The FBI says North Korean state hackers have stolen more than $400 million in crypto over the past 18 months by inviting people to fake Zoom and Teams calls, where the “friend” on screen is a secretly recorded clip of that friend’s own webcam. In a FLASH alert dated 12 November 2026, the bureau named the scheme FaceStealer and said it had seized more than 900 of those victim videos under a federal warrant.
The Justice Department announced the action the same Thursday, in a release that also covers the Binance theft of late October. It says it seized cloud-based infrastructure used in the scheme, in an operation led by the US Attorney’s Office for the Central District of California and FBI Los Angeles. No arrest, indictment or seized funds were announced for this part of the case.
What is new for crypto users is less the threat than the detail. Security firms had described the fake-meeting lure before, Microsoft among them in April. The FLASH lays out the whole cycle stage by stage and ends with a checklist written by the FBI.
What the FBI and the Justice Department announced on 12 November
The FLASH, numbered AC-111226-MS and marked TLP:CLEAR (free to share), runs to seven pages. Its title speaks of a “secretly recorded webcam library” of more than 900 tech workers. The FBI says it identified and seized over 900 victim videos that the hackers used to impersonate people in follow-on attacks, and the DOJ describes them as webcam videos of victims working in crypto and Web3 around the world.
The bureau attributes FaceStealer to the North Korean group that private security firms track under several names: Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. They are seven labels for what the FBI treats as one state-sponsored actor.
The DOJ release quotes Patrick Grandy, assistant director in charge of the FBI Los Angeles field office. The scheme, he said, “exploits our trust in ubiquitous video conference platforms and valued personal relationships.” His warning to anyone who feels safe: “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.” Assistant US Attorney Khaldoun Shobaki of the Central District of California led the effort with FBI Los Angeles, and the FBI has opened a resource page at fbi.gov/facestealer.
The same release announces the Binance measures: the department says it has court authority to seize or restrain more than $1.2 billion of the more than $6 billion taken from the exchange on or around 29 October, and that more than $2.7 billion has been frozen in total. The FBI attributes that theft to a different North Korean unit, TraderTraitor, as Coindaro reported when the bureau named TraderTraitor for the Binance hack. The two cases share a press release, not a method.
| Figure | What it covers | Source |
|---|---|---|
| More than $400 million | Crypto stolen with FaceStealer in the past 18 months | FBI FLASH, DOJ |
| 900+ | Victim webcam videos seized under a federal warrant | FBI FLASH, DOJ |
| 7 | Names used by security firms for the North Korean actor | FBI FLASH |
| 6 | Stages of the attack cycle described by the FBI | FBI FLASH |
| Tens of millions a week | Downloads of the JavaScript library whose maintainer was compromised | FBI FLASH |
| More than $6 billion / $2.7 billion / $1.2 billion | Binance theft / frozen in total / covered by seizure orders (separate case) | DOJ |
Both official texts give the $400 million as a single total for FaceStealer, and that is how Coindaro reports it. Neither text says how many victims lost money or how much any of them lost, and CyberScoop’s report of 12 November, drawn from the same material, has no breakdown either.
How a fake Zoom call turns a stolen webcam clip into malware on your computer
The FLASH names fake versions of Zoom, Microsoft Teams and Google Meet, and its examples use the first two. Six stages make up the cycle. Each one feeds the next, which is why the FBI says the blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool of targets “grows exponentially”.
- The cycle starts with a person already hacked, whom the FBI calls Victim A. The hackers have searched the device for wallets and seed phrases, taken over the Telegram account or another encrypted messenger and locked the owner out, copied contacts and chat histories, and recorded the webcam while Victim A waited for a call to start.
- Posing as Victim A, they message that person’s contacts and suggest a call to catch up, discuss a collaboration or talk about an investment. With the chat history in hand, they can tailor the message to past conversations. They also use new or hijacked Telegram, LinkedIn, Slack and Discord accounts.
- A Calendly-style scheduling invite comes first, without a video link. Shortly before the meeting, the real link arrives from Victim A’s account. It points to a look-alike domain registered in advance; the FBI gives uu01webzoom.us and teams.livemeet.us as examples. The page sits on a server controlled by the hackers and copies Zoom or Teams, built, in the FBI’s words, to be “indistinguishable from the genuine interfaces”.
- The target waits in what looks like a normal lobby. Once admitted, the hackers play Victim A’s recorded video, often with extra clips so the call appears to have several participants.
- After a short delay, “Victim A” sends a chat message saying the target cannot be heard. The fix offered is an update prompt, a script or a line of code to paste into the terminal. Following it downloads malware that installs a browser cookie harvester, keyloggers, a screen capturer and a backdoor. The target’s own webcam has been recorded since the first click on the fake link.
- The new victim’s video and contacts become the material for the next round of invitations.
Two details make the scheme harder to catch than an ordinary phishing link. The invitation comes from a real account the target has talked to before, and the face on screen is real footage of that person. The FBI also says the hackers are patient: in several cases, they stole funds and hijacked accounts months, and in some cases more than a year, after the first compromise, waiting for wallet balances to grow. They copy seed phrases, watch the addresses on chain and rebuild the wallet after a large transfer.
Deepfakes are an add-on: the FBI says stolen real videos still do most of the work
Much of the coverage on Thursday led with “deepfakes”. The FLASH is more careful. It says the hackers have begun to use AI tools, which the document calls “super intelligence (SI)”, to turn public photos and videos of well-known crypto and Web3 figures into fake video participants. Those clips can replace or sit next to stolen victim footage, and their quality “only needs to be good enough to pass as webcam video”.
But the FBI states plainly that FaceStealer “currently continues to overwhelmingly rely on the theft of genuine victim videos”. It credits the security firm Arctic Wolf for its input on the deepfake production. In practice, a check that looks for the signs of a synthetic face would not have stopped most of these attacks: the faces were real, only the timing was not.
That matters for tools sold as deepfake detectors. Coindaro looked at one of them last month, when World ID pitched a Zoom deepfake check for banks. A recorded clip of a real colleague raises a different question from a generated face, and the FBI’s advice in this FLASH does not depend on spotting either.
Open-source maintainers: one JavaScript library came close to shipping malware
FaceStealer is mainly used to steal crypto, the FBI says, but the same lure has been aimed at software maintainers, because one compromised maintainer can push malicious code to every user of a package. Earlier in 2026, according to the FLASH, the hackers drew the maintainer of a significant open-source JavaScript library into a fake Teams call with several participants, including at least one person he recognised.
He was told something was wrong on his system, followed the suggested fix and infected his computer. The attackers then used his access to add malicious dependencies that would be downloaded with the library, which gets tens of millions of downloads a week. Quick detection stopped it, the FBI says. The bureau does not name the library.
The FLASH adds that several other attempts targeted maintainers on the npm JavaScript registry and, recently, maintainers of Rust crates. For crypto users, the risk reaches beyond their own computer: wallets, dApps and exchange tools are built on these packages. Coindaro covered a separate supply-chain case on 10 November, when a Swarm release shipped a wallet-stealing backdoor; nothing published links that incident to North Korea.
The fake meeting invite Coindaro readers have seen before
Several recent incidents used similar social-engineering lures, although the FBI does not tie any of them to FaceStealer by name. On 6 November, the options platform SignalPlus traced a hack to a fake Teams invite and said its loss was under $82,000. Binance has said its own breach of late October began with a fake job interview, and Microsoft documented a Sapphire Sleet intrusion on macOS, from lure to compromise, in a report published on 16 April 2026 that the FBI cites.
Two other company reports cited by the FBI carry lists of indicators of compromise: Arctic Wolf’s “Still in the meeting: BlueNoroff six months on” and a Jumpsec analysis of a BlueNoroff ClickFix kit. “ClickFix” is the name the industry gives to the trick in stage five, where the victim is talked into running the attacker’s command themselves.
What the FBI tells you to do before, during and after a video call
Seven precautions close the FLASH. They apply whether the face on the call is stolen footage or a deepfake, and most of them cost nothing.
- Join with the official Zoom or Teams application and the meeting ID, not by clicking a link to a web version, above all when the invitation comes from a new or rarely heard-from contact.
- Keep your camera off until you can see, hear and talk with the person who invited you.
- If a call asks you to update, never run a script or paste code into a terminal. Update the app separately, or join through the official web version with the meeting ID.
- Check scheduling invites for a video link. The hackers often leave it out and send it close to the meeting time, to expose their infrastructure as little as possible.
- Confirm the meeting through another channel than the one used to invite you: a text or a phone call if the invitation came on Telegram.
- Protect Telegram, WhatsApp, Slack and other messengers with multi-factor authentication, login alerts and disappearing messages. The hackers take accounts over by logging in from another device, changing the recovery phone number and closing your sessions.
- Keep only small amounts in browser-extension wallets. Larger balances belong on a separate hardware device that is not connected, or with an exchange, and no recovery phrase or private key should be stored on any of your devices.
For people who think they may have been caught, the FBI’s order is clear. First, create a new wallet with a new seed phrase on a device that was never used to talk with the attackers, and move the funds there; the old phrase must be treated as copied. Then change passwords, log out every active session and add multi-factor authentication, including on developer accounts. Warn contacts and, if work files were on the device, your employer. Ask the platforms to close or restore lost accounts, and file a report at IC3.gov with the keyword “FaceStealer”.
Our guide to storing a seed phrase offline explains why a phrase that has ever touched an internet-connected device should be retired, and our guide to avoiding crypto scams covers the red flags and where to report a theft.
What the announcement does not say
The public documents leave several gaps. They do not name the court that issued the warrant, the domains or servers taken down, or how many there were. They give no number of victims who lost money, no losses per victim and no victim names. No defendant is named and no funds are reported seized for FaceStealer. The JavaScript library is not identified.
It is also not clear how many of the 900 recorded people know they were filmed. The FBI asks anyone who suspects a compromise to report it with the keyword FaceStealer. North Korea has in the past rejected US accusations of crypto theft as political provocation; by 17:45 UTC on 13 November, Coindaro had found no reaction from Pyongyang to this announcement and no new official detail since the Thursday release.
The next information is likely to come from the security firms the FBI credits, whose reports carry the technical indicators, and from any court filings in the Central District of California. Coindaro will update this piece if the library is named or charges are filed.