The FBI said North Korean hackers had stolen about $400 million in cryptocurrency over 18 months using more than 900 deepfake videos. The hackers allegedly impersonated people known to their victims and contacted them through fake versions of video-calling services. Links presented as connection fixes then gave the hackers access to crypto accounts, email records and chat messages, while webcam recordings and compromised accounts were used to impersonate victims to their contacts.

The FBI said the hackers sometimes monitored targets for at least a year, focusing particularly on major figures in the cryptocurrency sector. It called the method “FaceStealer” and advised potential victims to move their cryptocurrency to a new account, log out of accounts and change their passwords. The FBI also said North Korean hackers were behind a separate theft of $6 billion from the crypto platform Binance the previous month, of which $1.2 billion had been seized, and that the proceeds were used to finance the country’s weapons program.