FBI Says FaceStealer Fake Zoom Calls Stole $400M in Crypto

On Nov. 12, 2026, the US Justice Department announced the seizure of cloud infrastructure used by FaceStealer, a North Korea-linked scheme that stole more than $400 million in cryptocurrency in the last 18 months. In the same coordinated action, DOJ said it had court authorization to seize or restrain more than $1.2 billion in crypto stolen from Binance after an Oct. 29, 2026 theft of more than $6 billion.

The DOJ press release and an FBI alert published the same day describe a video call scam built around hijacked chat accounts, fake Zoom and Teams pages, secretly recorded webcam videos and malware. The FBI also said it seized more than 900 webcam videos of FaceStealer victims under a federal warrant.

What is FaceStealer and how does the scam work?

FaceStealer is a social engineering scheme. Social engineering means manipulating people into taking unsafe actions by abusing trust, rather than simply exploiting a technical bug.

According to the FBI FLASH alert, the attack has six stages. First, the hackers start with a victim who is already compromised. They scan the device for wallets and seed phrases, take over Telegram or another encrypted chat app, gather contact lists and chat histories, and secretly record the victim's webcam while waiting for a video call to begin. A seed phrase is the private recovery words that can restore control of a crypto wallet.

Second, the hackers use that hijacked account to message the victim's contacts. The pitch may be to catch up, discuss a collaboration or talk about investment opportunities, and it is tailored with details from past chats. The FBI says attackers also use new or hijacked Telegram, LinkedIn, Slack and Discord accounts.

Third, the attackers send Calendly or other calendar invites, then send a meeting link shortly before the call. The link looks like Zoom or Teams but points to typo-squatted domains. Typo-squatting means using web addresses that look close to a real brand, such as the FBI's examples uu01webzoom.us and teams.livemeet.us, to trick people into trusting a fake page. It is a tactic we have seen before in a fake Zoom app that bypassed Mac security.

Fourth, after a fake lobby, the attackers play stored webcam video from the earlier victim. They may add more videos to simulate several participants.

How does the fake audio fix infect your computer?

Fifth, while pretending to be the trusted contact, they claim there is an audio problem and guide the target to click an update prompt, run a script or paste code into a command line or terminal. That downloads malware that installs a browser cookie harvester, keyloggers, screen capturers and a backdoor. The target's webcam is recorded from the moment they click the fake link. Sixth, the new victim becomes bait for more contacts.

What are the red flags at each attack stage?

Who is behind FaceStealer?

DOJ and the FBI attribute the campaign to North Korean state-sponsored hackers known as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. The FaceStealer disruption was announced by the US Attorney's Office for the Central District of California, led by Assistant US Attorney Khaldoun Shobaki and the FBI Los Angeles Field Office.

Patrick Grandy, Assistant Director in Charge of FBI Los Angeles, said, "North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." He added, "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough." Brett Leatherman, FBI Cyber Branch Operations Director, said North Korean actors aggressively target people in cryptocurrency and Web3.

Why are open-source maintainers a target?

The FBI says the hackers earlier this year lured the maintainer of a significant open-source JavaScript library into a fake Teams call. Several apparent participants joined, including one person the maintainer recognized. After following the fake fix, the maintainer was infected.

The hackers then used that access to add malicious dependencies to a library with tens of millions of weekly downloads. A supply-chain attack means compromising a trusted developer, package or service so the attack reaches downstream users. Quick detection stopped the incident, and the FBI did not name the library. The bureau says it knows of several other attempts against developers and maintainers on npm and, more recently, Rust crates.

What happened to the stolen Binance crypto?

On or about Oct. 29, 2026, North Korean military hackers the FBI calls TraderTraitor stole more than $6 billion in virtual assets from Binance. The theft has been widely reported as $6.3 billion. US government and private sector efforts have frozen more than $2.7 billion, and DOJ has court authorization to seize or restrain more than $1.2 billion of that amount.

Bloomberg reported on Nov. 12, 2026 that the frozen funds were secured with Tether and Circle, the two biggest stablecoin issuers. The $1.2 billion action is meaningful, but it is less than a fifth of the Binance haul, and laundering through bridges, mixers and exchanges continues. Binance has said all stolen funds are covered for users.

How can you protect yourself from fake video calls?

The FBI says the hackers have begun using what the FBI calls super intelligence (SI) to create AI deepfake videos of well-known crypto and Web3 people from public photos and videos. A deepfake is AI-generated audio or video that impersonates a real person. Still, the FBI says the scheme overwhelmingly relies on stolen genuine victim videos.

• Use the official Zoom or Teams app and join with an invite code instead of clicking web links, especially for new or infrequent contacts.
• Do not turn on your webcam until you can see, hear and talk to the person who invited you.
• If an update prompt appears during a call, never run scripts or paste code into a terminal. Update the app separately.
• Check Calendly or calendar invites for a meeting link. Attackers often leave it out and send the link close to the meeting time.
• Confirm the meeting through another channel. If the invite came on Telegram, confirm by text or phone.
• Secure Telegram, WhatsApp, Slack and other chat apps with multifactor authentication, login alerts and expiring messages.
• Keep only small amounts in browser extension wallets. Store larger balances on a separate hardware wallet or with an exchange.
• Never store seed phrases or private keys on your devices.

What should you do if you think you were hit?

• Create a new wallet with a new seed phrase on a clean device and move funds.
• Secure chat and developer accounts by changing passwords, logging out all sessions and adding MFA.
• Warn your contacts and employer.
• Change all passwords.
• Ask platforms to shut down or restore hijacked accounts.
• Report the incident at IC3.gov with the keyword FaceStealer.

Our take: FaceStealer weaponizes trust in familiar faces more than it relies on exotic technical exploits. The defense is process: confirm out of band, do not paste terminal commands during calls and treat urgent fake fixes as hostile. The open-source angle is especially serious because one maintainer's mistake could affect millions of downstream users. And while AI deepfakes grab headlines, the FBI's own data shows the cheaper trick, replaying a real friend's video, is doing most of the damage.