Photo via BBC News

North Korean hackers used fake video calls in $400m crypto hack, says FBI

Read the original at BBC News ↗
Cite

Ng, K. (2026, November 13). North Korean hackers used fake video calls in $400m crypto hack, says FBI. BBC News. https://www.bbc.co.uk/news/articles/cqdj1ellpd70o?at_medium=RSS&at_campaign=rss

Dated from the outlet's own feed. Check the original for its byline.

BBC News · collected 2026-11-13 · by Kelly Ng

Quick Summary

The FBI reports that North Korean state-sponsored hackers used a social engineering scheme called FaceStealer to steal over $400 million in cryptocurrency from more than 900 victims over the last 18 months. The operation specifically targets individuals in the cryptocurrency and web3 sectors by using hijacked social media accounts to lure victims into fake video calls where they are prompted to download malware under the guise of fixing audio issues. This report highlights the sophisticated nature of the "FaceStealer" tactic, which uses pre-recorded videos of known contacts to deceive even security-conscious users into providing access to their devices.
Written by AI on 2026-11-13, from this article's own text only.

AI analysis

Why this leaning score
This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.
No political leaning scored for article 149998 · logged 2026-11-13

Compared with similar articles

This article reads unscored and hedges 36% of its claims. Each row says how that neighbour differs.
New York Post
Hedges 2 of 31 claims Outlet record 66/100
“While both articles describe North Korean hackers stealing cryptocurrency using fake video calls, they appear to cover different aspects of the same broader issue—one focuses specifically on the $400m theft involving 900 victims, while the other includes this theft but also mentions a larger $6.3 billion theft from Binance.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
14
sentences that state something as happening or true
Uncertain
36%
5 of 14 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
66/100
BBC News's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
unclustered
not grouped into a story yet
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-11-13 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

BBC News · 5742 article(s) · 7 correction(s) detected
Running correction rate · 7 correction(s)

Who wrote this

Kelly Ng
24 article(s) here · 1 carrying a prediction
Next, the hackers play pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction.
Au's wife Cheang said she hoped authorities would grant her and her family permission to regularly write to and visit Au in prison.
Two months and two days of the 10-year term will be served concurrently with his ongoing sentence, the judge said on Thursday.
China Media Group, CCTV's parent organisation, said last Tuesday it would suspend broadcasts of Spanish football La Liga matches following the furore, which also led to Mbappé being dropped by several Chinese brands.
In this case, the campaign will continue and expand depending on how secure Xi feels rather than any real issue with corruption."
On Tuesday, Prime Minister Sanae Takaichi said authorities are "verifying the facts" and will "respond appropriately" thereafter.
2026-10-14 · assertive framing · Russia arrests Japanese journalist on alleged espionage
[Otherwise] those kept in the dark while their taps run dry will push back, and rightly so," he adds.
Sohail Afridi, chief minister for Khyber Pakhtunkhwa province ruled by PTI, expects that the march will make its way to a town about 80km (50 miles) west of Islamabad by Thursday.
Speaking to Ukrainian media on Thursday, Sybiha, the foreign minister, said he "hopes that this situation will be resolved in the very near future".
In an X post days before the residency permit hikes set in, Takaichi wrote that her government recognises that "some members of the public may feel a sense of concern or unfairness" as Japan's foreign resident population grows.
Also by Kelly Ng
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 24 articles by Kelly Ng →

Topics

Binance FBI FaceStealer North Korea North Korean

Subjects

FBI ORG · 4× Binance ORG · 2× North Korea GPE · 2× Brett Leatherman PERSON · 1× Google ORG · 1× Justice Department ORG · 1× Microsoft ORG · 1× North Korean NORP · 1× Patrick Grandy PERSON · 1× Pyongyang GPE · 1×

Narrative

Authorities say FaceStealer, the latest scheme, "aggressively targets" those who work in the cryptocurrency and web3 sectors, particularly those who are involved in the development and maintenance of open-source software.
framing: mixed · carried by 1 article(s) · first seen 2026-11-13
Next, the hackers play pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction.

Claims (14 extracted, 5 hedged)

- Published State-sponsored hackers from North Korea have taken more than $400 million in cryptocurrency by using fake video calls to steal people's identities, US authorities say. asserted
authorities → publish → identities
More than 900 victims have fallen prey to the scheme, which the FBI refers to as FaceStealer, in the last 18 months, according to the bureau. uncertain
FBI → fall → bureau
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," says FBI cyber director Brett Leatherman. asserted
Leatherman → rely → years
This comes a week after the world's largest crypto exchange Binance revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. asserted
hackers → come → company
US law enforcement agencies attributed the Binance hack, thought to be the largest crypto hack to date, to North Korea-linked actors. asserted
agencies → attribute → actors
Pyongyang has denied this claim. uncertain
Pyongyang → deny → claim
Authorities say FaceStealer, the latest scheme, "aggressively targets" those who work in the cryptocurrency and web3 sectors, particularly those who are involved in the development and maintenance of open-source software. asserted
who → say → software
According to the FBI and US Justice Department, FaceStealer hackers use fake or hijacked social media accounts to invite potential victims into video calls hosted over "imposter versions" of Zoom, Microsoft Teams, and Google Meet. uncertain
hackers → accord → Zoom
Next, the hackers play pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction. asserted
audio → play → call
A message then pops up on the target's screen, asking them to "fix" the audio by clicking on a link. asserted
message → pop → link
This "fix" would eventually download malware onto the target's device, which allows hackers to access their contact lists and apps, widening their pool of potential victims. asserted
hackers → download → victims
Hackers would secretly record these calls and use the recordings as material to scam their new victims, according to the US authorities. uncertain
Hackers → record → authorities
The FBI has described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user". asserted
FBI → describe → user
"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough." uncertain
you → exploit → it
Give feedback · no sign-in needed

No sign-in needed for now. Your note is sent without a name, so it cannot be answered.

History Support