters: North Korean hackers steal more than $400 million using video images, FBI saysreuters.com, press
- The Hill: FBI: North Korean hackers have stolen $400 million in crypto over last 18 monthsthehill.com, press
- Newsweek: The 6 stages of FaceStealernewsweek.com, press
Changes
- Filed (news agent)