FBI: North Korean hackers stole $400M+ in crypto with fake video calls and deepfakes

The scale of the theft

According to the announcement, the hackers tracked as Sapphire Sleet and UNC1069 stole more than 400 million dollars in cryptocurrency across an 18-month period. The figure places the campaign among the largest state-attributed cryptocurrency thefts disclosed in 2026. The FBI and the Department of Justice did not disclose how much of the stolen value, if any, has been recovered, and no statement in the announcement indicated that funds had been returned to victims.

The operation targeted individuals and organisations in the cryptocurrency sector. The attackers focused on people with access to digital assets, including employees and executives at cryptocurrency companies, and used personal trust as the point of entry rather than a technical vulnerability in any exchange or wallet platform.

The method: impersonation through recorded video

The core of the scheme relied on video calls that appeared to come from a known contact. The attackers sent invitations from compromised accounts on Telegram, LinkedIn, Slack and Discord, and then joined calls on Zoom, Microsoft Teams or Google Meet while playing secretly recorded webcam footage of the person they were impersonating. The victim saw a familiar face and heard a familiar context, and had no immediate reason to suspect that the person on the screen was not present.

During the call, the attackers introduced a fabricated audio problem and asked the victim to run a fix. That fix installed malware on the victim's machine. According to reporting on the announcement, the malware included a cookie harvester, keyloggers, a screen capturer and a backdoor, giving the attackers the credentials and access required to move cryptocurrency out of the victim's accounts.

The campaign also turned each victim into material for the next attack. Victims were recorded during the calls, and the footage was then used as the face on subsequent calls to new targets. The method therefore compounded over time: each successful compromise supplied fresh, convincing footage for the next impersonation.

Artificial intelligence deepfakes of cryptocurrency figures form a newer and smaller addition to the operation, according to reporting on the announcement. The main method remained stolen real footage of real people, not synthetic video. That distinction matters, because it means the deception depended on genuine recordings rather than on generated imagery, and the familiar face on the screen was, in a literal sense, the person it appeared to be.

The disruption and the seizure

The FBI and the Department of Justice described the action as a disruption of the scheme, and announced the seizure of the cloud infrastructure used to run it, together with more than 900 victim webcam videos held by the operators. The seizure removes infrastructure that the campaign depended on, and the recovery of the videos limits the attackers' ability to reuse that footage in future calls.

The announcement did not state that any individual had been arrested or charged in connection with the scheme, and no such claim should be attached to it. The action taken was the seizure of infrastructure and material, not the detention of operators.

The FBI also published a dedicated resource page at fbi.gov/facestealer and an advisory through the Internet Crime Complaint Center, known as IC3, setting out the scheme in detail for potential victims and for organisations in the cryptocurrency sector.

Attribution and the wider context

Sapphire Sleet and UNC1069 are the designations used by researchers and government agencies for a North Korean state-backed hacking group. Attribution of the campaign to North Korea rests on the FBI and Department of Justice announcement and on the technical indicators set out in the associated advisory. The group has been linked by researchers to earlier cryptocurrency thefts, and the present campaign is consistent with a pattern in which North Korean state-backed actors use stolen cryptocurrency as a source of revenue.

The campaign sits within a broader trend of social engineering attacks that exploit trust rather than software flaws. The use of compromised messaging accounts to send invitations, the reliance on recorded footage rather than live interaction, and the staged technical fault that delivered the malware all indicate an operation designed around human behaviour. The technical components were conventional; the deception was the novel element.

Why it matters

The operation demonstrates that a video call, long treated as a reliable check on identity, can no longer be treated as one on its own. A familiar face on a call, even in real time, may be a recording. The campaign also shows how a single compromise can cascade: a compromised messaging account supplied the invitation, a recorded call supplied the trust, a fake fix supplied the malware, and the malware supplied the funds, while the recording of the victim supplied the material for the next attack.

For organisations in the cryptocurrency sector, the incident underlines the risk carried by any employee with access to digital assets, and the need for verification procedures that do not depend on a single channel. A call that arrives through one platform and asks for an action on another should be treated with caution, and an unexpected request to install software during a call should be treated as a signal to stop and verify through an independent channel.

What happens next

The seizure of infrastructure and video material disrupts this particular campaign, but the announcement does not claim that the group has been dismantled or that the threat has ended. The operators retain the knowledge and the methods, and the infrastructure can be rebuilt. The FBI resource page and the IC3 advisory remain the primary public sources for organisations seeking to assess their exposure and to recognise the pattern.

The case is likely to shape how cryptocurrency companies verify identity in remote communication, and how law enforcement approaches the seizure of infrastructure used in state-backed theft. The immediate lesson is narrower and more practical: a video call confirms that a camera is on, not that the person on the screen is present, and no request to install software should ever be accepted during a call without independent verification.

Source: Reuters, 12 November 2026; Help Net Security; CryptoNews; The Register; FBI resource page fbi.gov/facestealer; IC3 advisory, November 2026.