FBI warns crypto traders over latest hacking scheme
North Korean cyber actors have stolen more than US$400 million in cryptocurrency over the past 18 months through a sophisticated online scam that uses fake video meetings to deceive victims, the Federal Bureau of Investigation (FBI) has disclosed. The scheme, identified by the FBI as “FaceStealer”, targets people working in the cryptocurrency and Web3 industries, […]
The Federal Bureau of Investigation (FBI) has issued a warning to cryptocurrency traders about a new hacking scheme dubbed "FaceStealer". This sophisticated scam, originating from North Korean cyber actors, has netted over US$400 million in digital currency over the past 18 months. The FaceStealer scheme primarily targets individuals in the cryptocurrency and Web3 industries, as well as developers and maintainers of open-source software.
The hackers impersonate trusted professional contacts and invite targets to video conferences using compromised accounts. They record victims' webcam footage and use pre-recorded videos of familiar faces or deepfake videos of influential figures to make the meetings seem legitimate. The attackers then introduce a supposed technical issue and direct victims to a link or prompt, secretly installing malware on their devices.
This allows the hackers to steal cryptocurrency, hijack communication accounts, and access victims' contact lists and social media accounts. The FBI disrupted the FaceStealer infrastructure on November 12, 2026, seizing over 900 webcam videos of victims worldwide. The investigation, led by the FBI's Los Angeles Field Office, identified several North Korean cyber actor names linked to the scheme.
The FBI has warned that anyone involved in cryptocurrency, Web3, or open-source software development could be at risk and published a cybersecurity advisory to help protect against the scheme.
Written by urgent.news from Adom Online's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
