The FBI has disrupted infrastructure used by North Korean hackers in a social engineering scheme that targeted crypto and Web3 workers, according to the bureau. The attackers used fake Zoom and Microsoft Teams meetings to record webcams, install malware, and impersonate industry professionals.
How the Scheme Operated
According to Jeremy Robertson, special agent in charge of counterintelligence and cyber at the FBI's Los Angeles field office, the scheme was called FaceDealer. Attackers typically sent victims messages impersonating someone they knew or recognized as important in the industry.
To make the contact appear legitimate, hackers hijacked the person's social media accounts, including Telegram or LinkedIn. Victims were then lured into fake but realistic-looking Zoom or Teams meetings controlled entirely by the attackers.
During the fake meeting setup, hackers secretly recorded the victim's webcam to impersonate them later. When the meeting began, the victim would see video of their supposed contact—actually video from an earlier victim—along with fake participants. The scammers then messaged the victim claiming the other party couldn't hear them.
To resolve the supposed technical issue, victims were directed to run a fake update, which deployed malware giving attackers access to their computers, crypto wallets, and social media accounts.
Scale of the Campaign
The FBI found and disrupted videos involving more than 900 victims—all experienced professionals in crypto, Web3, and cybersecurity. Over 18 months, FaceDealer resulted in more than $400 million in thefts.
Robertson noted the effectiveness of the social engineering approach, cautioning that even skeptical individuals could fall victim to the scheme.
Broader Context
This disruption follows the FBI's attribution of a $6.3 billion Binance breach to North Korean actors in a campaign known as TraderTraitor. Officials confirmed that stolen funds from that breach were converted into ETH and routed through DeFi platforms and instant swap services.
North Korean officials have denied involvement in cyber theft campaigns, characterizing such accusations as absurd rhetoric.
