North Korean hackers used fake video calls in $400m crypto hack, says FBI

State-sponsored hackers from North Korea have taken more than $400 million in cryptocurrency by using fake video calls to steal people's identities, US authorities say.

More than 900 victims have fallen prey to the scheme, which the FBI refers to as FaceStealer, in the last 18 months, according to the bureau.

"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," says FBI cyber director Brett Leatherman.

This comes a week after the world's largest crypto exchange Binance revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company.

US law enforcement agencies attributed the Binance hack, thought to be the largest crypto hack to date, to North Korea-linked actors. Pyongyang has denied this claim.

Authorities say FaceStealer, the latest scheme, "aggressively targets" those who work in the cryptocurrency and web3 sectors, particularly those who are involved in the development and maintenance of open-source software.

According to the FBI and US Justice Department, FaceStealer hackers use fake or hijacked social media accounts to invite potential victims into video calls hosted over "imposter versions" of Zoom, Microsoft Teams, and Google Meet.

Next, the hackers play pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction.

A message then pops up on the target's screen, asking them to "fix" the audio by clicking on a link. This "fix" would eventually download malware onto the target's device, which allows hackers to access their contact lists and apps, widening their pool of potential victims.

Hackers would secretly record these calls and use the recordings as material to scam their new victims, according to the US authorities.

The FBI has described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user".

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday.

"If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."