FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls

thehackernews.com Nov 13, 2026

FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls

Curated by Shubham · TechCapsules · Nov 13, 2026

AI-summarised brief · reviewed before publication

The FBI confirmed that North Korean threat actors, operating under the FaceStealer campaign, stole over $400 million in cryptocurrency in the past 18 months. The operation used deepfake video calls and social engineering to target individuals in the crypto and Web3 sectors, recording victims’ webcams to build trust. The U.S. government seized the cloud infrastructure that enabled the attacks, while the DOJ also seized more than $1.2 billion in assets linked to the TraderTraitor hack of Binance. The proceeds are believed to fund Pyongyang’s illicit weapons program.

💡 Why It Matters

· The case exposes how state-sponsored actors exploit emerging tech, turning deepfakes into a weaponized phishing tool that can infiltrate software supply chains.
· It underscores the growing threat to digital finance and open-source ecosystems, prompting urgent reassessment of security protocols across the industry.

Read full article on thehackernews.com

LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers…

LNbits, an open‑source Bitcoin Lightning wallet platform, warned all operators to shut down their servers after a series of attacks exploited a vulnerability in the software. One operator reported that an attacker used an unknown extension to siphon 2,285,545 satoshis (≈0.023 BTC) from his instance before the warning was issued. The project issued an initial advisory at 12:33 UTC, asking users to disable the Paywall add‑on, and followed with a full shutdown notice 80 minutes later. No patches had been released by 09:00 UTC, though developer Ben Arc said fixes would be merged within 24‑48 hours. LNbits also disabled its own cloud service, promising restoration by 17:20 UTC. The breach left users unable to access funds pending a fix until the security updates are deployed.

💡 The incident proves that even lightweight, community‑maintained wallet stacks can become lucrative targets, forcing operators to treat open‑source code with the same rigor as commercial services.

thehackernews.com · Nov 9

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for…

Keplr wallet users who logged in with Google or Apple accounts suffered theft after a vulnerability in Web3Auth, the provider of the social‑login service, was exploited. The flaw gave the attacker access to private keys, allowing funds to be moved from compromised wallets. Web3Auth responded by using the same breach path to transfer assets from at‑risk accounts into designated recovery wallets before the thief could act, a process coordinated with Keplr. The rescue operation covered more than 44,000 wallets and moved over $6 million across Cosmos and Ethereum‑compatible chains. Wallets secured with recovery phrases or hardware devices were unaffected. Keplr has paused social‑login options, is investigating, and is working with Web3Auth to verify which accounts were impacted and to restore funds.

💡 The breach shows that convenient social‑login mechanisms can become a single point of failure for crypto custody, prompting a reassessment of authentication strategies in decentralized finance.

9to5mac.com · Nov 5

Security Bite: The record $6.3B Binance heist started with a fake Homebrew…

Last week, hackers stole $6.3 billion from Binance wallets, the largest financial heist ever. Binance froze nearly $3 billion, but the breach still dominated headlines. Security researcher Christopher Lopez and others suspect the attack began on a Mac, echoing the $1.5 billion Bybit theft that also started on a developer’s Mac. Mac users, especially DevOps and crypto professionals, have faced increasing malware and social‑engineering attacks, raising concerns about platform security.

💡 The incident underscores how even high‑profile exchanges remain vulnerable to sophisticated, platform‑specific attacks, prompting a reevaluation of security practices across the crypto ecosystem.

thehackernews.com · Nov 3

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to…

Binance disclosed that a $6.43 billion theft from its platform resulted from a coordinated, multi‑stage attack that began with a trojanized Homebrew installer used by a Wallet DevOps engineer in June 2026. The malware installed a malicious AI tool, exposing internal credentials. In September, attackers posed as a recruiter on a job‑hunting site, conducted fake interviews with a second engineer, and delivered a poisoned code repository that compromised his workstation. By October, the threat actors leveraged the compromised machines and an internal AI tool to hijack a container deployment token, gain control of additional engineers, and access the wallet‑signing service, enabling unauthorized transactions. Binance has since rebuilt the affected wallet system, hardened device and AI controls, and expanded AI‑driven anomaly detection.

💡 The breach shows how social‑engineering via fake recruitment can infiltrate even highly secured crypto exchanges, turning internal developer tools into a conduit for massive fund loss.

techcrunch.com · Nov 1

Binance resumes withdrawals following $6.3 billion breach

Binance announced it would resume withdrawals in a phased manner after a $6.3 billion hack that froze all deposits and withdrawals. The exchange reported covering 95 % of the stolen assets and is still sourcing the remaining, less liquid holdings. Binance confirmed it would absorb the financial loss and not pass it on to users. Withdrawals will restart gradually, with Bitcoin and Ethereum services partially suspended, and users may experience delays. The company will publish a detailed incident report post‑investigation.

💡 The swift restoration of withdrawals signals Binance’s resilience and commitment to user trust amid a massive security breach. It also underscores the broader industry challenge of safeguarding digital assets against sophisticated cyber threats.

thehackernews.com · Nov 1

FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The FBI announced that the North Korean‑aligned hacking collective known as TraderTraitor, also identified as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, stole more than $6.43 billion in cryptocurrency across 11 blockchains. investigators from the FBI, U.S. Secret Service and IRS‑CI said the group primarily converted the loot into Ethereum before moving it through decentralized‑finance swaps and instant‑swap services for further laundering. Binance resumed phase‑one withdrawals after pausing them following the breach, noting that deposits remain unaffected. The theft surpasses the $1.46 billion Bybit hack and represents the largest crypto heist on record, with 82 % of the stolen value on Ethereum and Bitcoin. On‑chain analysis shows $2.85 billion of the assets have been frozen by Tether, Circle, Ripple, Arbitrum and Optimism.

💡 The haul demonstrates how state‑backed actors can weaponize decentralized finance to fund illicit programs, forcing regulators and exchanges to tighten cross‑chain monitoring. It also proves that even leading platforms like Binance can be disrupted by sophisticated supply‑chain attacks, reshaping risk assessments for the broader Web3 ecosystem.