North Korean FaceStealer Campaign Reportedly Took More Than $400M
Two outlets report that North Korean-linked FaceStealer operations used AI deepfakes, compromised social accounts and malware to target cryptocurrency professionals.
Two outlets report that North Korean-linked FaceStealer operations used AI deepfakes, compromised social accounts and malware to target cryptocurrency professionals. This is an original TLT brief synthesising 2 outlets (TronWeekly, CryptoPotato), with their figures cross-checked, plus live market data, as of Sun, 15 Nov 2026 00:30:05 UTC.
The reported scale of the campaign shows how identity verification and compromised communication channels can become direct paths to large crypto losses. It also raises the security stakes for industry professionals whose accounts and trusted contacts may be used to authorize fraudulent activity.
- Two outlets cite approximately $400 million in losses.
- AI deepfakes and fake video calls reportedly supported the FaceStealer campaign.
- Hackers hijacked Telegram and LinkedIn accounts to lure targets.
- Crypto market cap stands at $2.23 trillion amid broad selling.
TronWeekly and CryptoPotato both cite approximately $400 million in connection with the FaceStealer scheme, while TronWeekly describes the total as more than $400 million. TronWeekly attributes the campaign to North Korean hackers and highlights AI-generated deepfakes, fake video calls and malware; CryptoPotato adds that Telegram and LinkedIn accounts were hijacked to make fake meeting invitations appear to originate from trusted contacts. The outlets do not contradict each other on the reported loss figure, but they emphasize different elements of the operation.
- North Korean Hackers Reportedly Use Meme Coins to Launder Binance Stolen Funds
- North Korean FaceStealer Campaign Reportedly Took More Than $400M — this brief
TronWeekly reports that North Korean hackers extracted more than $400 million through a scheme known as FaceStealer. The campaign targeted cryptocurrency professionals with AI-generated deepfakes, fraudulent video calls and malware, according to the outlet. CryptoPotato independently cites roughly $400 million in losses, placing the reported proceeds within the figure presented by TronWeekly.
A key mechanism described by CryptoPotato was the hijacking of Telegram and LinkedIn accounts. The attackers used those compromised profiles to issue meeting invitations that appeared to come from trusted industry contacts, increasing the likelihood that targets would engage with the false meetings. TronWeekly separately highlights the use of synthetic identities and live video deception as central elements of the campaign.
The two reports overlap on the approximate $400 million figure but provide different operational details. TronWeekly supplies the alleged North Korean attribution and identifies deepfakes, video calls and malware, while CryptoPotato focuses on compromised professional and messaging accounts. Neither report presents a conflicting estimate for the total amount stolen, and the figure cross-check also identifies $400 million as appearing in both outlets’ coverage.
The episode places renewed attention on how a compromised communication account can combine with convincing audiovisual material to undermine ordinary trust checks. Because the reported targets were cryptocurrency professionals, the risks extend beyond impersonation alone: the scheme incorporated fake meetings and malware designed to gain a foothold when a target interacted with what appeared to be a legitimate contact.
The broader market was under pressure during the reporting period. Total crypto market capitalization stood at $2.23 trillion, the overall market was broadly lower, and 
Bitcoin declined 6.18% over 24 hours. The Fear & Greed index registered 10, classified as Extreme Fear; no specific coin was linked to the reported FaceStealer activity. Attention now centers on whether the reported losses are independently confirmed and what account-security and meeting-verification controls crypto professionals apply to similar contact requests.
1 key figure independently matched across 2 outlets reporting this story.
TLT extracts the figures each outlet reports and flags the ones that agree. Numbers cited by only one outlet are attributed in the brief, not shown as corroborated.
North Korean FaceStealer Campaign Reportedly Took More Than — questions & answers
How much did the reported FaceStealer scheme steal?
TronWeekly and CryptoPotato cite approximately $400 million, with TronWeekly describing the total as more than $400 million.
How were cryptocurrency professionals targeted?
TronWeekly reports AI-generated deepfakes, fake video calls and malware, while CryptoPotato says hijacked Telegram and LinkedIn accounts supported fraudulent meeting invitations.
What market conditions accompanied the report?
Total crypto market capitalization was $2.23 trillion, Bitcoin was down 6.18% over 24 hours, and the Fear & Greed index stood at 10, indicating Extreme Fear.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from TronWeekly, CryptoPotato, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.