DMM Bitcoin
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +10, regulated +5; no longer operating, so capped at 50; fact-check adjustments (+42) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -12.8 |
| Problems around it, caused by others | -0.8 |
| Long-running | +10 |
| Regulated | +5 |
| Sum | 63 |
- No longer operating, so capped at 50.
Score: 50/100 (kept between 0 and 100)
How scoring works →Summary
DMM Bitcoin was a licensed Japanese cryptocurrency exchange operated by DMM Group (DMM.com) that launched in January 2018. In May 2024 it suffered the eighth-largest crypto theft in history when North Korean state-sponsored hackers attributed to the TraderTraitor subgroup of Lazarus Group stole 4,502.9 BTC (approximately $305–308 million USD) through a sophisticated supply-chain attack targeting Ginco, a third-party wallet management provider. Following the hack, Japan's Financial Services Agency issued a business improvement order, the exchange restricted operations, and in December 2024 announced full closure with all customer assets transferred to SBI VC Trade by March 2025.
Connected Entities
9 entities · 59 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Coincheck→mentioned with→Bitcoin(65%)
- TraderTraitor / UNC4899→mentioned with→THORChain(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
- THORChain→mentioned with→Ethereum(70%)
- THORChain→mentioned with→Bitcoin(60%)
- DMM Bitcoin→mentioned with→TraderTraitor / UNC4899(70%)
- + 10 more
Timeline(11 events)
10 January 2018
DMM Bitcoin launches trading platform under DMM Group, offering spot and leverage trading in Japan.
March 2024
TraderTraitor operative posing as a LinkedIn recruiter contacts a Ginco employee and delivers a malicious Python script disguised as a pre-employment coding challenge.
May 2024
Attackers exploit harvested session cookies to impersonate the compromised Ginco employee and access Ginco's unencrypted internal communications system.
31 May 2024
4,502.9 BTC (approximately $305–308 million) is illegally transferred from DMM Bitcoin wallets via manipulation of a legitimate DMM employee transaction request. DMM Bitcoin publicly confirms the breach.
12 July 2024
Tether blacklists a Tron wallet address linked to the laundering chain, freezing approximately $28–30 million in USDT connected to Huione Guarantee.
15 July 2024
ZachXBT publicly reports over $35 million from the DMM Bitcoin hack has been laundered through Huione Guarantee in Cambodia, identifying Lazarus Group laundering signatures.
September 2024
Japan's FSA (Kanto Local Finance Bureau) issues a formal business improvement order against DMM Bitcoin under Article 63-16 of the Payment Services Act, citing concentrated authority in operations and security as a systemic failure.
28 October 2024
FSA deadline for DMM Bitcoin to submit a business improvement plan with specific measures and implementation timeline.
2 December 2024
DMM Bitcoin announces it will cease all operations and transfer all customer accounts and assets to SBI VC Trade by March 2025.
23 December 2024
The FBI, U.S. DC3, and Japan's NPA issue a joint public statement formally attributing the DMM Bitcoin theft to North Korean cyber actors operating as TraderTraitor (also tracked as Jade Sleet, UNC4899, Slow Pisces).
8 March 2025
SBI VC Trade completes transfer of all DMM Bitcoin customer accounts and assets. DMM Bitcoin ceases operations entirely.
Decision Log
- slot 455371267 · hash DiPMDqdYnjSSm3L34qc2F7aPwqJQpTxvs3TeoZcnMFUn
- slot 426697952 · hash F29fy7nNV4JZn65Z2m125pawnpLtLJdBZTcywavsW2K8
- slot 426697948 · hash 9z7Cq5Fi2M17dbEga7grbgCvmB1v7wcEtgC5nbhoJm3p
- slot 421012595 · hash CPMKAgcjJtjhtVxN5LiX2DNGXF6qxEumTU13nohgszwp
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 17 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:32 AM
last updated: 10/10/2026, 6:51:05 PM
7 viewsavoid.net — verified advice for a post-truth world