North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says

North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months using a social-engineering scheme built on secretly recorded footage and AI deepfakes, the U.S. Justice Department said Thursday, as it announced the seizure of the infrastructure behind the operation.

The scheme, which the FBI calls “FaceStealer,” turns video conference calls into a trap. According to the DOJ, hackers lure targets into meetings using accounts stolen from previous victims, then play prerecorded webcam footage of trusted contacts to simulate their presence and win the target’s confidence.

The group also generates deepfake videos of well-known figures in the crypto and related industries, using AI to make the ruse more convincing.

Once a target is at ease, the attackers manufacture a fake technical glitch, such as claiming the person can’t be heard, and offer a link to “fix” it, which instead installs malware.

From there, the hackers can drain crypto wallets or exploit the victim’s access to other systems, sometimes waiting months or more than a year before striking. The FBI said it seized over 900 webcam recordings of FaceStealer victims under a federal warrant.

The DOJ tied the operation to North Korean groups known variously as Sapphire Sleet, BlueNoroff and APT38, among others, and warned the hackers have increasingly targeted open-source software developers in an apparent bid to enable supply-chain attacks.

The announcement came paired with an update on the record-breaking Binance hack. The department said it has now obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from the exchange on Oct. 29, part of over $2.7 billion frozen so far.

The FBI attributed that theft to the North Korean group TraderTraitor, and the regime has been laundering the proceeds at speed, spinning up a new wallet roughly every 25 seconds. North Korea has denied involvement, calling the FBI’s finding a political provocation.

The actions underscore how central crypto theft has become to Pyongyang’s finances. The U.S. recently sanctioned 11 people over a North Korean IT-worker scheme that moved millions in crypto, and researchers have cataloged the many ways the regime’s hackers break into crypto firms.

Officials said efforts to trace and recover the stolen Binance funds are ongoing.