North Korea’s state-backed hackers stole more than $400 million using a “highly effective social engineering scheme” involving identity theft and AI-powered fake video calls, the FBI said on Thursday.

The FBI this month accused hackers affiliated with North Korea of the theft of $6 billion from cryptocurrency platform Binance, a charge Pyongyang denies.

“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” said FBI Cyber Branch Operations Director Brett Leatherman.

The FBI said that, aside from the Binance hack, North Koreans have “aggressively [targeted] individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics”.

The scheme, which the American law enforcement agency dubbed “FaceStealer,” has led to the theft of more than $400m in the last 18 months.

FaceStealer hackers pretend to be someone known to the victim to lure them to a video meeting, using AI-powered deepfake video to gain trust. The hackers then “introduce a fake technical error” which requires the victim to click on a link or a prompt that installs malware.

By exploiting the victim’s contact lists, social media and communication apps, hackers can impersonate them to ensnare the next target.

“FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” said Patrick Grandy, assistant director at the FBI’s Los Angeles Field Office.

“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.

The FBI said it seized more than 900 webcam videos of FaceStealer victims.