Crypto Theft Can Begin Months Before Your Funds Disappear

The FBI’s November 12 advisory describes the delays in several reported cases involving FaceStealer, a North Korean scheme that uses hijacked accounts and fake video meetings to trick targets into installing malware.

The warning concerns people who may have followed malicious troubleshooting instructions long ago: an absence of unauthorized transfers does not establish that their wallet credentials remained private.

Key takeaways

• Copying a recovery phrase leaves no transaction for the owner to detect.
• A hijacked account and a genuine recording can make a malicious meeting appear familiar.
• Suspected victims need to address wallet control, account access and the risk to their contacts.

Why the wallet can look normal after the theft of a phrase

A recovery phrase lets compatible wallet software reconstruct the private keys used to authorize transactions. For a standard recovery-phrase wallet, someone with the phrase can restore access elsewhere without removing the owner’s access. Both can then hold the means to spend the funds.

Copying the phrase does not move cryptocurrency. A block explorer can show deposits and transfers, but it cannot show that another person has acquired the information needed to authorize a later withdrawal. An owner can therefore continue using the wallet while an attacker watches for a larger balance.

The advisory describes attackers doing precisely that. It gives no average waiting period or estimate of how often a compromise leads to delayed theft. Its finding is narrower: several reported cases involved theft and communication-account hijacking months to more than a year after the intrusion.

The exposure depends on what the attackers could access. A recovery phrase saved on an infected computer presents a different risk from a phrase that was never available to that device. A computer infection alone does not establish that every wallet the owner uses has lost its keys.

How a familiar contact delivers the fake fix

FaceStealer begins with access to a previous victim’s communication account. Attackers use that genuine account to approach contacts about a catch-up, collaboration or investment opportunity, then send a link to an imitation meeting service.

Inside the fake meeting, they play stolen webcam recordings to make recognizable people appear to be participating. They then claim that the target has an audio problem or needs an update. The proposed solution asks the target to download something, run a script or enter a command that installs malware.

The campaign still relies predominantly on genuine stolen recordings, although the advisory also describes synthetic video. The deception does not require an invented face: authentic footage is being used in a conversation the recorded person is not directing.

Authorities seized more than 900 victim webcam recordings during the disruption of FaceStealer infrastructure. The FBI attributes more than $400 million in cryptocurrency theft over 18 months to the scheme.

Cleaning the computer does not replace exposed wallet control

Removing malware can stop that software from continuing to operate on a device. It cannot retrieve a recovery phrase already copied elsewhere. Reinstalling a wallet application, changing its local password or restoring the same phrase on another computer leaves the underlying wallet credentials unchanged.

For an exposed recovery-phrase wallet, replacement means creating a wallet with a fresh phrase and moving the assets. Phantom’s migration guidance explains that its existing recovery-phrase wallets cannot simply be assigned a new phrase. It also advises checking tokens, collectibles, staked assets and DeFi positions, some of which require additional steps before they can be moved.

A migration therefore needs to account for more than the balance displayed on the wallet’s opening screen. The owner must identify the assets and positions still controlled by the exposed credentials and stop directing future payments to the old addresses.

Police Get Help Turning Crypto Traces Into Freeze Requests

Stolen accounts put the next contact at risk

Wallet access is only one use for the compromised device. FaceStealer attackers also obtain contact lists and chat histories, allowing them to tailor an approach around an earlier conversation. A message about an investment or meeting can arrive from the expected account and refer to a real relationship.

Recovering the account can interrupt that route to further victims, but contacts may already have received invitations or seen the owner’s recorded face. They need a warning through another established channel. Employers also need to know when a work device or work information may have been exposed, even if no cryptocurrency has disappeared.

What to do after a suspected compromise

The FBI’s response recommendations address both the owner’s assets and the people who could be targeted next:

1. Replace exposed wallet credentials. Create a wallet with a new recovery phrase on a device that was not used to communicate with the suspected hackers, and transfer the affected assets there.
2. Secure sensitive accounts. Change passwords, log out all active sessions and enable multifactor authentication. If an account is no longer accessible, contact the platform to request its recovery or shutdown.
3. Notify contacts and employers. Explain that attackers may impersonate the owner through hijacked accounts or prerecorded video. Report any possible exposure of work devices or files.
4. Report the incident. Submit a report to IC3 with the keyword “FaceStealer.”

For future meeting invitations: Open the official application independently and join with the meeting code. Confirm unusual requests through another established contact channel, and obtain updates separately rather than running scripts or commands supplied in chat.

Anyone who followed a suspicious “fix” months ago should reassess the credentials and accounts that were accessible then. That review determines whether funds need to move, account sessions need to end and contacts need a warning.