← Back to archive
Hack·resolved

DMM Bitcoin Hack — May 2024

The Japanese exchange lost approximately $305M of BTC to a private-key compromise attributed by the FBI to North Korea's TraderTraitor (Lazarus). DMM covered customer balances and wound down operations in 2025.

DMM Bitcoin was a Japanese crypto exchange founded in 2018 as a subsidiary of the diversified DMM Group. It operated under Japanese Financial Services Agency oversight.

On 31 May 2024 the exchange disclosed an unauthorised transfer of 4,502.9 BTC from one of its addresses. The disclosed cause was inadequate protection of access to wallet-management systems; technical details have not been publicly released. DMM Bitcoin immediately announced it would cover all customer balances at the exchange's expense — funded through a parent-group capital injection of approximately ¥55B.

In December 2024 the FBI, Japan's National Police Agency, and the Department of Defense Cyber Crime Center jointly attributed the attack to TraderTraitor, a North Korean state-sponsored cluster operating under the umbrella of the Lazarus Group. The attribution noted the use of social-engineering attacks against personnel of Ginco — DMM Bitcoin's wallet-software provider — as the initial access vector.

Also in December 2024 DMM Bitcoin announced that it would transfer customer accounts and balances to SBI VC Trade and wind down its operations. The transfer completed in April 2025; DMM Bitcoin formally ceased operations the same month.

Timeline

  1. 4,502.9 BTC drained

    Unauthorised transfer from DMM Bitcoin address to attacker-controlled wallet. ~$305M at the time.

  2. DMM discloses theft, commits to full reimbursement

    Parent DMM Group capitalises a ¥55B reimbursement fund.

  3. FBI / NPA / DC3 attribute attack to TraderTraitor (Lazarus)

    Joint statement names North Korean state actors; initial access via social engineering of Ginco wallet-software personnel.

  4. DMM Bitcoin announces wind-down

    Customer accounts and balances to be transferred to SBI VC Trade. Exchange will cease operations after transfer.

  5. Wind-down completes

    All customers transferred; DMM Bitcoin formally ceases operations.

Who was involved

Structural failures identified