Washington: US authorities have dismantled a cyber fraud operation linked to North Korean hackers that allegedly stole more than $400 million in cryptocurrency through manipulated video calls and artificial intelligence-generated deepfakes over an 18-month period.
The US Department of Justice announced that investigators had seized cloud infrastructure used by the cybercriminal network. The FBI identified the operation as “FaceStealer”, which targeted professionals working in the cryptocurrency and technology sectors.
According to investigators, perpetrators gained access to compromised accounts and sent fraudulent meeting invitations to potential victims. During video calls, they played previously recorded footage of familiar individuals or used AI-generated deepfakes impersonating prominent cryptocurrency personalities to establish credibility.
Victims were subsequently shown fabricated technical errors and directed to malicious links disguised as troubleshooting solutions. These links installed malware, allowing hackers to monitor systems and eventually steal digital assets. In certain cases, attackers reportedly remained undetected for months or even more than a year before executing the theft.
The FBI has linked FaceStealer to a hacking group identified as Sapphire Sleet or UNC1069. Authorities also seized more than 900 webcam recordings connected to the victims.
Separately, the Justice Department said it had obtained court authorisation to seize or restrict access to over $1.2 billion stolen in the October 29 Binance cryptocurrency breach. The FBI attributed that attack to another North Korean-linked group, TraderTraitor. The incident involved approximately $6.3 billion, making it the largest cryptocurrency theft on record, according to AP.
US agencies and private companies have frozen more than $2.7 billion connected to the Binance incident. Officials said cryptocurrency theft remains a major source of funding for North Korea’s weapons programme.
