FBI warns of a $400 million crypto scam using stolen webcam videos

Law enforcement agencies have disrupted cloud infrastructure tied to a major cyber threat campaign involving North Korean hackers who are stealing hundreds of millions of dollars in digital assets. According to an advisory released in November, the malicious operation uses unauthorized access to communication platforms to target individuals in the cryptocurrency sector. As part of the campaign, fbi warns users about attackers who hijack genuine accounts on messaging and professional networks to construct convincing social engineering approaches.

The attackers gain entry to historical chat logs, allowing them to tailor invitations to match prior conversations between acquaintances. A standard scheduling tool sets up the appointment, but a late link directs the target to a copycat video conferencing session hosted on fake software mimicking popular corporate tools. Once the participant joins, stored webcam recordings of known contacts play on the screen, creating the illusion of a legitimate meeting.

Stolen webcam recordings and hijacked accounts fuel a massive crypto scam worth over $400 million.

How the FaceStealer Operation Works

The scheme heavily relies on genuine video clips taken from prior victims, although generated deepfakes can also serve for impersonation. During the call, the target's own webcam begins recording immediately upon clicking the malicious link, capturing material that the perpetrators can later use against other contacts. This combination of account takeover and visual deception has generated more than $400 million in digital currency theft over an eighteen-month period.

The FBI notes that compromised accounts and financial losses may manifest months or even more than a year after the initial contact. Officials advise delaying camera activation, using official meeting tools with distinct invite codes, and verifying invitations through alternative communication channels. Individuals suspecting a breach should secure digital assets on a separate device, alert their contacts, and report the incident to authorities using specific keywords.

Why it matters

This sophisticated cyber campaign highlights the persistent vulnerabilities in remote professional communication and asset storage. By turning a victim's own digital presence against their professional network, the operation demonstrates how trust within established contacts can be weaponized to bypass standard security awareness.