FBI Links Fake Video Calls to North Korean Crypto Theft Scheme
The FBI says North Korean hackers are using deceptive video calls to install malware and drain cryptocurrency holdings.
The FBI says North Korean hackers are using deceptive video calls to install malware and drain cryptocurrency holdings. This is an original TLT brief synthesising 2 outlets (BeInCrypto, Decrypt), with their figures cross-checked, plus live market data, as of Sat, 14 Nov 2026 00:45:02 UTC.
The scheme targets crypto holders and Web3 workers by impersonating trusted contacts, turning routine video-call invitations into a potential route for fund theft.
- FBI attributes the scheme to North Korean hackers
- FaceStealer has taken more than $400 million in 18 months
- Fake calls use prerecorded or AI-generated contact footage
- Bitcoin fell 4.01% as market sentiment remained fearful
BeInCrypto and Decrypt both report that the FBI has linked the FaceStealer scheme to North Korean hackers and that it has taken more than $400 million over the past 18 months. Decrypt provides more detail about the method, identifying prerecorded footage and AI deepfakes of trusted contacts as tools for tricking crypto workers into installing malware during video calls. BeInCrypto emphasizes the FBI's broader warning that crypto owners, Web3 employees and people maintaining open-source code could be targets. The outlets do not contradict each other; their difference is one of emphasis, with Decrypt adding technical and enforcement context while BeInCrypto focuses on the warning's potential reach.
- FBI Links $6.3B Binance Hack to North Korean Group TraderTraitor
- US Sanctions Target Russian Nationals in North Korean Crypto Scheme
- FBI Links North Korea to Binance Hack, Calls for Action
- FBI Links Fake Video Calls to North Korean Crypto Theft Scheme — this brief
The FBI is warning cryptocurrency holders and industry workers that North Korean hackers may use fake video calls to steal digital assets. Both BeInCrypto and Decrypt identify the operation as FaceStealer, with the bureau saying the scheme has taken more than $400 million over the last 18 months.
Decrypt reports that the scheme relies on prerecorded footage and AI-generated deepfakes of people the victim may trust. A deceptive call is used to persuade crypto workers to install malware during the conversation, creating a direct path for attackers to drain funds. BeInCrypto highlights the FBI's broader assessment that anyone who owns crypto, works in Web3 or maintains open-source code could potentially be targeted.
The two outlets corroborate the central warning, the North Korean attribution and the $400 million-plus loss figure across 18 months. Neither outlet reports a contradictory number or mechanism. Decrypt goes further by describing the use of prerecorded and AI-generated contact footage, while BeInCrypto gives greater prominence to the range of people included in the FBI's warning.
The warning also appears alongside a separate enforcement development highlighted by Decrypt: the Department of Justice is moving to seize $1.2 billion connected to the Binance hack. The supplied coverage does not establish a direct connection between that seizure and FaceStealer, so the two matters should not be treated as part of the same case.
Current market conditions show broad weakness and caution across digital assets. Total crypto market capitalization stands at $2.41 trillion, 
Bitcoin is down 4.01% over 24 hours, and the Fear & Greed index is at 20, categorized as Extreme Fear. No specific coin is named in the FaceStealer coverage, leaving the FBI's warning relevant to the wider crypto sector rather than a single asset. The issue to watch is whether further advisories clarify the targeting methods, affected groups or losses associated with the scheme.
1 key figure independently matched across 2 outlets reporting this story.
TLT extracts the figures each outlet reports and flags the ones that agree. Numbers cited by only one outlet are attributed in the brief, not shown as corroborated.
FBI Links Fake Video Calls to North Korean Crypto Theft Sche — questions & answers
What is the FaceStealer scheme?
The FBI says it is a North Korean operation that uses deceptive video calls to trick crypto workers into installing malware and draining funds.
How much has the scheme taken?
BeInCrypto and Decrypt both report that FaceStealer has taken more than $400 million over the past 18 months.
Who could be targeted by the fake calls?
The FBI's warning extends to crypto owners, Web3 workers and people who maintain open-source code, according to BeInCrypto.
What is the current crypto market context?
Total market capitalization is $2.41 trillion, Bitcoin is down 4.01% over 24 hours, and the Fear & Greed index is at 20, indicating Extreme Fear.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from BeInCrypto, Decrypt, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.