Key takeaways
- On 12 November the US Justice Department announced the seizure of the cloud infrastructure behind FaceStealer, a North Korean scheme it says stole more than $400 million in cryptocurrency in the last 18 months.
- Targets are invited to video meetings from accounts stolen from earlier victims, then shown prerecorded webcam footage of people they actually know, plus deepfakes of well-known crypto figures.
- The malware arrives through a fake technical fault - typically a claim that the target cannot be heard - and a link or prompt to fix it.
- Under a federal warrant the FBI seized more than 900 webcam videos of FaceStealer victims: each victim's recorded face became the bait for the next one.
- The DOJ says theft sometimes came several months to more than a year after the initial compromise, so a call that seemed harmless at the time is not proof that nothing happened.
The person on the call was real. That is the uncomfortable part.
Not a cartoonish deepfake, not a stranger with a stolen avatar. According to the US Justice Department's release of 12 November, targets of the scheme it calls FaceStealer joined video meetings and saw prerecorded webcam video of people they already knew - colleagues, contacts, earlier victims. The face was genuine. It was just old.
The Department says the scheme, which it attributes to North Korean actors tracked under names including Sapphire Sleet, UNC1069, BlueNoroff and APT38, stole more than $400 million in cryptocurrency in the last 18 months. It announced the seizure of the scheme's cloud infrastructure the same day, and said the FBI had seized more than 900 webcam videos of victims under a federal warrant.
Nine hundred recordings. Hold that number, because it explains how the thing grows.
How the call actually works
The DOJ's description is short, and every step of it matters.
The invitation comes from someone you know. Meeting invites are sent from accounts stolen from earlier victims. You are not answering a cold message; you are answering a contact.
The faces are familiar. Once you join, the attackers record your webcam and play prerecorded video of previous victims known to you, to simulate trusted participants. The release says they also use AI-generated deepfakes of well-known people in crypto and Web3 to add credibility.
Something breaks. During the meeting a fake technical error appears - the release's own example is a claim that you cannot be heard - along with a link or prompt to fix it.
The fix is the malware. Following that prompt quietly installs it. From there the attackers can take cryptocurrency, use your access to other systems, and work through your contact lists and messaging apps to pick the next target.
And then the step that closes the loop: your own webcam footage, recorded while you were trying to get your microphone working, becomes the familiar face on somebody else's call.
Most coverage will miss where the attack actually is
The headlines lead with deepfakes, because deepfakes are the frightening, novel part. But read the sequence again and notice where the compromise happens.
It does not happen when you see the face. Seeing a face installs nothing. It happens when you act on a fault message - clicking an update, pasting a command, approving an install - inside a meeting you were not running.
My read is that this reframes the defence completely. You are not going to out-detect a recording of a real colleague; the whole point is that it is real. Spotting deepfakes is a contest the attacker chooses the rules for. But the attacker cannot skip the fix. No fix, no malware. Every version of this scheme the government has described needs you to do something to your own machine because a meeting told you to.
That gives you a rule simple enough to keep under pressure: a meeting never gets to change your computer. If your audio genuinely is not working, leave, fix it from the official app or your operating system's own settings, and rejoin - or move to a phone call on a number you already had. Nothing legitimate breaks because you declined a link offered mid-call.
The Across hijack two days ago had the same shape: the address bar was right, and the right address was the trap. Here the face is right, and the right face is the trap. In both cases the signal you were taught to check had been made accurate on purpose.
The delay is the part to take seriously
One line in the release deserves more attention than it will get. In several cases, the DOJ says, the theft and account hijacking happened several months to more than a year after the initial compromise.
Think about what that does to a victim's memory. A strange call where the audio failed, a quick fix, the meeting moved on, nothing seemed to happen. Ten months later a wallet empties and nobody connects the two. That delay is also what lets the scheme spread: the compromised machine and accounts sit quietly while they are used to reach your contacts.
So the useful question is not "did anything bad happen after that call?" It is "have I, at any point, run something a meeting told me to run?" If the honest answer is yes, the right response is to treat that machine as compromised now, not to wait for evidence.
What to do, in order
This is general security practice, not a substitute for the government's own guidance. The DOJ release points to an IC3 advisory and an FBI resource page that it says cover the mechanics in more detail, including protective steps and what to do after a compromise. Read those directly.
Never install, update or paste anything because a meeting asked. Not a plugin, not an SDK, not a "one-line fix" for the terminal. Update conferencing software only from the vendor's own site or your operating system's store, outside the call.
Verify the invitation, not the face. If a contact proposes a call - especially about an "opportunity" - confirm it through a different channel you already had with them. A stolen account can send a message; it cannot easily answer a phone number you have saved for years.
Keep keys off the machine that takes calls. A hardware wallet, or a separate device used only for signing, means a compromised laptop exposes your messages rather than your funds. The scheme profits from machines where both live together.
If you already ran something, act now. Move funds to a wallet whose keys were never on that machine, rotate credentials from a clean device, and report it. In the US that is IC3; elsewhere, your national cybercrime reporting service. Then warn your contacts, because your account is the next invitation.
What is not known
The release does not name the conferencing platforms abused, nor say how many people the 900 videos represent, nor how much of the $400 million has been traced. Some outlets describe Telegram, Zoom and Teams lookalike links in detail; that comes from private security researchers rather than from the DOJ, and I would treat it as plausible but less settled. The release also announces a separate court-authorised seizure and restraint of more than $1.2 billion tied to the October Binance theft, which it attributes to a different North Korean unit; it does not say those funds are connected to FaceStealer, so I have not treated them as one story.
A note on my own sourcing: the FBI's resource page refused an automated fetch, and the IC3 advisory is a PDF I could not extract cleanly. The attack sequence above is therefore taken from the DOJ release alone, paraphrased rather than quoted at length. Read the FBI and IC3 documents directly before relying on specifics.
Seizing the infrastructure takes servers offline. It does not take back the recordings already made of people's faces, or the access already sitting on machines that ran the fix months ago. Servers can be replaced. The habit that defeats this - a meeting never gets to change your computer - cannot be taken from you.
Details here come from the US Department of Justice release of 12 November 2026 and the cited reporting; the case is ongoing and the picture may change. This is education, not investment advice.
Frequently asked questions
What is FaceStealer?
It is the name the US government uses for a North Korean social-engineering scheme that lures crypto holders and open-source developers into fake video meetings. The DOJ says it stole more than $400 million in cryptocurrency in the last 18 months, and announced the seizure of its cloud infrastructure on 12 November 2026.
If the person on the call looked and sounded like someone I know, isn't that proof it was them?
No. The DOJ says the attackers play prerecorded webcam video of earlier victims known to the target, and use deepfakes of well-known crypto figures. The face can be completely genuine and still be a recording. Verify the meeting through a separate channel you already had with that person.
Where does the malware actually come from?
From the fix. During the meeting a fake technical error appears - for example, a claim that you cannot be heard - with a link or prompt to resolve it. Following that prompt quietly installs malware. If you never act on a fault message inside a meeting, this route does not work.
I had a strange call months ago and nothing happened. Am I fine?
Not necessarily. The DOJ says that in several cases theft came several months to more than a year after the initial compromise. If you ever ran or installed something because a meeting asked you to, treat that machine as compromised now: move funds to a wallet whose keys were never on it and rotate credentials from a clean device.
What should I do if I think I was targeted?
Disconnect the affected machine from anything holding funds, move assets to a wallet whose keys were never on it, change passwords and keys from a clean device, and report it - in the US to the FBI's IC3, elsewhere to your national cybercrime service. Then warn your contacts, because your accounts may be used to invite them next.
Is the threat over now that the infrastructure was seized?
Nobody can say that. Seizing servers disrupts the operation, but infrastructure can be rebuilt, recordings already made still exist, and access already gained may remain on machines that were compromised months ago. The defensive habit matters more than the takedown.
Sources
Every figure and quote above traces to one of these. Checked on publication day.
- justice.gov — Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency - US Department of Justice, 12 Nov 2026
- ic3.gov — FaceStealer cybersecurity advisory - FBI Internet Crime Complaint Center (IC3)
- fbi.gov — FaceStealer Cryptocurrency Theft Scheme - FBI
- thehackernews.com — FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls - The Hacker News
- decrypt.co — North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says - Decrypt
Deepmoni Das, Editor
I read the primary filings, exchange notices and post-mortems behind each story and write up what they actually say — with every source linked so you can check me. I am not a trader and I do not hold positions in anything covered here. Research and drafting are AI-assisted; the sourcing, the edits and the mistakes are mine.
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.