Photo via The Daily Caller

FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme That Swiped $400 Million In Crypto

Read the original at The Daily Caller ↗
Cite

Kresak, D. (2026, November 13). FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme That Swiped $400 Million In Crypto. The Daily Caller. https://dailycaller.com/2026/11/13/fbi-north-korea-facestealer-cryptocurrency-scheme

Dated from the outlet's own feed. Check the original for its byline.

The Daily Caller · collected 2026-11-13 · by Dylan Kresak

Quick Summary

The FBI and Department of Justice disrupted a North Korean cyber operation called "FaceStealer" that stole more than $400 million in cryptocurrency over an 18-month period. Hackers recorded over 900 tech workers' webcam footage to impersonate them in video calls, tricking colleagues into downloading malware to gain system access. The report highlights the use of AI deepfake technology in these schemes and notes that federal authorities seized more than $1.2 billion of North Korea's stolen assets.
Written by AI on 2026-11-13, from this article's own text only (the story summary below draws on all the coverage).
See how they differ ↓

How they differ

3 outlets covered “FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme”.

What each outlet says

One AI summary per outlet of its latest article on this story, written from that article alone and checked against it. Open the article for the outlet's own words.

Daily CallerThis outlet13 Nov

The FBI and Department of Justice disrupted a North Korean cyber operation called "FaceStealer" that stole more than $400 million in cryptocurrency over an 18-month period. Hackers recorded over 900 tech workers' webcam footage to impersonate them in video calls, tricking colleagues into downloading malware to gain system access. The report highlights the use of AI deepfake technology in these schemes and notes that…

FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme That Swiped $400 Million In Crypto (this article)
BBC13 Nov

The FBI reports that North Korean state-sponsored hackers used a social engineering scheme called FaceStealer to steal over $400 million in cryptocurrency from more than 900 victims over the last 18 months. The operation specifically targets individuals in the cryptocurrency and web3 sectors by using hijacked social media accounts to lure victims into fake video calls where they are prompted to download malware…

North Korean hackers used fake video calls in $400m crypto hack, says FBI →
Dawn13 Nov

The FBI reported that state-backed North Korean hackers used a social engineering scheme called "FaceStealer" to steal more than $400 million over the last 18 months. The operation involves hackers using AI-powered deepfake videos to impersonate people in a victim's contact list, eventually tricking the targets into installing malware during fake technical errors. This reporting focuses on how these tactics exploit…

North Korean hackers stole $400m using fake video calls: FBI →

Compared with similar articles

This article reads unscored and hedges 43% of its claims. Each row says how that neighbour differs.
BBC News
Hedges 5 of 14 claims Outlet record 66/100
Dawn
Hedges 1 of 11 claims Outlet record 72/100
New York Post
Hedges 2 of 31 claims Outlet record 66/100
“While both articles discuss North Korean hackers stealing cryptocurrency using similar methods, they appear to describe different schemes with different amounts and timeframes.”

Story

FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme
Other · 3 article(s) covering the same event. See how they differ ↑
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
23
sentences that state something as happening or true
Uncertain
43%
10 of 23 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
92/100
The Daily Caller's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
3
Other
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-11-13 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

The Daily Caller · 225 article(s) · 0 correction(s) detected
No corrections detected for this publisher. That may mean careful reporting, or simply that nothing has been checked.

Who wrote this

Dylan Kresak
16 article(s) here · 1 carrying a prediction
The hackers record the victim without their knowledge as their wait for the meeting to begin, which the hackers will later use to impersonate them, Robertson explained.
Microsoft says that more than a hundred million users may finally be able to use their emails after a nearly day-long outage.
Vovan and Lexus asked the officials if they would give Ukraine access to AI models to support its military efforts, according to the call.
A coalition of nonprofit groups is suing some of the biggest artificial intelligence companies over concerns that their technology could pose catastrophic risks to public safety.
Colette Kress, Nvidia’s chief financial officer, will fill in for Huang as the company searches for a new CEO, Reuters reported.
“While the Board has no reason to believe that either national security or Nvidia secrets were compromised, the Board’s inquiry will examine all available information,” Nvidia’s Board of Directors said in a Sunday press release.
Former airline workers’ office chats may soon train one of the world’s biggest artificial intelligence models.
An artificial intelligence giant promised teachers unions that it would not mine children’s data at school.
“Why would you want to bring water-polluting, diesel-generating data centers right down the street from where people live, work, play?
— Congress’ permitting maze could decide whether the U.S. can power its industrial future, energy industry leaders warned.
Also by Dylan Kresak
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 16 articles by Dylan Kresak →

Topics

Binance FBI FaceStealer North Korean North Korea’s

Subjects

FBI ORG · 11× North Korean NORP · 6× Binance ORG · 5× Robertson PERSON · 3× North Korea’s GPE · 2× Jeremy Robertson PERSON · 1× Los Angeles GPE · 1× Teams ORG · 1× The Department of Justice ORG · 1× Zoom ORG · 1×

Narrative

Jeremy Robertson, FBI special agent in charge of counterintelligence and cyber at the Los Angeles, CA, field office, explained the North Korean FaceStealer operation in a video posted Friday on the FBI’s YouTube channel. “North Korean hackers send you a message impersonating someone you know, or someone significant in your industry …
framing: mixed · carried by 1 article(s) · first seen 2026-11-13
The hackers record the victim without their knowledge as their wait for the meeting to begin, which the hackers will later use to impersonate them, Robertson explained.

Claims (23 extracted, 10 hedged)

The FBI cracked down on a North Korean operation to secretly hack tech employees’ webcams and steal hundreds of millions in cryptocurrency from their colleagues on video calls. asserted
FBI → crack → calls
North Korean hackers seized employees’ accounts and covertly recorded webcam footage to pose as victims’ trusted contacts, tricking victims into downloading malware, which resulted in more than $400 million in stolen cryptocurrency across 18 months, according to an FBI report posted Thursday. uncertain
which → seize → report
The scheme, which the FBI dubbed “FaceStealer,” has begun to include the use of AI deepfake technology to rob victims, according to a Thursday FBI Flash alert. uncertain
FBI → dub → alert
The FBI found that the hackers had recorded more than 900 tech workers, whose footage was used to impersonate them, according to the FBI Flash alert. uncertain
footage → find → alert
(RELATED: ‘Rocky Balboa,’ ‘Superman Cash’ And ‘Fat Boy’ Allegedly Hit Hospitals, Bank In $129 Million AI Con) uncertain
Balboa → hit → Con
Jeremy Robertson, FBI special agent in charge of counterintelligence and cyber at the Los Angeles, CA, field office, explained the North Korean FaceStealer operation in a video posted Friday on the FBI’s YouTube channel. “North Korean hackers send you a message impersonating someone you know, or someone significant in your industry … asserted
you → explain → industry
Next, they lure you into a realistic but imposter Zoom or Teams meeting,” Robertson said in the video. asserted
Robertson → lure → video
The hackers record the victim without their knowledge as their wait for the meeting to begin, which the hackers will later use to impersonate them, Robertson explained. asserted
Robertson → record → them
The hackers then instruct the victim to download malware that enables them to access the victim’s computer, by telling the individual their meeting audio is not working and sending them an “update” to fix it, Robertson said. asserted
Robertson → instruct → it
The Department of Justice said Thursday it took control of the hackers’ online setup and seized the stolen webcam videos, according to the department’s press release. uncertain
it → say → release
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said according to the press release. uncertain
Proctor → bankroll → release
“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.” asserted
Division → use → gains
“By springing into action at a moment’s notice, we worked together to freeze this massive criminal fraud in its tracks,” Jeanine Ferris Pirro, U.S. attorney for the District of Columbia, said in the release, referring to funds stolen from Binance. asserted
Pirro → spring → Binance
“The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets.” uncertain
we → think → assets
The Justice Department and the FBI did not immediately respond to the DCNF’s requests for comment. asserted
Department → respond → comment
Previously, North Korean military hackers, “TraderTraitor,” looted more than $6 billion in cryptocurrency from Binance on Oct. 29, the press release stated. asserted
release → loot → Oct.
A Binance spokesperson told the Daily Caller News Foundation that roughly $6.34 billion worth of digital assets were affected and about $2.85 billion is “frozen or intercepted so far.” asserted
billion → tell → assets
“Our teams continue to work closely with law enforcement, blockchain intelligence firms, issuers and industry partners to trace, freeze and recover additional impacted funds,” the Binance spokesperson said. asserted
spokesperson → continue → funds
“Recovery is ongoing and we’ll share further verified updates through official Binance channels. asserted
we → share → channels
The DOJ has court approval to seize or restrain more than $1.2 billion worth of stolen assets, part of over $2.7 billion that authorities as well as private companies have frozen, the press release states. asserted
release → have → that
In another hacking incident using the same FaceStealer scheme, the hackers fooled a developer who helps run a popular piece of free software into downloading malware, according to the FBI alert. uncertain
who → use → alert
The breach “could easily have resulted in very large-scale victimization,” the FBI said. uncertain
FBI → result → victimization
The agency knows of several other North Korean attempts to target tech workers, according to the alert. uncertain
agency → know → alert
Give feedback · no sign-in needed

No sign-in needed for now. Your note is sent without a name, so it cannot be answered.

History Support