US authorities say a North Korea-linked operation nicknamed "FaceStealer" has taken roughly $400 million in crypto over about 18 months. Instead of hacking wallets directly, the attackers used a far simpler weapon: a convincing video call.
How the scam works
Victims, often people working in the crypto industry, are contacted by someone they appear to know. On the call they see and hear what looks like a trusted colleague or contact. In reality it can be prerecorded footage or an AI-generated deepfake. During the call, the "contact" says something is wrong with the audio or video and asks the victim to install a fix, an update or a meeting tool. That file is malware.
Once installed, the malware can search the computer for browser-saved passwords, wallet files, session cookies and anything else that helps drain accounts.
Why it matters to ordinary wallet owners
A hardware wallet protects your keys from malware, but only if you never type your recovery words into a computer, and never hand over control of your device. If your crypto seed is stored in a text file, a notes app or a screenshot, malware on your machine can read it in seconds.
Warning signs
- An unexpected call or meeting invite, even from a familiar face or account.
- A request to install software, a plugin or an "update" during the call.
- Pressure to act fast or to share your screen.
- A link that differs slightly from the official meeting service.
How to protect yourself
- Confirm any unusual request through a second channel, such as a message to a phone number you already know.
- Download software only from the official website of the vendor.
- Keep your recovery phrase offline on paper or metal, and never type it into a website, app or online tool.
- Use a hardware wallet and check every transaction on its own screen.
- Keep a separate, clean device for larger holdings.
- Keep your operating system and antivirus up to date.
The takeaway
Seeing a face on a screen is no longer proof of identity. Treat every request to install software as suspicious, and keep your seed phrase away from any connected device. If you suspect you installed something malicious, disconnect from the internet, move funds from a clean device to a new wallet, and change your passwords.
