FBI Warns of North Korean Crypto Scam Using Stolen Faces

North Korean hackers have used hijacked accounts and stolen webcam videos to impersonate crypto workers in fake meetings, according to the FBI. The scheme was linked to more than $400 million in cryptocurrency theft during the 18 months before Nov. 12, 2026.

The Justice Department announced Nov. 12 that authorities had disrupted cloud infrastructure used in the FaceStealer operation. Under a federal warrant, the FBI seized more than 900 webcam videos belonging to victims.

The attackers take control of accounts on Telegram, LinkedIn, Slack and Discord. They review chat histories and contact lists, then approach people who know the account’s original owner. Their messages refer to earlier conversations, making the contact appear familiar.

The attackers can use legitimate calendar services to schedule meetings. Shortly before the call, they send a link to a fake Zoom or Microsoft Teams session. Recorded webcam footage can make it appear that a known contact is attending. The attackers can also simulate several participants.

The FBI says stolen recordings of real people remain the main method used in the operation. The hackers also use computer-generated deepfakes.

The target’s webcam may begin recording when the person clicks the fake meeting link. The attackers can later use that footage to impersonate the new victim when contacting other people.

During the meeting, an attacker usually claims there is an audio or another technical problem. The attacker then tells the target to install an update, run a script or paste code into a computer terminal. Following those instructions can install malware that steals browser cookies, records keystrokes, captures screens and maintains access to the device.

That access can expose cryptocurrency holdings and other accounts. The hackers can also obtain communication histories, contact lists and webcam footage for later attacks. The FBI has identified cases in which cryptocurrency theft or account takeovers occurred months or more than a year after the initial compromise.

The bureau advises users to open meetings through the official application and use an invitation code. It recommends confirming invitations through a separate communication channel, especially when the original account may have been compromised. Users should wait to turn on their webcams until they verify who is attending and should not run scripts or paste terminal commands presented as meeting-software updates.

People who suspect they were targeted should move cryptocurrency to a new wallet created on an unaffected device, secure communication and developer accounts, warn their contacts and employers, and report the incident to the FBI’s Internet Crime Complaint Center using the keyword “FaceStealer.”