日本和 FBI 將北韓列為從 DMM 竊取比特幣的一方，這是北韓迄今為止盜竊加密貨幣的摘要

2024 年 12 月 24 日，國家警察廳、聯邦調查局等宣布，他們已確定約 48

On December 24, 2024, the National Police Agency, the Tokyo Metropolitan Police Department, the FBI, and others announced that TraderTraitor, a division of the North Korean government-affiliated cyber attack group Lazarus Group, was involved in the recent Bitcoin leak. It all started in March 2024, when TraderTraitor impersonated a recruiter on LinkedIn and contacted an employee of Ginco, who had been entrusted with managing DMM Bitcoin wallets. TraderTraitor sent the employee a URL to a malicious Python script disguised as a recruitment test and had the employee copy the code onto his own GitHub page. Starting in May 2024, TraderTraitor misused session cookie information that controls access permissions, impersonating the relevant employees and illegally accessing Ginco's communications system. It then used this access to tamper with legitimate cryptocurrency transaction requests made by DMM Bitcoin employees and stole bitcoins. It then transferred the stolen bitcoins to a wallet managed by TraderTraitor.

2024 年 12 月 24 日，國家警察廳、東京警察廳、聯邦調查局等機構宣布，北韓政府附屬網路攻擊組織 Lazarus Group 的一個部門 TraderTraitor 參與了最近的比特幣洩漏事件。這一切都始於 2024 年 3 月，當時 TraderTraitor 在 LinkedIn 上冒充招募人員，聯繫了 Ginco 的一名員工，該員工曾被委託管理 DMM 比特幣錢包。 TraderTraitor 向該員工發送了一個偽裝成招募測試的惡意 Python 腳本的 URL，並讓該員工將程式碼複製到他自己的 GitHub 頁面上。從2024年5月開始，TraderTraitor濫用控制存取權限的會話cookie訊息，冒充相關員工非法存取Ginco的通訊系統。然後，它利用此存取權限篡改 DMM Bitcoin 員工提出的合法加密貨幣交易請求並竊取比特幣。然後，它將被盜的比特幣轉移到 TraderTraitor 管理的錢包。

This incident began on May 31, 2024, when the unauthorized leakage of Bitcoin was detected from a DMM Bitcoin wallet. The total amount of Bitcoin confirmed to have been illegally leaked was 4,502.9 BTC (equivalent to approximately 48.2 billion yen), and on June 5, 2024, DMM revealed plans to raise approximately 55 billion yen to fully cover the amount of the illegally leaked Bitcoin. In August 2024, DMM Group Chairman Keiji Kameyama stated , 'We apologize for the great inconvenience caused to Bitcoin users,' and 'We will continue to disclose any information on the cause, etc. as soon as it becomes available.' 'DMM Bitcoin' announces that it will raise approximately 55 billion yen to guarantee the full amount of illegally leaked bitcoins - GIGAZINE

該事件始於 2024 年 5 月 31 日，當時從 DMM 比特幣錢包中偵測到未經授權的比特幣洩漏。確認非法洩漏的比特幣總量為 4,502.9 BTC（約 482 億日圓），2024 年 6 月 5 日，DMM 透露計劃籌集約 550 億日元，以完全覆蓋非法洩露的比特幣金額。 2024 年 8 月，DMM 集團董事長龜山敬二表示，“對於給比特​​幣用戶造成的巨大不便，我們深表歉意”，並且“我們將在獲得有關原因等的任何信息後立即披露”。 「DMM Bitcoin」宣布將籌集約550億日元，以確保非法洩露的比特幣的全額 - GIGAZINE

Subsequently, on September 26, 2024, the Kanto Regional Financial Bureau issued an administrative disposition to DMM Bitcoin, including an order to improve its business practices, pursuant to Article 63-16 of the Payment Services Act . This administrative disposition required DMM Bitcoin to analyze and clarify the specific facts and root causes of the unauthorized leakage of Bitcoin, respond to customers, and strengthen its system risk management system. Since the unauthorized leak occurred, DMM Bitcoin has been restricting its services, such as screening new account openings, suspending virtual currency withdrawal processing, and suspending spot trading buy orders, but has announced that it will transfer customer accounts and assets under custody to SBI VC Trade on December 1, 2024. DMM Bitcoin also reported that it plans to discontinue its business after the transfer is completed around March 2025. [IMPORTANT] Basic agreement regarding the transfer of accounts and assets held by SBI VC Trade - DMM Bitcoin (2024/12/02) https://bitcoin.dmm.com/news/20241202_01

隨後，2024 年 9 月 26 日，關東地方金融局根據《支付服務法》第 63-16 條，對 DMM Bitcoin 發布了行政處分，包括命令改善其商業行為。此行政處理要求DMM Bitcoin分析並澄清比特幣未經授權洩漏的具體事實和根本原因，回應客戶，並強化系統風險管理系統。自從發生未經授權的洩密事件以來，DMM Bitcoin一直在限制其服務，例如篩選新開戶、暫停虛擬貨幣提款處理、暫停現貨交易買單，但宣布將把客戶帳戶和託管資產轉移給SBI VC於2024年12 月1 日進行交易。 / 12/02) https://bitcoin.dmm.com/news/20241202_01

After that, the American analysis company Chainalysis published the results of its investigation that the unauthorized access to DMM Bitcoin was linked to a North Korean cyber attack group. When Chainalysis traced the stolen cryptocurrency, it was revealed that the group had been laundering the money by using a service called ' Mixer ' that anonymizes transaction history and then funneling it to the Cambodian online marketplace 'Huione Guarantee.' The theft of virtual currencies through cyber attacks from North Korea has beensteadily increasing since 2017, and in December 2022, South Korea's intelligence agency, the National Intelligence Service, reported the results of an investigation stating that 'North Korean cyber attack groups stole 8,000 billion won (approximately 86 billion yen) of virtual currencies and other assets in 2022 alone, totaling 1.5 trillion won (approximately 162 billion yen) over the five years from 2017.' In North Korea, the income generated by theft of virtual currencies is one of the main sources of income for the regime , and it has been pointed out that the stolen virtual currencies are being used for the development of ballistic missiles and weapons of mass destruction. The terrifying reality that North Korea is funding its weapons development program through cyber-attacks and cryptocurrency heists - GIGAZINE

此後，美國分析公司Chainaanalysis公佈調查結果稱，未經授權存取DMM比特幣與北韓網路攻擊組織有關。當 Chainaanalysis 追蹤被盜的加密貨幣時，發現該組織一直在使用名為「Mixer」的服務來洗錢，該服務可以匿名化交易歷史，然後將其轉移到柬埔寨線上市場「Huioneguarantee」。自2017年以來，透過北韓網路攻擊竊取虛擬貨幣的事件不斷增加，2022年12月，韓國情報機構國家情報院公佈的調查結果稱，「北韓網路攻擊組織竊取了8兆韓元」僅在2022 年，虛擬貨幣和其他資產的價值就達到了1.5 兆韓元（約860 億日圓），從2017 年起的五年內總計達到1.5 兆韓元（約1,620 億日圓）。在朝鮮，盜竊虛擬貨幣所產生的收入是政權的主要收入來源之一，有人指出，被盜的虛擬貨幣正被用於開發彈道飛彈和大規模殺傷性武器。北韓透過網路攻擊和加密貨幣搶劫為其武器開發計畫提供資金的可怕現實 - GIGAZINE

Additionally, cryptocurrency trading platform Hyperliquid reported on December 23, 2024 that addresses and signs of activity used by North Korean hackers to test potential security bugs had been found.

此外，加密貨幣交易平台 Hyperliquid 於 2024 年 12 月 23 日報告稱，已發現北韓駭客用於測試潛在安全漏洞的地址和活動跡象。

DPRK's trading career is...uh....going....???? tbh if i was the dude Hyperliquid's 4 validators (or those fucking ghetto ass binaries on gh) I would be shitting my pants right now. Hyperliquid dudes dont seem worried at all though so im sure its fine. ???? pic.twitter.com/JrrU7t1sJe

北韓的貿易生涯正在……呃……進行……？說實話，如果我是 Hyperliquid 的 4 個驗證者（或者 gh 上那些該死的貧民區二進位），我現在就會拉褲子了。高流動性的傢伙似乎一點也不擔心，所以我確信它沒問題。 ???? pic.twitter.com/JrrU7t1sJe

Security expert Taylor Monahan said, 'We found no signs of funds being leaked or misused

安全專家泰勒莫納漢表示：「我們沒有發現資金被洩露或濫用的跡象