Source-reported · Independent verification status is not recorded for this article; claims remain attributed to their sources.
FBI: North Korean Hackers Used Deepfake Video Calls to Steal Over $400 Million in Crypto
North Korean hackers stole more than $400 million in cryptocurrency by luring victims onto fake video calls that used deepfake faces and planted malware, the FBI says. The operation shows how Pyongyang mixes social engineering and AI tools to fund its sanctioned state and complicates trust in everyday online interactions.
North Korea-linked hackers turned routine video calls into a way to steal hundreds of millions of dollars in cryptocurrency, according to U.S. investigators.
The FBI says the attackers took more than $400 million in crypto using fake video calls built around deepfaked identities and malware. The scheme relied on stolen accounts, familiar-looking faces, and staged audio problems to convince targets they were speaking with trusted contacts, then nudged them toward actions that installed malicious software.
Targets included people and organizations active in the digital asset world, such as developers, traders, or staff with access to internal systems. By hijacking or convincingly imitating real profiles, the hackers lowered skepticism at the start of a call. When the video or sound appeared to fail, they shifted to links, documents, or “updates” that carried the payload.
The financial impact for some victims runs from disrupted projects to wiped-out holdings. On a personal level, the wave of theft undermines confidence in basic processes like remote job interviews or onboarding, which have become standard in many fields.
The FBI says it has seized the infrastructure used in the campaign, cutting off the servers and other resources that supported the deepfake calls and malware distribution. But the underlying approach—combining social engineering, stolen accounts, and AI-generated visuals—can be reused by other actors.
This fits a broader pattern in which Pyongyang turns cybercrime into a revenue source under sanctions. Cryptocurrency theft gives it global reach and a way to move funds through mixers and exchanges.
The next steps to watch include any new U.S. or allied sanctions on North Korean units or intermediaries tied to these operations, closer scrutiny of exchanges that receive stolen funds, and moves by companies to tighten identity checks for sensitive video calls.