North Korea Stole $400M Using Fake Video Calls: The DOJ Just Revealed How Deep It Goes
North Korean hackers joined your video call, looked like someone you trust, and walked out with $400 million in crypto — and the DOJ says this is just what they've caught so far.
The FBI has officially named the operation: FaceStealer. It's not phishing. It's not a sketchy email. It's a fully staged video call where threat actors use prerecorded footage and real-time AI deepfakes of known, trusted contacts to convince crypto employees to install malware directly onto their work machines. By the time the call ends, the attacker already has access.
This isn't a theoretical risk. The Department of Justice confirmed the scheme is active, sophisticated, and responsible for hundreds of millions in losses tied to North Korea's state-sponsored hacking apparatus, specifically the Lazarus Group, which has become the most prolific crypto thief in history.
The $1.2 Billion Move Nobody Saw Coming
Simultaneously, the DOJ is moving to seize $1.2 billion connected to the 2022 Binance hack — a separate but equally alarming development that signals U.S. prosecutors are finally playing offense, not just documenting losses after the fact.
That seizure attempt is significant. It means law enforcement has traced the funds well enough to file legal action, which is extraordinarily difficult with crypto. It also means some of that stolen money may have been sitting in wallets, partially unmoved, for years.
Why This Changes Everything for Crypto Teams
The FaceStealer operation exposes a gap that no hardware wallet or seed phrase best practice can fix: human trust. These attacks work because they exploit the exact workflows crypto companies rely on — remote teams, video standups, contractor onboarding. The malware installed during these calls can quietly drain wallets, exfiltrate private keys, and harvest credentials over time.
Crypto firms that handle significant on-chain assets are the primary targets. That includes exchanges, DAOs with treasuries, custody providers, and DeFi protocol teams with admin key access.
What Crypto Holders and Teams Should Watch
This story has two immediate implications:
For teams: Any unsolicited or unexpected video call requesting screen sharing or software installation should be treated as a potential attack vector. Verify identity out-of-band, every time, no exceptions.
For the market: The DOJ's $1.2 billion seizure attempt is a signal that regulatory and law enforcement pressure on crypto-linked illicit flows is accelerating. That's a double-edged story — better security long-term, but more scrutiny on exchanges and custody infrastructure short-term.
Watch for more DOJ actions in the coming weeks. This feels like the opening move of a much larger enforcement push, not a one-off headline.