{"investigation":{"slug":"dmm-bitcoin","entity_name":"DMM Bitcoin","trust_score":52,"severity_base":null,"score_modifier":42,"confidence":1,"status":"published","content_type":"investigation","summary":"DMM Bitcoin was a licensed Japanese cryptocurrency exchange operated by DMM Group (DMM.com) that launched in January 2018. In May 2024 it suffered the eighth-largest crypto theft in history when North Korean state-sponsored hackers attributed to the TraderTraitor subgroup of Lazarus Group stole 4,502.9 BTC (approximately $305–308 million USD) through a sophisticated supply-chain attack targeting Ginco, a third-party wallet management provider. Following the hack, Japan's Financial Services Agency issued a business improvement order, the exchange restricted operations, and in December 2024 announced full closure with all customer assets transferred to SBI VC Trade by March 2025.","sections":[{"content":"DMM Bitcoin Co., Ltd. was a licensed cryptocurrency exchange operating under the umbrella of DMM Group (DMM.com), a large Japanese internet conglomerate founded in 1999 and headquartered in Tokyo. DMM.com's business interests span e-commerce, digital entertainment, foreign exchange (DMM FX), and financial services. DMM Bitcoin launched its trading platform on January 10, 2018, offering both spot and leverage trading across multiple cryptocurrencies including Bitcoin, Ethereum, and XRP. The exchange was registered with Japan's Financial Services Agency (FSA) and operated under the Payment Services Act, making it a fully licensed entity under Japanese financial law. At the time of the hack it served a substantial retail customer base and was considered a mid-tier exchange within the Japanese market.","heading":"Background","sources":[{"url":"https://www.financemagnates.com/cryptocurrency/news/dmm-bitcoin-coming-january/","name":"","type":"other","credibility":3},{"url":"https://www.forexgdp.com/news/crypto-exchange-farewell/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 31, 2024, DMM Bitcoin publicly confirmed that 4,502.9 BTC — then valued at approximately $305 million USD — had been illegally transferred from its wallets in an unauthorized outflow. The hack is ranked among the eight largest cryptocurrency thefts in history according to blockchain analytics firm Elliptic, and was the largest single crypto hack of 2024.\n\nThe FBI, the U.S. Department of Defense Cyber Crime Center (DC3), and Japan's National Police Agency (NPA) jointly attributed the theft on December 23, 2024, to North Korean cyber actors operating under the designation TraderTraitor, also tracked as Jade Sleet, UNC4899, and Slow Pisces — a financially motivated subgroup of the Lazarus Group sponsored by North Korea's Reconnaissance General Bureau (RGB).\n\nThe attack was multi-stage and began in late March 2024, when a TraderTraitor operative posing as a recruiter on LinkedIn contacted a software developer employed at Ginco, a Tokyo-based enterprise cryptocurrency wallet software company that managed transaction systems on behalf of DMM Bitcoin. The operative sent the Ginco employee a URL linking to a malicious Python script hosted on GitHub, framed as a pre-employment coding challenge. The employee copied the script to their personal GitHub page, unknowingly exposing session cookie data and credentials to the attackers.\n\nBy mid-May 2024, the attackers leveraged the harvested session cookies to impersonate the compromised Ginco employee and gained unauthorized access to Ginco's internal communications infrastructure, which was reportedly unencrypted. In late May 2024, the threat actors exploited this internal access to manipulate a legitimate transaction request submitted by a DMM Bitcoin employee, rerouting 4,502.9 BTC to attacker-controlled wallets. The funds were drained from a single wallet.\n\nThe attack vector — targeting a third-party vendor's employee via social engineering rather than directly breaching the exchange — exemplifies a supply-chain compromise technique that has become a hallmark of North Korean cyber operations in the cryptocurrency sector.","heading":"The $305M Lazarus Hack","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2024/05/31/hackers-steal-305-million-from-dmm-bitcoin-crypto-exchange/","name":"","type":"other","credibility":3},{"url":"https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2024/05/31/japanese-crypto-exchange-dmm-bitcoin-suffers-305m-hack","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/fbi-reveals-dmm-crypto-hack-300m-north-korea","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain analysts tracked the movement of the 4,502.9 BTC stolen from DMM Bitcoin through a series of obfuscation techniques consistent with prior Lazarus Group operations.\n\nThe primary laundering method employed was a peel chain strategy, in which stolen funds were split and transferred across hundreds of intermediate wallet addresses in progressively smaller increments — beginning at approximately 499 BTC per hop and declining to 10–20 BTC increments — to frustrate blockchain tracing. Funds were then deposited into Bitcoin CoinJoin mixing services to sever the transaction chain.\n\nFollowing mixing, on-chain investigator ZachXBT reported in July 2024 that over $35 million from the stolen funds had been bridged from Bitcoin to other blockchain networks (including Ethereum and Avalanche) via the cross-chain liquidity protocol THORChain, converted to USDT, bridged to the Tron network, and transferred to Huione Guarantee — a Cambodian online marketplace subsequently identified by the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) as a financial institution of primary money laundering concern with $11 billion in on-chain flows largely tied to illicit activity.\n\nZachXBT publicly shared 538 wallet addresses linked to the operation, identifying Lazarus Group laundering techniques as the basis for attribution prior to the official FBI statement. Tether (USDT issuer) responded to the intelligence by blacklisting a Tron wallet address on July 12, 2024, freezing approximately $28.2–$30 million in USDT linked to Huione addresses connected to the laundering chain.\n\nChainalysis independently confirmed the North Korean attribution and traced the flow of funds through the CoinJoin mixer before their movement to HuiOne Guarantee. TRM Labs also stated the hack bore hallmarks consistent with North Korean operational patterns. The timing obfuscation, use of mixers, peel chains, and cross-chain bridging to USDT on Tron are all documented Lazarus Group laundering signatures.","heading":"On-Chain Evidence","sources":[{"url":"https://cointelegraph.com/news/lazarus-group-suspected-moving-stolen-funds-dmm-bitcoin-hack","name":"","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-dmm-flow-of-funds-analysis","name":"","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/","name":"","type":"other","credibility":3},{"url":"https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/lazarus-transfers-funds-from-dmm-bitcoin-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Japan's Financial Services Agency (FSA), operating through the Kanto Local Finance Bureau, issued a formal business improvement order against DMM Bitcoin in September 2024 under Article 63-16 of the Payment Services Act. The order cited multiple governance failures including the concentration of authority within a single team responsible for both system operations and security — a structural oversight that regulators determined contributed to the conditions enabling the hack.\n\nDMM Bitcoin was required to submit a comprehensive business improvement plan to the FSA by October 28, 2024, detailing specific measures to prevent recurrence and an implementation timeline.\n\nThe breach and subsequent FSA action prompted broader regulatory reform in Japan. The FSA announced plans to require all third-party cryptocurrency custody and trading management firms (such as Ginco) to register with regulators before offering services to licensed exchanges — a direct policy response to the supply-chain vector exploited in the DMM attack. Additionally, the FSA announced plans to submit legislation to parliament in 2026 that would mandate crypto exchanges maintain liability reserves for hack-related losses, mirroring reserve requirements applicable to traditional securities firms.","heading":"Regulatory Response (FSA Japan)","sources":[{"url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/380286/japan-crypto-exchange-reserve-mandate","name":"","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/japans-fsa-require-crypto-exchanges-050024196.html","name":"","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/japan-fsa-weighs-registration-rules-095902067.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the May 2024 hack, DMM Bitcoin immediately restricted multiple services including cryptocurrency withdrawals and new spot purchase orders. The exchange explored raising capital to cover customer losses and pledged to restore the full value of stolen BTC by acquiring equivalent Bitcoin with assistance from its parent group.\n\nHowever, the financial and reputational damage proved insurmountable. On December 2, 2024, DMM Bitcoin formally announced it would cease all operations and transfer all customer accounts and assets — both Japanese yen holdings and cryptocurrency balances — to SBI VC Trade, a cryptocurrency exchange operated by SBI Group, one of Japan's largest financial conglomerates.\n\nThe asset and account transfer was completed on or around March 8, 2025. Customers did not need to take action as accounts were opened automatically with SBI VC Trade. Margin trading positions were excluded from the transfer; customers with open leveraged positions were required to settle prior to the transfer date. SBI VC Trade simultaneously added 14 new cryptocurrency spot trading pairs inherited from DMM's offerings, including TRX, SAND, ALGO, and MKR.\n\nDMM Bitcoin's closure represents one of the most significant exchange failures in Japanese crypto history, second in scale only to the Coincheck hack of January 2018, which resulted in approximately $523 million in NEM token losses.","heading":"Exchange Shutdown","sources":[{"url":"https://www.coindesk.com/business/2024/12/02/japanese-crypto-exchange-dmm-bitcoin-to-shut-down-after-305-m-hack","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/328890/japanese-exchange-dmm-bitcoin-to-shut-down-transfer-assets-to-sbi-group-unit-after-300-million-hack","name":"","type":"other","credibility":3},{"url":"https://cryptopotato.com/sbi-vc-trade-completes-acquisition-of-hacked-crypto-exchange-dmm-bitcoin-assets/","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/294452/japanese-crypto-exchange-shut-down-300m-hack-transfer-accounts-sbi","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"DMM Bitcoin is rated with a trust score of 10/100, reflecting that it is a defunct exchange responsible for one of the largest cryptocurrency security failures in history. The exchange is no longer operational as of March 2025 and no longer poses a direct counterparty risk to new users.\n\nKey risk factors assessed:\n\n1. Catastrophic security failure: The loss of 4,502.9 BTC ($305–308M) in a single unauthorized transaction represents a total failure of transaction authorization controls and third-party vendor oversight.\n\n2. Supply-chain vulnerability: DMM Bitcoin outsourced wallet management to Ginco without adequate oversight of Ginco's security posture, communications encryption, or employee security practices — a critical governance gap exploited by a state-level threat actor.\n\n3. State-sponsored threat attribution: The attack was formally attributed by the FBI, U.S. DC3, and Japan's NPA to TraderTraitor/Lazarus Group, a North Korean state-sponsored cyber operation with a documented history of large-scale cryptocurrency theft totaling billions of dollars across multiple incidents.\n\n4. Regulatory sanction: The FSA business improvement order confirms that regulators identified systemic governance and security control failures at the exchange.\n\n5. Fund recovery: Stolen funds have not been recovered. A significant portion was laundered through mixing services and Huione Guarantee. Tether froze approximately $28–30M in linked USDT addresses, representing a small fraction of total losses.\n\n6. Customer impact: Customer assets were ultimately protected through the SBI VC Trade transfer, which is a mitigating factor. However, the inability to withdraw funds for an extended period following the hack caused documented customer hardship.\n\nUsers encountering any entity claiming to be a successor to or affiliated with DMM Bitcoin should exercise extreme caution and verify independently against SBI VC Trade's official communications.","heading":"Risk Assessment","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom","name":"","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/","name":"","type":"other","credibility":3},{"url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018-01-10","event":"DMM Bitcoin launches trading platform under DMM Group, offering spot and leverage trading in Japan.","source":""},{"date":"2024-03","event":"TraderTraitor operative posing as a LinkedIn recruiter contacts a Ginco employee and delivers a malicious Python script disguised as a pre-employment coding challenge.","source":"","date_original":"2024-03-01"},{"date":"2024-05","event":"Attackers exploit harvested session cookies to impersonate the compromised Ginco employee and access Ginco's unencrypted internal communications system.","source":"","date_original":"2024-05-01"},{"date":"2024-05-31","event":"4,502.9 BTC (approximately $305–308 million) is illegally transferred from DMM Bitcoin wallets via manipulation of a legitimate DMM employee transaction request. DMM Bitcoin publicly confirms the breach.","source":""},{"date":"2024-07-12","event":"Tether blacklists a Tron wallet address linked to the laundering chain, freezing approximately $28–30 million in USDT connected to Huione Guarantee.","source":""},{"date":"2024-07-15","event":"ZachXBT publicly reports over $35 million from the DMM Bitcoin hack has been laundered through Huione Guarantee in Cambodia, identifying Lazarus Group laundering signatures.","source":""},{"date":"2024-09","event":"Japan's FSA (Kanto Local Finance Bureau) issues a formal business improvement order against DMM Bitcoin under Article 63-16 of the Payment Services Act, citing concentrated authority in operations and security as a systemic failure.","source":"","date_original":"2024-09-01"},{"date":"2024-10-28","event":"FSA deadline for DMM Bitcoin to submit a business improvement plan with specific measures and implementation timeline.","source":""},{"date":"2024-12-02","event":"DMM Bitcoin announces it will cease all operations and transfer all customer accounts and assets to SBI VC Trade by March 2025.","source":""},{"date":"2024-12-23","event":"The FBI, U.S. DC3, and Japan's NPA issue a joint public statement formally attributing the DMM Bitcoin theft to North Korean cyber actors operating as TraderTraitor (also tracked as Jade Sleet, UNC4899, Slow Pisces).","source":""},{"date":"2025-03-08","event":"SBI VC Trade completes transfer of all DMM Bitcoin customer accounts and assets. DMM Bitcoin ceases operations entirely.","source":""}],"sources_used":[{"url":"https://www.financemagnates.com/cryptocurrency/news/dmm-bitcoin-coming-january/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260829151625/https://www.financemagnates.com/cryptocurrency/news/dmm-bitcoin-coming-january/","credibility":3,"archive_timestamp":"2026-08-29T15:16:25+00:00"},{"url":"https://www.forexgdp.com/news/crypto-exchange-farewell/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom","name":"","type":"other","archive_url":"http://web.archive.org/web/20260812004132/https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom","credibility":3,"archive_timestamp":"2026-08-12T00:41:32+00:00"},{"url":"https://techcrunch.com/2024/05/31/hackers-steal-305-million-from-dmm-bitcoin-crypto-exchange/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829142236/https://techcrunch.com/2026/08/28/is-the-best-way-to-watch-a-movie-on-a-pair-of-sunglasses/?sidebar=a","credibility":3,"archive_timestamp":"2026-08-29T14:22:36+00:00"},{"url":"https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20260813050324/https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html","credibility":3,"archive_timestamp":"2026-08-13T05:03:24+00:00"},{"url":"https://www.coindesk.com/business/2024/05/31/japanese-crypto-exchange-dmm-bitcoin-suffers-305m-hack","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/fbi-reveals-dmm-crypto-hack-300m-north-korea","name":"","type":"other","archive_url":"http://web.archive.org/web/20260315171724/https://cointelegraph.com/news/fbi-reveals-dmm-crypto-hack-300m-north-korea","credibility":3,"archive_timestamp":"2026-03-15T17:17:24+00:00"},{"url":"https://cointelegraph.com/news/lazarus-group-suspected-moving-stolen-funds-dmm-bitcoin-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260217060321/https://cointelegraph.com/news/lazarus-group-suspected-moving-stolen-funds-dmm-bitcoin-hack","credibility":3,"archive_timestamp":"2026-02-17T06:03:21+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-dmm-flow-of-funds-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20260511061851/https://www.merklescience.com/blog/hack-track-dmm-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-05-11T06:18:51+00:00"},{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260818025742/https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/","credibility":3,"archive_timestamp":"2026-08-18T02:57:42+00:00"},{"url":"https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern","name":"","type":"other","archive_url":"http://web.archive.org/web/20260823234519/https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern","credibility":3,"archive_timestamp":"2026-08-23T23:45:19+00:00"},{"url":"https://beincrypto.com/lazarus-transfers-funds-from-dmm-bitcoin-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251008201023/https://beincrypto.com/lazarus-transfers-funds-from-dmm-bitcoin-hack/","credibility":3,"archive_timestamp":"2025-10-08T20:10:23+00:00"},{"url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/380286/japan-crypto-exchange-reserve-mandate","name":"","type":"other","archive_url":"http://web.archive.org/web/20251230225012/https://www.theblock.co/post/380286/japan-crypto-exchange-reserve-mandate","credibility":3,"archive_timestamp":"2025-12-30T22:50:12+00:00"},{"url":"https://finance.yahoo.com/news/japans-fsa-require-crypto-exchanges-050024196.html","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://finance.yahoo.com/news/japan-fsa-weighs-registration-rules-095902067.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20251110123139/https://finance.yahoo.com/news/japan-fsa-weighs-registration-rules-095902067.html","credibility":3,"archive_timestamp":"2025-11-10T12:31:39+00:00"},{"url":"https://www.coindesk.com/business/2024/12/02/japanese-crypto-exchange-dmm-bitcoin-to-shut-down-after-305-m-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260521064416/https://www.coindesk.com/business/2024/12/02/japanese-crypto-exchange-dmm-bitcoin-to-shut-down-after-305-m-hack","credibility":3,"archive_timestamp":"2026-05-21T06:44:16+00:00"},{"url":"https://www.theblock.co/post/328890/japanese-exchange-dmm-bitcoin-to-shut-down-transfer-assets-to-sbi-group-unit-after-300-million-hack","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptopotato.com/sbi-vc-trade-completes-acquisition-of-hacked-crypto-exchange-dmm-bitcoin-assets/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260219055757/https://cryptopotato.com/sbi-vc-trade-completes-acquisition-of-hacked-crypto-exchange-dmm-bitcoin-assets/","credibility":3,"archive_timestamp":"2026-02-19T05:57:57+00:00"},{"url":"https://decrypt.co/294452/japanese-crypto-exchange-shut-down-300m-hack-transfer-accounts-sbi","name":"","type":"other","archive_url":"http://web.archive.org/web/20260611191159/https://decrypt.co/294452/japanese-crypto-exchange-shut-down-300m-hack-transfer-accounts-sbi","credibility":3,"archive_timestamp":"2026-06-11T19:11:59+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:32.164542+00:00","updated_at":"2026-08-30T05:14:07.903719+00:00"}}