FBI says North Korean hackers took about $400 million in crypto over 18 months

Hackers from North Korea stole roughly $400 million in cryptocurrency over a period of 18 months, according to the FBI. The Israeli news service News.co.il reported the FBI's announcement, describing it as a wide-ranging cyber campaign and saying the investigation is still going on.

The Jerusalem Post, citing the FBI, described the hackers as state-backed and put the total at more than $400 million. News.co.il said the attackers relied mainly on video footage gathered covertly, which they used to mislead victims and gain access to their systems.

How the theft was carried out

The reports give only an outline of the method. According to News.co.il, the central technique was a sophisticated use of video that had been obtained in secret. That footage was used for two purposes: to deceive the people being targeted, and to break into the computer systems they controlled.

Neither report explains whose video was used, how it was obtained, or what form the deception took. Attacks of this broad kind, in which the weak point is a person who is tricked rather than a flaw in software, are commonly called social engineering. The reports do not say which individuals, companies or platforms lost funds.

Who is making the claim

The attribution comes from the Federal Bureau of Investigation (FBI), the main federal law enforcement agency of the United States, which also has responsibility for domestic counterintelligence and investigates major cybercrime. Both reports present the figures and the North Korean link as the FBI's findings. Neither outlet says it has seen the underlying evidence, and no response from North Korea is included in either report.

The Jerusalem Post's description of the group as state-backed means the FBI links the hackers to the North Korean government rather than treating them as independent criminals. News.co.il referred to the operation as Pyongyang's, using the name of the North Korean capital as shorthand for the government there.

Why cryptocurrency

Cryptocurrencies are digital assets that move across networks without passing through a traditional bank. Once a thief controls the access credentials for a wallet or an exchange account, funds can be transferred quickly and across borders. That makes the people and systems holding those credentials attractive targets, and it is why deceiving an individual can be as damaging as defeating a technical defence.

Where the reports differ

The two accounts agree on the core facts: the FBI is the source, the hackers are North Korean, and the stolen assets were cryptocurrency worth around $400 million. They differ on the exact size of the figure. News.co.il said about $400 million was taken, while The Jerusalem Post said more than $400 million. Only News.co.il gives the 18 month timeframe and the detail about covertly obtained video. The Jerusalem Post's text, as available to us, breaks off before describing the method, so we cannot say whether it supports that account.

The Jerusalem Post illustrated its story with a file image of hacker code dated October 30, 2026, credited to Reuters. It is a generic illustration and not a picture of the attack itself.

What the reports do not say

• Who the victims were, and whether any of the stolen cryptocurrency has been recovered or frozen.
• When the 18 month period began and ended.
• What evidence the FBI relied on to link the hackers to North Korea, and whether any individuals have been named or charged.
• How the secret video footage was obtained and exactly how it was used against victims.
• Any response from North Korea to the allegation.

News.co.il said the investigation is continuing, so further detail may follow from the FBI.