DMM Bitcoin hack — May 2024
Incident facts
| Date of incident | (approximate) |
|---|---|
| Target type | Centralised exchange |
| Loss | $308,000,000Published estimates range $305,000,000 to $308,000,000Price at time of incident |
| Method | Social engineeringFake recruiter compromised an employee at wallet vendor Ginco, then altered a transaction request |
| Chains | Bitcoin |
| Attributed to | North Korea (TraderTraitor)Confirmed |
| Outcome | Project shut down |
What happened
The Japanese exchange DMM Bitcoin lost 4,502.9 BTC, worth about $305m to $308m, in late May 2024. The loss was disclosed on 31 May.
The route in was not DMM itself. In March 2024 a North Korean operator posing as a recruiter on LinkedIn approached an employee of Ginco, a Japanese wallet software company, and sent a malicious script framed as a pre-employment exercise. That employee had access to Ginco's wallet management system. By May the attackers were using stolen session data to impersonate them, and used that access to alter a legitimate transaction request made by a DMM employee.
The exchange could not absorb the loss. DMM Bitcoin announced in December 2024 that it would wind down, transferring customer accounts and custodial assets to SBI VC Trade.
The joint FBI, DC3 and Japanese National Police Agency statement of December 2024 attributes the theft to the group tracked as TraderTraitor, also known as Jade Sleet, UNC4899 and Slow Pisces. The exact date of the theft has not been published, so the disclosure date is used here.
Law enforcement
In December 2024 the FBI, the US Department of Defense Cyber Crime Center and Japan's National Police Agency issued a joint statement attributing the theft to North Korean actors tracked as TraderTraitor.
Sources
- Federal Bureau of InvestigationPrimary · retrieved 2026-08-01
- CoinDeskSecondary · retrieved 2026-08-01
- TechCrunchSecondary · retrieved 2026-08-01
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "DMM Bitcoin hack — May 2024", iTokenly, accessed 2026-08-01, https://itokenly.com/hacks/dmm-bitcoinhttps://itokenly.com/hacks/dmm-bitcoinPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.