Fake video calls stole 400 million dollars

North Korean hackers stole over 400 million dollars in crypto with fake video calls, the FBI said on the 12th of November 2026. The theft took 18 months, and the FBI calls the scheme FaceStealer.

The hackers also use AI to make deepfakes, fake videos of real people, the US Justice Department said.

How the trick works

A victim gets a meeting invite from the hacked account of someone they know, the FBI said. The meeting runs on fake copies of Zoom, Microsoft Teams or Google Meet.

The hackers play old recorded video of people the victim knows. Then they fake a sound problem and send a link to fix it, which installs harmful software.

900 videos seized

The FBI said it seized more than 900 secretly recorded webcam videos of victims. It also shut down cloud servers the hackers used.

The scheme targets people in crypto and people who look after open source software, code that anyone can use, the FBI said.

Deepfakes of famous faces

The hackers turn public photos of crypto stars into deepfakes, the FBI said. The fakes only need to pass as webcam video.

Below we break down the theft

400 million dollars over 18 months is about 22 million dollars a month, by our arithmetic.

Hackers stole a record 6.3 billion dollars from the crypto exchange Binance a week earlier, the BBC reported. That is about 16 times more than FaceStealer took.

What is confirmed and what is not

The BBC wrote that more than 900 people were victims. The FBI itself counted more than 900 seized videos.

North Korea has denied US claims about the Binance hack, the BBC reported.

Key facts

The FBI warned about FaceStealer on the 12th of November 2026.

Hackers stole more than 400 million dollars in 18 months.

They used fake meetings and AI deepfakes.

The FBI seized more than 900 webcam videos.