FBI Links $308M DMM Bitcoin Hack to North Korea’s TraderTraitor Group

The FBI has officially linked the devastating DMM Bitcoin hack to North Korea’s TraderTraitor hacking group, which allegedly has connections to the infamous Lazarus Group. In May, the cyberattack resulted in the theft of 4,502 Bitcoin, valued at $308 million, causing severe financial damage and the eventual shutdown of the Japanese crypto exchange.

The attack began with sophisticated social engineering tactics targeting Ginco, a Japanese cryptocurrency wallet company. Hackers posed as recruiters on LinkedIn, sending malicious links disguised as pre-employment tests hosted on GitHub. A Ginco employee unknowingly clicked the link, enabling the hackers to compromise their GitHub account. This access allowed the attackers to impersonate the employee in internal communications.

By May, the group exploited this access to manipulate a legitimate transaction request from a DMM Bitcoin employee. The stolen Bitcoin was swiftly transferred to wallets controlled by the hackers. Despite efforts by DMM Bitcoin to recover funds and compensate users through Bitcoin repurchases, the financial losses were insurmountable. As a result, the exchange announced its permanent closure and plans to transfer customer accounts to SBI VC Trade by March 2025.

This breach stands as one of Japan's most significant crypto thefts, second only to the 2018 Coincheck hack, where $530 million was stolen. The incident sheds light on the growing threat posed by North Korean cybercriminal groups in the cryptocurrency sector. In 2024 alone, these groups have been responsible for stealing $1.34 billion in crypto assets, representing about two-thirds of all global crypto thefts.

In July, the stolen funds were funneled through Huione Guarantee, a company operating in Cambodia. Reports from Chainalysis suggest the firm has been involved in pig butchering scams valued at approximately $49 billion. In response, Cambodia initiated a crackdown in December, blocking access to 16 cryptocurrency exchanges, including major platforms like Binance, Coinbase, and OKX.

Taylor Monahan, a security expert from MetaMask, emphasized the ongoing risk: “Crypto folks (hopefully) already know that Lazarus is one of the most prevalent threat actors targeting this industry. They rekt more people, companies, protocols than anyone else. But it’s good to know exactly how they get in. Because another smart contract audit won’t save you.”

This attack serves as a stark reminder of the persistent and evolving threat posed by North Korean cybercriminals. Their ability to exploit human error through social engineering and advanced infiltration techniques remains a serious challenge for the global cryptocurrency industry.