Crypto Theft Can Begin Months Before Your Funds Disappear
Hackers copied crypto recovery phrases and waited for balances to grow before stealing funds, with some thefts occurring more than a year after the initial computer compromise.
The FBI’s November 12 advisory describes the delays in several reported cases involving FaceStealer, a North Korean scheme that uses hijacked accounts and fake video meetings to trick targets into installing malware.
The warning concerns people who may have followed malicious troubleshooting instructions long ago: an absence of unauthorized transfers does not establish that their wallet credentials remained private.
Key takeaways
- Copying a recovery phrase leaves no transaction for the owner to detect.
- A hijacked account and a genuine recording can make a malicious meeting appear familiar.
- Suspected victims need to address wallet control, account access and the risk to their contacts.
Why the wallet can look normal after the theft of a phrase
A recovery phrase lets compatible wallet software reconstruct the private keys used to authorize transactions. For a standard recovery-phrase wallet, someone with the phrase can restore access elsewhere without removing the owner’s access. Both can then hold the means to spend the funds.
Copying the phrase does not move cryptocurrency. A block explorer can show deposits and transfers, but it cannot show that another person has acquired the information needed to authorize a later withdrawal. An owner can therefore continue using the wallet while an attacker watches for a larger balance.
The advisory describes attackers doing precisely that. It gives no average waiting period or estimate of how often a compromise leads to delayed theft. Its finding is narrower: several reported cases involved theft and communication-account hijacking months to more than a year after the intrusion.
The exposure depends on what the attackers could access. A recovery phrase saved on an infected computer presents a different risk from a phrase that was never available to that device. A computer infection alone does not establish that every wallet the owner uses has lost its keys.
How a familiar contact delivers the fake fix
FaceStealer begins with access to a previous victim’s communication account. Attackers use that genuine account to approach contacts about a catch-up, collaboration or investment opportunity, then send a link to an imitation meeting service.
Inside the fake meeting, they play stolen webcam recordings to make recognizable people appear to be participating. They then claim that the target has an audio problem or needs an update. The proposed solution asks the target to download something, run a script or enter a command that installs malware.
The campaign still relies predominantly on genuine stolen recordings, although the advisory also describes synthetic video. The deception does not require an invented face: authentic footage is being used in a conversation the recorded person is not directing.
Authorities seized more than 900 victim webcam recordings during the disruption of FaceStealer infrastructure. The FBI attributes more than $400 million in cryptocurrency theft over 18 months to the scheme.
Cleaning the computer does not replace exposed wallet control
Removing malware can stop that software from continuing to operate on a device. It cannot retrieve a recovery phrase already copied elsewhere. Reinstalling a wallet application, changing its local password or restoring the same phrase on another computer leaves the underlying wallet credentials unchanged.
For an exposed recovery-phrase wallet, replacement means creating a wallet with a fresh phrase and moving the assets. Phantom’s migration guidance explains that its existing recovery-phrase wallets cannot simply be assigned a new phrase. It also advises checking tokens, collectibles, staked assets and DeFi positions, some of which require additional steps before they can be moved.
A migration therefore needs to account for more than the balance displayed on the wallet’s opening screen. The owner must identify the assets and positions still controlled by the exposed credentials and stop directing future payments to the old addresses.
Stolen accounts put the next contact at risk
Wallet access is only one use for the compromised device. FaceStealer attackers also obtain contact lists and chat histories, allowing them to tailor an approach around an earlier conversation. A message about an investment or meeting can arrive from the expected account and refer to a real relationship.
Recovering the account can interrupt that route to further victims, but contacts may already have received invitations or seen the owner’s recorded face. They need a warning through another established channel. Employers also need to know when a work device or work information may have been exposed, even if no cryptocurrency has disappeared.
For future meeting invitations: Open the official application independently and join with the meeting code. Confirm unusual requests through another established contact channel, and obtain updates separately rather than running scripts or commands supplied in chat.
Anyone who followed a suspicious “fix” months ago should reassess the credentials and accounts that were accessible then. That review determines whether funds need to move, account sessions need to end and contacts need a warning.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
