Learn · 2026-11-14

FaceStealer Deepfake Video Calls: How to Check Your Wallet

You usually cannot tell a good deepfake by looking at it, so the most reliable check is to confirm the call through a separate channel you already trust. Treat any "technical fix" link or download offered during a call as the main warning sign. There is also no way to scan a wallet address for malware, because malware lives on your device and not on the blockchain. What you can do is check your wallet on a public block explorer for transactions you did not make, and treat the device as compromised if you installed anything during a suspicious call.

This guide was written on 2026-11-14. The situation may change, so check official channels.

BOTLAB is not affiliated with the FBI, the US Department of Justice, Binance, or any of the news outlets cited below.

What is confirmed so far

The facts below come only from the linked reports. We have not added anything beyond them.

The FaceStealer campaign

US authorities seized cloud infrastructure used in FaceStealer. The DOJ described it as a North Korean social engineering campaign that stole more than $400 million in cryptocurrency over the past 18 months (Cointelegraph).
According to the DOJ, the hackers lured targets into meetings using accounts stolen from previous victims. They then played prerecorded webcam footage of trusted contacts to simulate their presence (Decrypt).
The group also used AI-generated deepfakes of prominent or well-known figures in crypto to gain targets' trust. This is reported by both Cointelegraph and Decrypt.
Once a target was at ease, the attackers faked a technical glitch, such as claiming the person could not be heard. They then offered a link to "fix" it, and the link installed malware (Decrypt). Cointelegraph describes this as "bogus technical fixes" used to trick targets into installing malware.
From there the hackers could drain crypto wallets or exploit the victim's access to other systems. They sometimes waited months, or more than a year, before striking (Decrypt).
The FBI seized more than 900 webcam videos of FaceStealer victims under a federal warrant. It also published a public advisory on how to protect against the scheme and what to do after a compromise (Cointelegraph).
The DOJ said the group is publicly known by several names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima (Cointelegraph).

The separate Binance hack

The DOJ announced a separate case at the same time. It obtained court authorization to seize or restrain more than $1.2 billion of the crypto stolen from Binance in the Oct. 29 hack. That sum is part of more than $2.7 billion frozen so far.

The two sources give slightly different totals for the theft. Cointelegraph says $6.3 billion and Decrypt says "roughly $6.4 billion". The Block reports the same headline seizure.

The FBI attributed that hack to the group TraderTraitor, and North Korea has denied involvement. Cointelegraph reports that Binance said on X that it covered the affected assets with its own funds. The FaceStealer campaign is a different case from the Binance hack.

What the sources do not say

None of the sources gives a deadline, a cut-off date or a block height. There is no time limit to act by.
Timing still matters in one way. Decrypt reports that attackers sometimes waited more than a year before striking. A suspicious call from many months ago can still matter today.
The sources do not list specific wallets, apps or video platforms affected.
None of them gives a link to the FBI advisory in its text. Find it through the FBI's own official website rather than through links sent to you.

Who is targeted, and the wider effect

The sources do not say who is not affected. They do say who was targeted:

People working in crypto and Web3 (Cointelegraph).
Open-source developers and maintainers. The hackers increasingly targeted them to gain access to their devices and software repository accounts (Cointelegraph). Decrypt describes this as "an apparent bid to enable supply-chain attacks" (Decrypt).

This is the wider effect. A compromised developer could expose many software users, not only that developer. Ordinary holders who never take work video calls appear to be less directly targeted, based on these reports. The sources do not say they are unaffected, though.

How to spot a suspicious video call

No visual trick reliably detects a well-made deepfake. Prerecorded real footage of a real contact may look completely normal. Pay attention to the process instead of the face.

Red flags drawn from the reported method

The invite comes from a known contact's account, but the request is unusual or rushed.
The other person barely interacts live, or their responses do not quite match what you just said.
A "glitch" appears, such as "we can't hear you" or "your camera isn't working," and you are offered a link, plugin, script or app to fix it.
You are asked to install anything, run a command, or update software from a link rather than through your normal app store or the official vendor site.

Verify before you trust

Hang up and contact the person through a different channel you already had, such as a saved phone number. Do not use a number or link supplied in the call or the invite.
Never install software from a link shared during a call. Fix audio and video problems through your system settings or the video app's own official update process.
If you are a developer, be extra cautious with any request to run code, open repositories, or grant access during or after a call.

How to check your own position

You cannot scan a wallet address for malware. You can check whether anything has moved, and whether your device may be at risk.

If you installed something during a suspicious call

Treat that device as possibly compromised. Stop using it for wallets, exchange logins or email until it has been checked or reset.
From a different, trusted device, change passwords for your email, exchange and repository accounts, and review your 2FA settings.
Read the FBI's public advisory on protection and post-compromise steps. Reach it through the FBI's official site.
Contact your wallet provider or exchange only through its official website or in-app support.
Report the incident to your local police or national cybercrime authority.

Check the wallet on a public block explorer

Open the official block explorer for your chain by typing its address yourself. Do not use a link from a message.
Paste your public wallet address. This is safe to share and never gives anyone control.
Review recent outgoing transactions and look for any you do not recognise.
On EVM chains, check active token approvals with the explorer's own approval tool. Revoke ones you do not recognise, but only from a device you trust.
Repeat this check periodically. The reports say attackers sometimes waited a long time before acting.

If you also want a plain overview of what sits at a public address, you can Scan a wallet free. StuckScan is read-only and covers 20 chains. It shows what is in a wallet and what is staked, locked, pending, possibly stuck or ready to claim, with on-chain proof. It needs no wallet connection, no signing, and never asks for a seed phrase.

It cannot detect malware on your device. It also does not yet check bridges, most DeFi (except Aave v3), or Solana stake accounts on the web page.

Watch out for follow-up scams

High-profile news attracts copycat scams. Keep these rules in mind:

Nobody legitimate will ever ask for your seed phrase. Not the FBI, not an exchange, not a wallet provider, and not a "recovery service."
Nobody legitimate charges a fee to "unlock," "release" or "recover" funds.
Be wary of messages claiming you are owed part of seized funds, or that your wallet was "flagged" in the case.
Ignore unsolicited "security check" tools, browser extensions or apps promoted around this news.
Do not trust a video call just because the face looks familiar. That is exactly what this campaign exploited.

FAQ

Can I scan my wallet address to see if FaceStealer malware is on it?

No. Malware runs on your computer or phone, not on a blockchain address. You can check the address on a block explorer for unexpected transactions or approvals. To check the device itself, use the official FBI advisory and reputable security tools.

Is there a deadline to act?

None of the sources gives a deadline or block height. The attackers reportedly sometimes waited more than a year before striking. A past suspicious call is still worth taking seriously now.

I was on a call where someone sent a "fix" link, but I didn't click it. Am I affected?

The sources describe malware being installed through such links. They do not describe infection without installing something. Report the account to the contact through another channel, since their account may have been taken over.

Is FaceStealer the same as the Binance hack?

No. The DOJ announced them together, but they are separate cases. The FBI attributed the Binance hack to TraderTraitor, while FaceStealer is described as a social engineering campaign.

Key takeaways

You usually cannot spot a deepfake by eye. Verify unexpected calls through a separate, trusted channel.
The reported trap is a fake glitch followed by a "fix" link that installs malware. Never install software from a call.
Malware lives on devices, not wallet addresses. Check your address on an official block explorer and review token approvals.
The sources give no deadline, but attackers reportedly waited months or more than a year before striking.
Crypto and Web3 workers and open-source developers were the main reported targets.
No legitimate party asks for your seed phrase or a recovery fee.
BOTLAB is not affiliated with the FBI, the DOJ, Binance or the cited outlets.

General information, not financial advice. Crypto trading can lose money, including all capital. Check the official docs before you move funds.

Want these checks run on your own strategy? See the strategy and backtest audit.

More guides

Not sure where your crypto is? Paste a public address and see what is staked, locked, pending or ready to claim on 20 chains. Free and read-only, with no wallet connection.
Scan a wallet free