North Korean Cyber Scam Evokes Trust to Steal $300 Million from Crypto Executives

North Korean cyber criminals have executed a cunning social engineering scheme that has siphoned over $300 million from cryptocurrency executives by impersonating recognizable industry figures during counterfeit video calls, as detailed in a security warning from Taylor Monahan, a security researcher with MetaMask.

Key Takeaways

North Korean hackers have stolen $300 million by executing a social engineering scheme involving fake video calls.
The operation targets cryptocurrency executives using compromised Telegram accounts to gain victims' trust.
Attackers simulate technical problems to trick victims into downloading malicious software.
The malware gives hackers control over systems, enabling them to drain wallets and extract sensitive information.
Industry reports indicate North Korean actors have stolen around $2 billion from the cryptocurrency sector over the past year.

North Korean hackers hijack Telegram, stage fake Zoom calls and deploy RAT malware to drain crypto wallets in a $300m long‑con campaign.

The ‘Long Con’ of North Korean Hackers

Referred to as a “long con,” this operation specifically targets executives in the cryptocurrency sector by taking over secure communication channels, as noted by Monahan in the warning.

The attack initiates when hackers hijack a trusted Telegram account, often belonging to a venture capitalist or a conference participant known to the victim. The attackers utilize prior conversation history to establish credibility and subsequently invite victims to video calls on platforms like Zoom or Microsoft Teams through masked calendar links.

In these meetings, victims often see what appears to be a live video stream of their contact. This feed is usually a recycled clip from a podcast or public event, as mentioned in the alert.

The scam culminates when the impersonator feigns a technical issue. After mentioning problems with audio or video, the attacker prompts the victim to download a specific script or update a software development kit. This file harbors harmful software, according to Monahan.

Once installed, the malware—often a Remote Access Trojan (RAT)—grants hackers complete control over the victim's system. The RAT not only drains cryptocurrency wallets but also extracts sensitive information, including internal security protocols and Telegram session tokens, which are then leveraged to target more victims within the network.

Monahan pointed out that this operation “weaponizes professional courtesy,” taking advantage of the psychological pressures present in business meetings to lead victims to make poor decisions. The researcher cautioned that any request to download software during a call should be viewed as a clear signal of an ongoing attack.

The fake meeting tactic is a part of a larger strategy by North Korean operatives, who, according to industry reports, have pilfered an estimated $2 billion from the cryptocurrency sector in the last year, including notable breaches such as the Bybit incident.