US seizes servers behind North Korean video-call crypto theft
US authorities have seized cloud infrastructure used in the FaceStealer scheme, which the FBI says let North Korean state-backed hackers steal more than $400 million in cryptocurrency over 18 months. Court approval also allows seizure or restraint of over $1.2 billion linked to the Binance hack, which the FBI attributes to separate North Korean actors. The scheme lured crypto and Web3 workers into fake Zoom, Teams or Google Meet calls using AI-generated deepfakes, then installed malware. The FBI links the cluster to Sapphire Sleet, UNC1069 and BlueNoroff, and says it secretly recorded more than 900 victims' webcam videos.
Key facts
- The FBI identified hijacked Telegram, LinkedIn, Slack and Discord accounts used to send meeting invitations.
- The FBI says hackers have started using AI to create deepfakes of well-known crypto figures.
- The FBI says attackers impersonate known contacts to lure victims into a fake technical error.
Summarised with AI from 5 sources · Updated 16:40Read our AI policy
Why it matters
The FBI says the stolen funds support North Korea's illicit weapons program, and the seizure disrupts that channel.
What changed
Summary updated
First published from Hindustan Times, BBC News, Daily Maverick, DW and The Jerusalem Post