North Korean state-backed hackers have stolen more than $400 million through sophisticated online scams involving artificial intelligence and fake video calls, according to the FBI. The cybercriminals reportedly used stolen identities and deepfake technology to deceive victims into trusting fraudulent video meetings.
The operation, identified as “FaceStealer”, has targeted individuals working in cryptocurrency and Web3 industries. According to the FBI, the hackers stole the money over the past 18 months through carefully planned social engineering attacks.
The disclosure highlights how cybercriminals increasingly exploit artificial intelligence to make online fraud more convincing. Moreover, the latest findings raise concerns about the growing risks associated with digital communication and cryptocurrency security.
How North Korean Hackers Used AI Deepfakes to Steal Money
The FBI described FaceStealer as a sophisticated operation that relies on impersonation and artificial intelligence. Hackers first pretend to be someone familiar to their intended victims before inviting them to join a video meeting.
During these calls, criminals use AI-generated deepfake videos to imitate trusted individuals. Consequently, victims may struggle to recognise that they are interacting with impostors rather than genuine contacts.
Once they establish trust, the hackers introduce what appears to be a technical problem during the meeting. They then instruct victims to click on a link or follow a prompt to resolve the supposed issue.
However, the link or prompt installs malware on the victim’s device, giving attackers an opportunity to compromise their digital security.
The hackers also exploit victims’ contact lists, social media accounts and messaging applications. By gaining access to these networks, they can impersonate compromised users and approach additional targets.
This approach allows the criminals to expand their operations through existing personal and professional relationships.
FBI Warns Even Experienced Technology Users Can Become Victims
The FBI has warned that FaceStealer can deceive even people with strong technical knowledge and cybersecurity awareness.
Patrick Grandy, assistant director at the FBI’s Los Angeles Field Office, described the operation as particularly dangerous because it exploits everyday digital habits.
“FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” Grandy said.
He also warned that criminals take advantage of people’s confidence in familiar video conferencing platforms and trusted personal relationships.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy added.
Meanwhile, the FBI confirmed that investigators seized more than 900 webcam videos belonging to FaceStealer victims.
FBI Links Cryptocurrency Theft to North Korea’s Weapons Programme
The latest findings have also renewed concerns about North Korea’s alleged involvement in major cryptocurrency thefts.
Brett Leatherman, FBI Cyber Branch Operations Director, said the country relies on stolen cryptocurrency proceeds to support its weapons activities.
“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” Leatherman said.
The FBI has also accused North Korean-affiliated hackers of stealing $6 billion from cryptocurrency exchange Binance. However, Pyongyang has rejected the accusation.
Beyond that incident, American investigators say North Korean hackers have increasingly targeted people working in cryptocurrency and Web3 industries.
The FBI described these attacks as part of an aggressive campaign involving deceptive social engineering techniques.
The FaceStealer operation demonstrates how artificial intelligence can make traditional cybercrime tactics more convincing. Furthermore, the use of deepfake video calls creates new challenges for individuals and organisations trying to identify online impersonation.
As these attacks become more sophisticated, even familiar faces and trusted contacts may no longer guarantee that an online interaction is genuine.
For the latest updates, visit and follow The Truth International website (www.thetruthinternational.com) and subscribe to the YouTube Channel.
