FBI warns North Korean hackers used AI deepfakes to steal $400 million in cryptocurrency

The FBI announced on November 12, 2026, that North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months. The investigation identified the hacking group as Sapphire Sleet, also known as UNC1069, according to Japanese media and other outlets. Officials stated that the group utilized a sophisticated social engineering method known as FaceStealer to target victims.

The FaceStealer method relies on surreptitiously recorded video of a victim's contacts to lure targets into fake video calls. These fraudulent calls take place on common communication platforms such as Zoom, Microsoft Teams, or Google Meet. During these sessions, hackers use AI-generated deepfake videos to impersonate known contacts. Once the target is engaged, the hackers use simulated technical errors to trick individuals into clicking malicious links. These links install malware on the computers and social media accounts of the victims. The FBI has already identified and seized over 900 victim webcam videos as part of the investigation.

The scope of the theft and the Binance connection

The FBI noted that this specific hacking group is distinct from another group linked to a massive theft from Binance. Earlier this month, the FBI accused North Korean hackers of stealing $6 billion from Binance, though some outlets cited the amount as $6.3 billion. North Korea has denied any involvement in the Binance theft. Regardless of the specific amount, officials expressed concern regarding the scale of these operations.

Brett Leatherman, the Director of the FBI Cyber Division, stated that the North Korean regime uses large-scale cryptocurrency thefts to fund illegal weapons programs, stealing billions in recent years. The scale of the FaceStealer operation highlights how AI technology is being integrated into cybercrime to bypass traditional security measures.

The effectiveness of AI-driven social engineering

The use of deepfake technology makes these attacks particularly dangerous because they exploit human trust in visual and auditory cues. Patrick Grandy, the Deputy Assistant Director of the FBI Los Angeles Field Office, stated that FaceStealer is a highly effective social engineering method that can deceive even technically proficient and security-conscious users. By impersonating a known colleague or friend during a video call, the hackers bypass the skepticism that a person might otherwise have toward an unknown sender.

As these AI-driven methods become more common, security experts and law enforcement agencies continue to monitor the evolution of state-sponsored hacking. The ability to mimic real people in real-time video environments represents a significant shift in the landscape of digital fraud and state-backed cyber warfare.

Glossary

• UNC1069 — UNC1069 is a hacking group also known as Sapphire Sleet. It is a North Korean state-backed group that has been identified for stealing cryptocurrency.
• Binance — Binance is a platform where users can buy and sell U.S. stocks and ETFs from their accounts.
• social engineering — Social engineering is a method used to deceive individuals, such as the FaceStealer method which uses AI-generated deepfake videos to impersonate known contacts. It exploits human trust in visual and auditory cues to bypass security measures.
• malware — Malware refers to malicious software installed on computers or social media accounts. It can be delivered through malicious links during fraudulent communication sessions.