FBI Unveils $400 Million Cryptocurrency Theft Scheme via Video Calls

The United States Federal Bureau of Investigation (FBI) has warned cryptocurrency owners and participants in the Web3 industry about the FaceStealer scam, which uses fake video conferences to spread malware. According to the agency, over the past 18 months, perpetrators have stolen digital assets worth more than $400 million. U.S. law enforcement links the campaign to North Korean hacker groups known as Sapphire Sleet, BlueNoroff, and APT38.

How the FaceStealer Scheme Works

The attack begins with an invitation to a video meeting sent through a previously hacked account of a familiar person. Perpetrators create fake versions of popular video communication services, including Zoom and Microsoft Teams, and then play pre-recorded videos of previous victims. This creates the impression that the user is communicating with real acquaintances.

In some cases, scammers also use deepfakes of well-known figures in the cryptocurrency industry, created using artificial intelligence. Simultaneously, perpetrators secretly record the video of the new meeting participant to later use it for similar attacks.

During the conversation, scammers simulate a technical malfunction, such as telling the user that they cannot be heard. To fix the problem, they suggest installing an update or performing certain actions on the computer. As a result, malware is installed on the device, capable of providing access to cryptocurrency wallets, accounts, and other data.

According to the FBI, in some cases, cryptocurrency theft occurred several months or more than a year after the initial infection of the device.

FBI Seized Over 900 Victim Videos

During the investigation, the FBI disrupted the cloud infrastructure used for FaceStealer attacks. Law enforcement also seized over 900 webcam recordings of victims, which were used to deceive subsequent victims.

The investigation was led by the FBI's Los Angeles office. According to its head, Patrick Grandi, the scheme exploits users' trust in common video communication platforms and personal contacts.

Once in control of the device, perpetrators also examine the victim's contacts, correspondence, and social networks. This allows them to send new invitations on behalf of familiar people and expand the circle of potential victims.

Open Source Software Developers at Risk

In addition to cryptocurrency owners, FaceStealer targets developers and maintainers of open-source software projects. By gaining access to their accounts and repositories, perpetrators can attempt to introduce malicious components into the software used by other developers and companies.

The FBI warns that such attacks pose risks to software supply chains. The agency recommends verifying video meeting invitations through independent communication channels, using official applications, and not installing updates based on instructions received during suspicious calls.

The FaceStealer investigation continues. Published data shows that the scheme combines account hacking, social engineering, and fake video creation technologies to gain access to digital assets.