This is news about a warning or a rule change, not legal advice. Status can change after publication, so check the official source before you act.
SCAM ALERTConsumer alert, published November 14, 2026
The FBI says it has disrupted a North Korean impersonation scheme it calls FaceStealer. In a FLASH alert numbered AC-111226-MS, the FBI says the scheme stole more than $400 million in cryptocurrency over about 18 months. The main targets are people who work in crypto and Web3, along with open-source software developers and maintainers.
What is happening
The FBI ties FaceStealer to North Korean state-sponsored actors. Its FLASH alert lists several names security researchers use for the group. These include Sapphire Sleet, UNC1069, CryptoCore, APT38, BlueNoroff and Stardust Chollima. The FBI’s dedicated FaceStealer page on fbi.gov describes the same theft scheme. Its list of group names differs slightly from the list in the FLASH.
The Department of Justice and the FBI Los Angeles Field Office announced the disruption effort. The case sits in the Central District of California. According to the Justice Department, agents used a federal warrant to seize cloud infrastructure used in the scheme. They also seized more than 900 webcam videos of victims.
That number matters. The videos were the raw material for the scam. Each one was a real person, recorded without knowing it, whose face could be used to fool the next target.
This is not the first warning of its kind. On September 3, 2024, the FBI’s Internet Crime Complaint Center issued public service announcement I-090324-PSA. It warned that North Korean actors were running tailored social-engineering campaigns against people who work in decentralized finance and crypto. In April 2025, the FBI warned again that North Korea was “aggressively” targeting the crypto industry.
What the disruption means for you. Seizing servers and stolen videos takes tools away from the attackers. It does not mean the threat is over. The FBI is still warning crypto holders and developers to watch for these calls. The announcements we reviewed do not describe arrests or charges against named people. They also give no figure for how much a typical victim lost.
A figure to ignore. A FinanceX Magazine headline says the US seized $1.2 billion in the FaceStealer case. We found no official FBI or Justice Department page that supports that number. The official figure is more than $400 million stolen. The $1.2 billion figure could not be matched to it.
How the scam works
The FBI’s FLASH describes a pattern that builds trust one step at a time.
First, you get an invitation to a meeting. It comes from an account you may recognize, such as a colleague, a business contact or someone in your crypto circle. The FBI says these accounts were hijacked from earlier victims. The real owner did not send the message.
Next, you are pointed to a video-meeting app. The FBI says these apps are fake. They are built to look like a normal meeting tool.
Then the call starts. On screen, you see a person you think you know. The FBI says the attackers replay secretly recorded webcam footage of earlier victims. The face is real. The movements are real. But nobody is actually on the other end. The point is to make you believe you are on a live call with a trusted person.
Finally, something seems to go wrong. Maybe the audio fails or the app says it needs attention. You are offered a fix. The FBI says this could be an update, a script or a command to paste and run. That fix installs malware. From there, the attackers can go after your crypto.
How to spot it
- A meeting invite that pushes you to download or use a meeting app you do not normally use.
- A contact who appears on video but does not respond naturally, talks over you, or seems to loop.
- A “technical problem” on the call that comes with a ready-made solution.
- Being asked to install an update, run a script or paste a command into your computer.
- Pressure to fix the problem right now so the meeting can continue.
- A message about work, funding or a partnership that arrives through an account that suddenly feels slightly off.
A familiar face is no longer proof. The FBI’s warning shows that real footage of a real person can be reused against you.
Never run a fix from a call
No legitimate meeting needs you to paste a command or run a script someone hands you. If an app says it needs an update, close it. Get any software you use only from its official source, on your own, not from a link in the meeting. If a contact asks you to do this, check with them through a different channel you already trust.
If you think you were targeted
If you were targeted
- Stop using the affected computer for anything involving money or crypto. Disconnect it from the internet if you ran a script, command or update from a call.
- From a separate device you trust, check your crypto wallets and exchange accounts. Contact the platforms you use through their official support channels and tell them you may have been compromised.
- Change passwords and turn on two-factor authentication for email, exchange and financial accounts, again using a clean device.
- If bank or card details may be exposed, call your bank or card issuer using the number on the back of your card.
- Freeze your credit with all three credit bureaus if you think personal or identity information was taken.
- Warn the contact whose account sent the invite, using a phone number or channel you already had. Their account may still be in the attackers’ hands.
If you lost a large amount, or your employer’s systems were involved, talk to a lawyer. Your company’s security team should also know right away.
How to report it
The FBI asks victims to report FaceStealer activity to the FBI’s Internet Crime Complaint Center at ic3.gov. Use the keyword “FaceStealer” in your report. The FBI’s FaceStealer page on fbi.gov says reports must be filed this way.
You can also report the fraud to the FTC at ReportFraud.ftc.gov.
If your personal information was stolen or misused, report it and get a recovery plan at IdentityTheft.gov.
You can contact your state attorney general’s consumer protection office as well.
Report quickly, even if you are not sure you lost money. Details such as the account that sent the invite, the name of the meeting app and the time of the call can help investigators link your case to others.
For the background, see our crypto scams and regulation guides.
Check, verify or complain
Sources
- FBI / IC3 (Flash) ic3.gov · official source
- FBI fbi.gov · official source
- Department of Justice justice.gov · official source
Leah writes US Financer's Consumer Alerts: scam warnings and money rule changes issued by federal agencies, state attorneys general, regulators and courts. Each alert starts from the official notice, says what is confirmed and what is not known yet, and lists the agency's own page…
Ruth is US Financer's standards editor. Every article goes through her checks before and after it is published: each rate, fee, cap, deadline and rule is matched against its primary source, every law named is linked to its official text, and anything that cannot be…
What changed
- Nov 14, 2026 First published.
Comments are closed