WASHINGTON — North Korean state-sponsored hackers siphoned more than $400 million in cryptocurrency over the past 18 months by weaponizing stolen webcam footage to compromise digital asset investors, the Federal Bureau of Investigation confirmed in an emergency advisory.
The heist targeted the global blockchain ecosystem.
Operating under an operational campaign the FBI designated as "FaceStealer," operatives infiltrated corporate networks by baiting marks into fraudulent video conference sessions. The threat actors impersonated enterprise communication staples — including Zoom, Microsoft Teams, and Google Meet — to execute the thefts. Federal authorities have recovered more than 900 illicitly captured webcam recordings of victims, exposing an industrial-scale espionage and asset-stripping pipeline linked directly to Pyongyang.
The operation relied on patient social engineering rather than direct brute-force network assaults. Operatives first compromised the legitimate social media and private messaging accounts of trusted industry insiders. From those verified accounts, hackers dispatched direct meeting invitations to colleagues, partners, and business contacts.
The trap closed in minutes.
Victims entered what appeared to be routine operational calls, only to see pre-recorded, hijacked video footage of their trusted associate staring back at them. As victims joined, Pyongyang's operatives recorded their webcams in real time. The mock video stream then flashed a deliberate software glitch, prompting the user to click an external diagnostic link to resolve the audio-visual failure.
That click detonated the payload. The link installed malicious code directly onto the host machine, granting the hackers remote access to local files, authentication cookies, private keys, and corporate social media accounts. The operatives then extracted every active contact list, turning each newly infected target into a fresh launchpad to ensnare the next tier of victims.
Federal investigators cautioned that the syndicate's technical playbook is rapidly mutating. Sapphire Sleet operatives have begun training generative artificial intelligence engines to manufacture hyper-realistic deepfake avatars of high-profile cryptocurrency figures and prominent blockchain founders, allowing them to bypass traditional video identity verification protocols altogether.
The FBI formally attributed the 18-month campaign to an advanced persistent threat cluster tracked as "Sapphire Sleet" — catalogued by cyber intelligence analysts as UNC1069. The bureau clarified that Sapphire Sleet operates as a distinct specialist unit within Pyongyang's apparatus, separate from the state-backed cyber formation linked to the historic $6.3 billion intrusion against cryptocurrency exchange Binance.
| Campaign Parameter | Official FBI Intelligence Finding |
|---|---|
| Threat Actor Designation | Sapphire Sleet (UNC1069) |
| Primary Theft Mechanism | FaceStealer cloned video meeting software |
| Stolen Capital (18 Months) | Exceeds $400 million in digital assets |
| Seized Operational Evidence | 900+ victim webcam recordings |
| Impersonated Platforms | Zoom, Microsoft Teams, Google Meet |
| Next-Generation Vector | Generative AI audio-video deepfakes |
The FBI urged digital asset firms, web3 developers, and infrastructure operators to implement mandatory multi-channel identity verifications before joining external video conferences, while federal counter-cyber squads continue operations to neutralize command-and-control servers tied to the seized video repositories.