Fake Zoom Patch Scam Drains $300M in Crypto, SEAL Warns

Crypto News Exploits

Fake Zoom Patch Scam Drains $300 Million in Crypto, SEAL Warns

Written by Aaron S.,

Editor-In-Chief

Last Updated: December 15, 2025

Key Takeaways

North Korean hackers use fake Zoom calls via Telegram to install malware that steals passwords and crypto keys, which causes over $300 million in losses;
Victims should disconnect devices, move crypto to new wallets, reset passwords, enable 2FA, and wipe memory after exposure;
The scam spreads through hijacked Telegram accounts; users must secure their accounts, end sessions, and warn their contacts immediately.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Fake Zoom Patch Scam Drains $300 Million in Crypto, SEAL Warns

BITDEGREE IN YOUR SOCIAL FEED

Security Alliance (SEAL) reported that a scam involving deceptive Zoom sessions linked to North Korean hackers has become a widespread threat.

SEAL revealed that victims first receive messages via Telegram that appear to come from known contacts.

Once the meeting begins, the attackers pretend there are audio problems. They then send a fake Zoom patch that secretly infects devices with malware when victims open it.

What Is Tether? (USDT SIMPLY Explained With Animations)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

That software captures sensitive details such as passwords and private cryptographic keys, which can potentially drain crypto funds.

Security researcher Taylor Monahan estimates that this scam has already resulted in losses of over $300 million in digital assets.

Monahan warned that if a suspicious link is clicked during one of these fake calls, disconnecting the device from Wi‑Fi and powering it off should be the first step.

Additionally, transferring any remaining crypto to fresh wallets using a different device, updating all passwords, enabling two‑factor authentication (2FA), and performing a complete memory wipe are essential precautions.

Securing the Telegram account used in the scam is also critical. That includes reviewing connected devices in settings, ending all other sessions, changing the password, and enabling stronger authentication.

The scam spreads when attackers access a Telegram account and use its contact list to keep finding new victims. Monahan emphasizes that individuals whose accounts are compromised must immediately alert contacts to avoid further harm.

Recently, a San Jose widow lost nearly $1 million after trusting a man she met online who lured her into a fake crypto investment. How did the incident happen? Read the full story.