Blockchain
North Korean hackers steal $308M in Bitcoin from DMM Bitcoin using bold cyber ta...
Japanese and U.S. authorities have officially attributed the theft of $308 million in cryptocurrency from the Japan-based cryptocurrency firm, DMM Bitcoin, to North Korean cybercriminals. The incident, which occurred in May 2024, was linked to the TraderTraitor threat activity, also tracked under aliases such as Jade Sleet, UNC4899, and Slow Pisces.
_“The theft is affiliated with TraderTraitor threat activity, which is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously,”_ stated the U.S. Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center, and the National Police Agency of Japan in a joint alert.
DMM Bitcoin, which recently ceased its operations, suffered one of the largest crypto heists this year. The company’s closure came shortly after the May 2024 attack, raising speculation that the financial and reputational damage from the heist significantly contributed to its decision to shut down.
---
## How the Heist Pulled Off!!!
The heist unfolded in three distinct phases, starting with a targeted employee compromise, followed by lateral movement within the organization, and culminating in the large-scale theft of funds.
### Phase 1: Initial Compromise
In March 2024, an employee at Ginco, a Japan-based cryptocurrency wallet software company, became the first victim. Threat actors impersonated a recruiter and sent the employee a URL to a malicious Python script hosted on GitHub as part of a purported pre-employment test. The employee, who had access to Ginco’s wallet management system, unknowingly compromised their credentials by copying the malicious Python code to their personal GitHub page.
### Phase 2: Escalation and Lateral Movement
By mid-May 2024, the adversaries exploited session cookie information to impersonate the compromised employee. This access allowed them to infiltrate Ginco’s unencrypted communications system, setting the stage for the next phase of the attack.
### Phase 3: Execution of the Heist
In late May 2024, the threat actors manipulated a legitimate transaction request from a DMM Bitcoin employee. This led to the unauthorized transfer of 4,502.9 BTC, valued at $308 million at the time. The stolen funds were swiftly moved to TraderTraitor-controlled wallets.
---
## Fund Laundering
The blockchain intelligence firm Chainalysis confirmed the involvement of North Korean hackers in the DMM Bitcoin breach. Their analysis revealed that the attackers exploited vulnerabilities in the company’s infrastructure to execute unauthorized withdrawals.
The stolen funds were transferred through intermediary addresses and obfuscated using a Bitcoin CoinJoin Mixing Service, which blends transactions to make tracing funds challenging. After mixing, portions of the funds passed through bridging services and were funneled to HuiOne Guarantee, an online marketplace linked to the Cambodian conglomerate HuiOne Group, previously exposed for facilitating cybercrimes. Similar methods have been used in other incidents, like the Axie Infinity hack, where stolen funds were laundered across multiple platforms to evade detection.
---
## What are the Possible Implications
The attack highlights the persistent threat posed by North Korean cyber actors, who have consistently targeted the cryptocurrency sector to fund their regime. The use of advanced social engineering techniques and malware underscores the need for organizations to bolster their cybersecurity defenses. Companies should consider implementing multi-factor authentication, conducting regular security training for employees, and monitoring network activity for anomalous behavior to mitigate such risks.
Authorities worldwide must remain vigilant, as North Korean cyber actors show no signs of slowing down their targeted campaigns on the cryptocurrency and financial sectors. Organizations should prioritize proactive measures such as implementing zero-trust security frameworks, conducting regular penetration testing, and investing in advanced threat detection systems to mitigate risks effectively.
