FBI: North Korean hackers stole more than $400 million
A campaign using fake video calls and deepfakes is believed to have stolen hundreds of millions in cryptocurrency over eighteen months.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
North Korean hackers have stolen more than $400 million in cryptocurrency over the past eighteen months. The US Federal Bureau of Investigation (FBI) reported this, naming the campaign FaceStealer and seizing infrastructure.
According to the US Department of Justice, FaceStealer mainly targeted people in the cryptocurrency sector, the Web3 industry and open-source software developers. The FBI attributes the campaign to North Korean hackers also known as Sapphire Sleet and UNC1069. The US authorities present that attribution as their assessment.
The attackers are said to have sent invitations to video calls through accounts belonging to existing contacts. During such a call, the FBI says, a known person was impersonated using previously recorded video footage or a deepfake. Victims were then presented with a fabricated technical problem, accompanied by a link or instructions to restore the audio or connection.
The so-called solution installed malware on the victim's computer. This allowed the attackers to steal cryptocurrency, take over communications and social-media accounts, and then approach new contacts. The FBI says it seized more than 900 webcam videos of victims.
According to the US authorities, the campaign differs from the recent theft at cryptocurrency exchange Binance. That separate attack, which the FBI attributes to another North Korean group, is said by the Department of Justice to have involved more than $6 billion in virtual assets. The two amounts must therefore not be added together as a single FaceStealer haul.
The department says that US authorities and private partners have since frozen more than $2.7 billion in stolen assets in the Binance case. According to the US justice authorities, permission has been obtained to seize or hold more than $1.2 billion. This concerns the Binance case, not the $400 million attributed to FaceStealer.
The FBI warns that the technique is not used only for cryptocurrency theft. By gaining access to developers' accounts, attackers may also try to penetrate software supply chains. For companies, this means that a video call with a known contact is no longer reliable proof of identity when the communication or software environment has previously been compromised.
The US government has long said that North Korea uses digital theft to obtain revenue for the regime and possibly programmes for prohibited weapons. In the case now made public, it remains unclear how many victims outside the United States were affected and how much money actually flowed to North Korean state structures.
Also show the region and a close-up
One story, several perspectives
What is established
- The FBI says a North Korean campaign known as FaceStealer stole more than $400 million in cryptocurrency over eighteen months.
- According to the FBI, the campaign used impersonated video calls, recorded footage, deepfakes and malware.
- The US authorities say that open-source software developers were also targeted.
Left
Arguments The case shows that digital security cannot be left solely to individual users. Platforms and companies should invest more heavily in security, reporting requirements and protecting employees and developers.
Values Collective security, protection of employees and reducing power imbalances between large technology companies and users.
Consequences Stricter obligations could make attacks more difficult, but could also increase costs and administrative burdens for smaller software companies.
Centre
Arguments A combination of international law enforcement, information-sharing, security standards and individual vigilance is needed. The government must act against criminal infrastructure, while organisations remain responsible for managing access.
Values Proportionality, evidence, international cooperation and preserving room for innovation.
Consequences Targeted measures can limit the damage without general bans on cryptocurrency or video calls, but they remain dependent on cross-border cooperation.
Right
Arguments According to this approach, the thefts show that digital sectors take too little responsibility for risky products and that hostile states must be dealt with firmly. Companies should tighten their security and access controls immediately.
Values National security, individual responsibility and a robust response to states that use digital crime.
Consequences Stronger sanctions and tighter security may act as a deterrent, but could increase international tensions and costs for companies.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The main facts can be found directly in the publication by the US Department of Justice and are described independently by Reuters and AP. Where allegations or attributions by US authorities are involved, this is stated explicitly.
- confirmed The FBI reported on 12 November 2026 that FaceStealer was said to have stolen more than $400 million in cryptocurrency over eighteen months. — Mentioned in the Department of Justice report and in the Reuters article. source
- confirmed The campaign used recorded video footage, deepfakes and fabricated technical problems. — Described in the FBI and department publication. source
- confirmed The FBI seized more than 900 webcam videos of victims. — Mentioned in the DOJ publication and the Reuters article. source
- confirmed According to the US authorities, the FaceStealer campaign was separate from the Binance attack. — The department refers to the campaigns separately and links them to different groups. source
- confirmed More than $2.7 billion in Binance assets was frozen and permission was obtained to seize or hold more than $1.2 billion. — These figures appear in the DOJ publication and are described by AP. source
Editor's note
The core consists of an FBI and Department of Justice report dated 12 November 2026, supplemented by Reuters and AP. The attribution to North Korea and the figure of more than $400 million are presented as the assessment of the US authorities; not all attacks have been independently verified publicly.Sources
- Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency — U.S. Department of Justice
- North Korean hackers steal more than $400 million using video images, FBI says — Reuters
- US seizes $1.2 billion in cryptocurrency stolen from Binance — Associated Press
More on this in Dutch media
- de Volkskrant — „noord-korea cybercriminaliteit”
- NOS — „noord-korea cybercriminaliteit”
- Het Parool — „noord-korea cybercriminaliteit”