{"investigation":{"slug":"sbi-crypto","entity_name":"SBI Crypto","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"SBI Crypto is a cryptocurrency mining subsidiary of Japan's SBI Holdings, operating one of the top Bitcoin mining pools globally and offering related infrastructure services. On September 24, 2025, addresses linked to the company saw approximately $21–24 million in suspicious outflows across five cryptocurrencies; blockchain investigator ZachXBT and security firm Cyvers identified laundering patterns consistent with DPRK-affiliated Lazarus Group operations. SBI Group did not proactively disclose the breach and provided only minimal confirmation after independent researchers surfaced the incident publicly.","sections":[{"content":"SBI Crypto Co., Ltd. is a wholly-owned subsidiary of SBI Holdings, Inc., Japan's largest publicly listed financial conglomerate with over $200 billion in total assets. SBI Holdings operates an extensive crypto-asset business segment that includes the VCTRADE exchange (operated through SBI VC Trade Co., Ltd.), market-making via B2C2 (acquired 2019), and industrial-scale Bitcoin mining through SBI Crypto. SBI Crypto began self-mining Bitcoin and its forks in August 2017, initially at overseas mining farms, before expanding to a publicly accessible mining pool in March 2021 in partnership with German firm Northern Data AG and Texas-based Whinstone US. As of the time of the 2025 breach, the mining pool ranked sixth globally by hashrate. SBI VC Trade holds registration as a Crypto-Asset Exchange Service Provider under Japan's Payment Services Act and was among the first eleven Bitcoin exchanges licensed by the Financial Services Agency (FSA) following Japan's revised regulatory framework in 2017.","heading":"Corporate Background","sources":[],"severity":"medium"},{"content":"On September 24, 2025, on-chain addresses linked to SBI Crypto's mining pool operations saw suspicious outflows totaling approximately $21–24 million across Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash. The breach was publicly surfaced on October 1, 2025 by blockchain investigator ZachXBT, assisted by blockchain security firm Cyvers. According to the rekt.news post-mortem, the on-chain breakdown was approximately $17.45 million in BTC (attacker address: bc1qx0a2kfjd7eweczv8xqjm6rggm40v0nkhfss78l), $6.4 million in ETH (0x40d76a78ddba2ea81fb0f9fba147a08bcfc2b866), plus smaller amounts in BCH, LTC, and DOGE. The stolen funds were immediately split across multiple intermediate wallets, routed through instant exchanges including SideShift, FixedFloat, and OpenOcean DEX, and then deposited into Tornado Cash — with 924 ETH mixed across 15 separate Tornado Cash transactions. As of October 3, 2025, 143.2 BTC remained in the attacker wallet. ZachXBT stated the attack patterns 'share several indicators with known DPRK attacks,' citing similarities to the Lazarus Group's methodology in the May 2024 DMM Bitcoin compromise ($308 million). No official government body has formally attributed the attack to DPRK as of the time of reporting. SBI Crypto's attack vector was not confirmed publicly; possible social engineering of employee credentials (consistent with Lazarus Group tactics) was noted by investigators.","heading":"$21–24 Million Hack (September 2025) — DPRK Attribution","sources":[],"severity":"medium"},{"content":"A significant concern raised by investigators and media is SBI Group's handling of the breach. Neither ZachXBT nor Protos Media could find evidence that SBI Crypto notified its mining pool members of the theft prior to independent researcher disclosure. SBI Group did not respond to request for comment from CoinDesk or Protos. On approximately October 2, 2025, SBI Group issued a minimal confirmation acknowledging 'unauthorized outflow of crypto assets' but stated that the impact on 'consolidated results would be minor' without completing a damage assessment. No detailed incident report was published. This response stands in contrast to Japan FSA guidance encouraging prompt and transparent disclosure of material security incidents. Japan's FSA was separately working in 2025 on legislation to require crypto exchanges to maintain liability reserves for hack-related losses, legislation it planned to submit to parliament in 2026.","heading":"Disclosure Failure and Regulatory Concern","sources":[],"severity":"medium"},{"content":"In April 2023, SBI Crypto filed a lawsuit in Texas against Whinstone US (a data center acquired by Riot Platforms, NASDAQ: RIOT), alleging fraud, fraudulent inducement of contract, fraud by nondisclosure, negligent bailment, and breach of contract. The suit alleged that Whinstone misrepresented its readiness to host large-scale Bitcoin mining operations when the parties signed a Hosting Service Agreement in October 2019. Specific allegations included: Whinstone claiming to have secured up to one gigawatt of electricity when it had not yet signed power contracts; delivery of only 14,600 mining machines by April 2021 rather than the promised 20,000; and machines found in June 2021 with 'high levels of dust and corrosion build-up' and lacking promised dust filters. SBI originally sought over $175 million in purported lost profits tied to Bitcoin price appreciation, plus over $50 million in equipment replacement costs, exemplary damages, attorneys' fees, and interest. The parties reached a verbal global settlement on February 16, 2026, under which Riot Platforms agreed to pay SBI $20 million in cash to resolve all existing or future claims.","heading":"Whinstone US Lawsuit and Settlement","sources":[],"severity":"medium"},{"content":"SBI Holdings and Standard Chartered-backed Zodia Custody announced the dissolution of their Japanese joint venture, SBI Zodia Custody Co., Ltd., in September 2025 — the same month as the mining pool breach. The venture was 51% owned by SBI and 49% by Zodia Custody, and was established approximately two years prior. The joint venture had been in discussions with Japan's FSA regarding local registration but had not submitted a formal application before the dissolution decision was made. Zodia Custody CEO Julian Sawyer cited differing strategic priorities as the reason, describing it as a 'mutual decision.' SBI indicated it would reallocate resources toward diversified technology investments rather than direct crypto custody. The dissolution is not indicative of wrongdoing but represents a material retreat from SBI's institutional custody ambitions in Japan.","heading":"Zodia Custody Joint Venture Dissolution","sources":[],"severity":"medium"},{"content":"Despite the 2025 security incident and litigation, SBI Holdings has continued to expand its crypto footprint. In March 2025, SBI absorbed customers from DMM Bitcoin following the collapse of that exchange after a $308 million hack in May 2024 — the same hack whose methodology ZachXBT later cited as a pattern match to the SBI Crypto breach. In May 2026, SBI Holdings announced formal discussions to acquire Bitbank as a consolidated subsidiary, with the stated goal of creating Japan's largest crypto platform group. SBI Securities and Rakuten Securities were also reported in May 2026 to be developing in-house cryptocurrency investment trusts ahead of anticipated reclassification of crypto as a financial product under Japan's Financial Instruments and Exchange Act. SBI Holdings and Startale Group also introduced a jointly developed Japanese yen stablecoin, JPYSC.","heading":"SBI Group Crypto Expansion Context","sources":[],"severity":"medium"},{"content":"Japan's crypto regulatory regime is among the most developed globally. Crypto-asset exchange service providers must register with the FSA under the revised Payment Services Act. SBI VC Trade is registered under this framework and was Japan's first Electronic Payment Instruments Exchange Service Provider. In 2025, the FSA was finalizing comprehensive crypto trading rules and was developing legislation to require exchanges to hold liability reserves to compensate customers for hack-related losses. Cryptocurrency mining pools such as SBI Crypto's are subject to different requirements than exchanges; the extent to which the FSA has taken action or sought disclosures specifically related to the SBI Crypto September 2025 breach is not publicly documented as of the time of this writing.","heading":"Japan Regulatory Framework","sources":[],"severity":"medium"}],"timeline":[{"date":"2017-08","event":"SBI Crypto begins self-mining Bitcoin and forks at overseas mining farms.","source":"","source_url":"https://cryptobriefing.com/sbi-holdings-japan-announces-public-bitcoin-mining-pool/","date_original":"2017-08-01"},{"date":"2017-09","event":"SBI Virtual Currencies (operating VCTRADE) receives FSA registration as a cryptocurrency exchange, among the first eleven licensed in Japan.","source":"","source_url":"https://www.ccn.com/worlds-first-bank-owned-cryptocurrency-exchange-launches-publicly-in-japan/","date_original":"2017-09-01"},{"date":"2019-10","event":"SBI Crypto signs Hosting Service Agreement with Whinstone US (Rockdale, Texas) for large-scale Bitcoin mining operations.","source":"","source_url":"https://decrypt.co/125685/sbi-crypto-sues-riot-blockchain-owned-data-center-fraud-negligence","date_original":"2019-10-01"},{"date":"2021-03-19","event":"SBI Crypto opens its Bitcoin mining pool to the general public, ranking 11th globally at launch.","source":"","source_url":"https://cointelegraph.com/news/sbi-crypto-s-bitcoin-mining-pool-goes-public"},{"date":"2023-04","event":"SBI Crypto files lawsuit against Whinstone US (owned by Riot Platforms) alleging fraud, negligent bailment, and breach of contract, seeking over $225 million.","source":"","source_url":"https://decrypt.co/125685/sbi-crypto-sues-riot-blockchain-owned-data-center-fraud-negligence","date_original":"2023-04-01"},{"date":"2025-03","event":"SBI Holdings absorbs DMM Bitcoin customers after DMM Bitcoin's collapse following a $308 million hack attributed to Lazarus Group.","source":"","source_url":"https://rekt.news/sbi-crypto-rekt","date_original":"2025-03-01"},{"date":"2025-09-11","event":"SBI Holdings and Zodia Custody (Standard Chartered-backed) announce dissolution of their SBI Zodia Custody joint venture before FSA application was filed.","source":"","source_url":"https://beincrypto.com/sbi-ends-joint-venture-with-zodia-custody/"},{"date":"2025-09-24","event":"Approximately $21–24 million in cryptocurrency (BTC, ETH, LTC, DOGE, BCH) drained from SBI Crypto mining pool addresses in what ZachXBT later described as bearing DPRK Lazarus Group indicators.","source":"","source_url":"https://rekt.news/sbi-crypto-rekt"},{"date":"2025-10","event":"ZachXBT and Cyvers publicly surface the SBI Crypto breach. Stolen funds traced through SideShift, FixedFloat, OpenOcean, and Tornado Cash (924 ETH across 15 transactions). SBI Group does not respond to CoinDesk or Protos for comment.","source":"","source_url":"https://www.theblock.co/post/373081/japans-sbi-crypto-hit-by-21-million-exploit-funds-sent-to-tornado-cash-zachxbt","date_original":"2025-10-01"},{"date":"2025-10-02","event":"SBI Group issues a minimal statement confirming 'unauthorized outflow of crypto assets,' stating the impact on 'consolidated results would be minor' without completing a damage assessment.","source":"","source_url":"https://rekt.news/sbi-crypto-rekt"},{"date":"2026-02-16","event":"SBI Crypto and Riot Platforms reach verbal global settlement: Riot to pay SBI $20 million to resolve all claims from the 2023 Whinstone lawsuit.","source":"","source_url":"https://www.theblock.co/post/391962/riot-sbi-crypto-reach-20-million-settlement-in-texas-bitcoin-mining-dispute"},{"date":"2026-05","event":"SBI Holdings announces formal discussions to acquire Bitbank, aiming to create Japan's largest crypto platform group.","source":"","source_url":"https://www.banklesstimes.com/articles/2026/05/01/japans-sbi-lines-up-bitbank-buyout-as-next-big-crypto-exchange-play/","date_original":"2026-05-01"}],"sources_used":[],"source_tags":["zachxbt","defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:20.908529+00:00","updated_at":"2026-08-29T01:36:03.614+00:00"}}