The U.S. Justice Department said North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months using a scheme called “FaceStealer.” The FBI describes the operation as turning video conference calls into traps: attackers use accounts stolen from previous victims, then play secretly recorded webcam footage and AI-generated deepfake videos of trusted contacts to win a target’s confidence. After luring the victim onto a call, the hackers fabricate a technical glitch and send a link that installs malware, allowing them to drain crypto wallets or access other systems, sometimes months later. The DOJ linked the campaign to North Korean groups known as Sapphire Sleet, BlueNoroff and APT38 and noted a growing focus on open-source developers to facilitate supply-chain attacks. In a separate action, the DOJ obtained court authorization to seize more than $1.2 billion tied to the Binance hack, part of $2.7 billion already frozen. 1