FBI: FaceStealer's $400M thefts lean on real webcam video

The FBI says North Korean state-sponsored hackers have stolen more than $400 million in cryptocurrency over the past 18 months with a social engineering scheme it calls FaceStealer. The figure comes from an FBI FLASH alert dated 12 November 2026 and a Justice Department release the same day, which announced the seizure of cloud infrastructure used in the scheme. The FBI attributes the activity to the group known as Sapphire Sleet, BlueNoroff and UNC1069, among other names.

The scheme feeds on itself. The hackers take over a victim’s Telegram or other messaging accounts and invite that person’s contacts to what looks like a Zoom or Teams call on a look-alike domain. There they play webcam video secretly recorded from earlier victims, so the call seems to include people the target knows. A staged audio fault then prompts the target to run an “update” that installs malware. The FBI says it seized more than 900 recorded victim videos.

The Hacker News headlined the story as theft “using deepfake video calls”. The Justice Department release frames it in a similar way: it calls FaceStealer a super intelligence-enabled campaign and says the scheme behind the $400 million relies on recorded videos and deepfakes, without saying how often each is used. The FBI alert is narrower. It says the hackers have begun to use what it calls super intelligence (SI) to make deepfakes of well-known people in the cryptocurrency and web3 industries, but that the scheme “currently continues to overwhelmingly rely on the theft of genuine victim videos”. The alert does not tie any part of the $400 million to a deepfake.

The FBI also says the hackers used the same technique this year against the maintainer of an open-source JavaScript library with tens of millions of weekly downloads. They used the maintainer’s access to add malicious dependencies to the library; the FBI calls it a failed attack, stopped by quick detection.