FBI Flags North Korean Video-Call Scheme Behind $400M Crypto Thefts
The FBI says North Korean hackers are using deepfakes and fake video calls to trick crypto workers into installing malware.
The FBI says North Korean hackers are using deepfakes and fake video calls to trick crypto workers into installing malware. This is an original Token Times brief synthesising 2 outlets (BeInCrypto, Decrypt), with their figures cross-checked, plus live market data, as of Fri, 13 Nov 2026 12:45:01 UTC.
The scheme targets people and systems linked to digital assets rather than exploiting blockchain protocols directly. Its scale and use of convincing contact impersonation raise security risks across crypto businesses, Web3 workers and open-source contributors.
- FBI attributes FaceStealer operations to North Korean hackers
- Fake calls use deepfakes or prerecorded footage to install malware
- The reported losses exceed $400 million over 18 months
- Bitcoin fell 4.91% as the overall crypto market broadly declined
BeInCrypto and Decrypt both report that the FBI has attributed the FaceStealer scheme to North Korean hackers and that the operation generated more than $400 million in losses over the last 18 months. Both also describe attackers using deceptive video calls to persuade crypto workers to install malware. BeInCrypto emphasizes the broad target list, including crypto holders, Web3 personnel and open-source code maintainers, while Decrypt specifies prerecorded footage and AI deepfakes of trusted contacts. No material figure conflict appears in the coverage: both outlets cite the $400 million figure, although Decrypt separately notes a DOJ move to seize $1.2 billion connected to the Binance hack.
- US Sanctions Russians Over North Korean Crypto Money Laundering Scheme
- FBI Flags North Korean Video-Call Scheme Behind $400M Crypto Thefts — this brief
The FBI is warning members of the crypto community about FaceStealer, an operation it attributes to North Korean hackers. According to BeInCrypto, the bureau says the scheme has taken more than $400 million over the past 18 months through fraudulent video calls designed to compromise systems and steal digital assets.
The calls impersonate people the target knows or trusts. Decrypt reports that attackers use prerecorded footage and AI-generated deepfakes during live conversations, then direct victims toward installing malware. The deception is aimed at compromising crypto-related devices or activity rather than requiring direct attacks on blockchain infrastructure.
The two outlets corroborate the core warning, the North Korean attribution, the video-call mechanism and the reported $400 million in losses. They differ in emphasis: BeInCrypto highlights the potentially broad victim base, while Decrypt focuses on the deepfake and prerecorded-video methods. Decrypt also places the warning alongside a separate Department of Justice effort to seize $1.2 billion connected to the Binance hack, though the supplied coverage does not establish that the seizure and FaceStealer are the same operation.
The FBI’s warning extends beyond asset holders to people working in Web3 and those maintaining open-source code. That reach matters because the described attack relies on social engineering and trusted contact rather than a visible on-chain exploit, making technical safeguards alone insufficient to address the initial point of entry.
The wider crypto market was broadly lower as the warning circulated. Total market capitalization stood at $2.4 trillion, 
Bitcoin fell 4.91% over 24 hours, and the Fear & Greed index registered 20, labeled Extreme Fear. No specific coin named in the supplied market list is identified as a target in the FaceStealer reporting; the figures provide broader market context rather than a direct price reaction to the FBI advisory. Key developments to monitor include further FBI disclosures about the operation and whether reported seizures or arrests clarify the scope of the attributed activity.
1 key figure independently matched across 2 outlets reporting this story.
Token Times extracts the figures each outlet reports and flags the ones that agree. Numbers cited by only one outlet are attributed in the brief, not shown as corroborated.
FBI Flags North Korean Video-Call Scheme Behind $400M Crypto — questions & answers
How does the FaceStealer scheme operate?
Attackers use fake video calls, including prerecorded footage and AI deepfakes of trusted contacts, to persuade crypto workers to install malware.
How much has FaceStealer taken?
The FBI says the North Korean operation has taken more than $400 million over the last 18 months.
Who does the FBI say may be targeted?
The warning includes crypto holders, Web3 workers and people who maintain open-source code.
Which outlets reported this story?
This is an original Token Times brief that synthesises reporting from BeInCrypto, Decrypt, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original Token Times brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.