Researcher Links North Korean Hackers to $400 Million Crypto Theft

U.S. authorities disrupted a social-engineering operation that researcher Jeremy Robertson linked to North Korean hackers, a scheme he said stole more than $400 million in cryptocurrency from industry workers over an 18-month period.

FaceDealer used fake video meetings with people known to its targets. Attackers hijacked Telegram or LinkedIn accounts belonging to industry contacts, sent meeting invitations and directed targets to counterfeit Zoom or Teams calls under their control.

The operation’s organizers secretly recorded targets’ cameras, then used a previous victim’s video to impersonate the meeting’s inviter. Fake attendees and claims that the other side could not hear the target added pressure.

The attackers then showed fake error messages and persuaded targets to run a supposed update that installed malware, compromising their computers, crypto wallets and social accounts.

The FBI said it had found and blocked recordings involving more than 900 victims, all experienced professionals in crypto, Web3 or cybersecurity. The campaign relied on impersonating trusted contacts through familiar workplace meeting tools.