In the past 18 months, a hacking group linked to North Korea has stolen over $400 million in cryptocurrency through a social engineering attack dubbed FaceStealer. The scheme has targeted individuals in the Web3 and crypto finance spheres by combining deepfake videos and impersonation tactics to trick victims into handing over wallets and credentials. In parallel, the U.S. Department of Justice seized more than $1.2 billion in cryptocurrency connected to a North Korean hacking subgroup following a hack of a major exchange.
How FaceStealer Works
This campaign starts when attackers compromise someone in the crypto or Web3 sector—often via stolen or hijacked Telegram, LinkedIn, Slack, or Discord accounts. These compromised accounts are then used to initiate meetings with other targets, offering career opportunities or investment discussions.
When the target accepts, the meeting’s link (which usually mimics Zoom or Microsoft Teams domains) is sent via Telegram using typosquatting. Once inside the video call, the attackers play pre-recorded or AI-generated deepfake videos of trusted contacts to build rapport and trust—sometimes using avatars made from other people’s images. This illusion is carefully crafted so the target believes the situation is legitimate.
The Malware Hook & Attack Chain
At a certain point in the meeting, a technical issue is faked—like a broken audio connection. The target is then asked to click a (malicious) update link, run code locally, or install software under the guise of a fix. This action activates malware, giving the attackers access to seed phrases, private keys, or other sensitive credentials, authorizing them to steal crypto and gain further access.
Once the malware is deployed, the attackers gain full control of the victim’s communication accounts and device. From there, they harvest contact lists and reach out to new potential victims—spreading the attack laterally through trusted relationships.
Magnitudes & Motivations
This operation is carried out by a financial threat cluster known by multiple names including BlueNoroff and APT38, which is closely tied to North Korean cybercrime funding illicit weapons programs. It aggressively targets founders, executives, developers—particularly those involved in crypto or blockchain—and individuals with access to wallets or exchange infrastructure.
Across more than 20 countries—with the U.S., U.K., Singapore, Hong Kong, South Korea and the UAE among the most impacted—hundreds of targets have been identified. About 80% of them directly operate in crypto finance or investment. Founders and C-suite execs alone represent nearly half of all targets.
Attackers have refined their tools: generative AI platforms supply avatars, synthetic media, and voice training materials. They grab likenesses from interviews, YouTube talks, and profile photos to make deepfake content more convincing. And they build professional illusions—from fake recruiter websites to polished LinkedIn pages—to make their lures more credible.
Recent Cases & Takedowns
Law enforcement has seized over 900 victim webcam recordings used to impersonate people in follow-on attacks. One notable hit earlier this year involved the maintainer of Axios’s npm package—attackers inserted a Trojan into a supply chain update using this deepfake impersonation style.
Earlier work by cybersecurity firms traced at least 400 victims spanning 20+ countries; later investigations expanded to over 600 targets across nearly 60 nations. In response, U.S. agencies have taken down the infrastructure behind FaceStealer, and the DOJ has seized over $1.2B of stolen crypto tied to these operations.
Why This Matters
FaceStealer isn’t just another phishing campaign—it represents a sharp escalation in how AI and deepfake tech are weaponized against high-value targets in crypto and software development. The combination of social engineering, identity manipulation, trusted contact spoofing, and supply chain compromise makes this distinctly dangerous.
As cryptocurrency ecosystems mature, things like identity proof, meeting authenticity, and secure communication channels become critical. Devs, execs, and investors alike need to stay alert: fake links, unexpected meeting requests from known contacts, or sudden requests to install updates or run code should always trigger scrutiny. And across the board, organizations should treat these kinds of threats as not hypothetical—but as ongoing, adaptive, and evolving.
