North Korean Cyber Actors Responsible for the $308 Million Bitcoin Heist from DMM.com, Say the FBI, DC3, and Japan’s NPA

This incident targeted the Japan-based crypto platform DMM.com. It highlights the growing threat of state-sponsored cybercrime that aims to steal digital assets.

The Federal Bureau of Investigation (FBI), Department of Defense Cyber Crime Center (DC3), and Japan’s National Police Agency (NPA) have attributed the $308 million Bitcoin (BTC) heist from DMM.com to North Korean cyber actors, also known as TraderTraitor, Jade Sleet, UNC4899, or Slow Pisces.

The theft, which occurred in May 2024, was part of a larger campaign targeting Japanese crypto platforms. The incident highlights the increasing threat of state-sponsored cybercrime aimed at stealing digital assets.

FBI’s Investigation Leads to North Korean Hackers

The FBI’s investigation revealed that the cyberattack began in March 2024 with a reconnaissance phase. A North Korean cyber actor posed as a recruiter and contacted an employee of Ginco, a Japan-based crypto wallet software company.

The attacker used LinkedIn to approach the employee and sent a false link claiming it was a pre-employment test. However, the link led to a Python script hosted on GitHub. Once downloaded, the script compromised the employee's system.

After gaining entry into the employee's system, the cyber actor exploited session cookie information, allowing them to impersonate the victim and gain further access to Ginco's insecure communications system.

On May 11, 2024, the attacker manipulated a legitimate transaction request from a DMM employee, sending 4,502.9 BTC, valued at $308 million at the time, into wallets controlled by the hackers.

The FBI report noted that the stolen funds were moved to wallets controlled by the TraderTraitor group, solidifying the connection between the cyber actor and the theft.

Community Reacts to DMM Bitcoin Hack, WazirX Debate EnsuesAs news of the DMM Bitcoin hack spread, some crypto community members began comparing it to other high-profile crypto thefts, such as the WazirX hack.

In response to an X article covering the DMM hack, Pushpendra Singh, founder of PushpendraTech and SmartViewAi, asked if the incident could justify other events. He highlighted the need to focus on user withdrawals in such cases.

“Bro this can’t justify wazirx hack. We have to focus on user withdrawal’s .”

Meanwhile, Nischal Shetty, Co-Founder of WazirX, commented on the legal proceedings surrounding the crypto exchange's assets. He stated that creditors will be left to decide on the distribution of assets, especially in cases like the WazirX hack.

“Creditors will have to decide on the asset distribution scheme. Especially in cases like ours. If majority votes in favor of a particular scheme then the liquid assets can be disbursed according to the terms of that scheme.”

The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.