DMM Bitcoin Hack
Reported loss
$305M
Private Key Compromised (Unknown Method)
What happened
DMM Bitcoin lost 4,502.9 BTC in May 2024, valued by the FBI at $308 million. The FBI, DC3 and Japan's National Police Agency attributed the theft to North Korean TraderTraitor actors. Investigators said access obtained through a compromised Ginco employee was likely used to manipulate a DMM transaction request.
Technical root cause
The FBI describes a supplier employee compromise and session impersonation, followed by likely transaction-request manipulation. Its statement does not establish the precise signing failure or confirm theft of a private key.
How it happened
- A fake recruiter sent a Ginco employee a GitHub-hosted Python script disguised as a hiring test in March 2024; the employee was subsequently compromised.
- After mid-May, the actors used session-cookie information to impersonate the employee and access Ginco communications.
- Investigators assessed that this access likely enabled manipulation of a legitimate DMM employee's transaction request.
- The stolen BTC ultimately reached TraderTraitor-controlled wallets.
Protocol details
Classification
Infrastructure / CeFi / Social Engineering
Protocol Type
Exploit/Access control
Protocol links
Website
@DMM_Bitcoin
Evidence
- report @Cointelegraph incident report x.com
- report @BeosinAlert incident report x.com
- analysis Website reference halborn.com
- analysis DeFiLlama defillama.com
- analysis FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com fbi.gov
- analysis Press Conference by SUZUKI Shunichi (June 4, 2024) fsa.go.jp
- analysis Administrative action against DMM Bitcoin Co., Ltd. lfb.mof.go.jp
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
