Audit log

Every state-changing event for DMM Bitcoin: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 15:26:59Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,012,595

   sig

   3QfJPihnpkoL…xaeQGcBpcopyexplorer ↗

   hash

   CPMKAgcjJtjh…nohgszwpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6994 B) ▸

   {"actor":"system:backfill","investigation_id":"e8972dc5-6b5b-4ab9-9e05-1974d92b8c54","kind":"publish","page_slug":"dmm-bitcoin","published_at":"2026-05-20T15:26:59.244Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DMM Bitcoin","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.financemagnates.com/cryptocurrency/news/dmm-bitcoin-coming-january/"},{"credibility":3,"name":"","type":"other","url":"https://www.forexgdp.com/news/crypto-exchange-farewell/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom"},{"credibility":3,"name":"","type":"other","url":"https://techcrunch.com/2024/05/31/hackers-steal-305-million-from-dmm-bitcoin-crypto-exchange/"},{"credibility":3,"name":"","type":"other","url":"https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2024/05/31/japanese-crypto-exchange-dmm-bitcoin-suffers-305m-hack"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/fbi-reveals-dmm-crypto-hack-300m-north-korea"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/lazarus-group-suspected-moving-stolen-funds-dmm-bitcoin-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-dmm-flow-of-funds-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/"},{"credibility":3,"name":"","type":"other","url":"https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/lazarus-transfers-funds-from-dmm-bitcoin-hack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/380286/japan-crypto-exchange-reserve-mandate"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/japans-fsa-require-crypto-exchanges-050024196.html"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/japan-fsa-weighs-registration-rules-095902067.html"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2024/12/02/japanese-crypto-exchange-dmm-bitcoin-to-shut-down-after-305-m-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/328890/japanese-exchange-dmm-bitcoin-to-shut-down-transfer-assets-to-sbi-group-unit-after-300-million-hack"},{"credibility":3,"name":"","type":"other","url":"https://cryptopotato.com/sbi-vc-trade-completes-acquisition-of-hacked-crypto-exchange-dmm-bitcoin-assets/"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/294452/japanese-crypto-exchange-shut-down-300m-hack-transfer-accounts-sbi"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d"}]}],"sources_used":[],"summary":"DMM Bitcoin was a licensed Japanese cryptocurrency exchange operated by DMM Group (DMM.com) that launched in January 2018. In May 2024 it suffered the eighth-largest crypto theft in history when North Korean state-sponsored hackers attributed to the TraderTraitor subgroup of Lazarus Group stole 4,502.9 BTC (approximately $305–308 million USD) through a sophisticated supply-chain attack targeting Ginco, a third-party wallet management provider. Following the hack, Japan's Financial Services Agency issued a business improvement order, the exchange restricted operations, and in December 2024 announced full closure with all customer assets transferred to SBI VC Trade by March 2025.","timeline":[{"date":"2018-01-10","event":"DMM Bitcoin launches trading platform under DMM Group, offering spot and leverage trading in Japan.","source":""},{"date":"2024-03-01","event":"TraderTraitor operative posing as a LinkedIn recruiter contacts a Ginco employee and delivers a malicious Python script disguised as a pre-employment coding challenge.","source":""},{"date":"2024-05-01","event":"Attackers exploit harvested session cookies to impersonate the compromised Ginco employee and access Ginco's unencrypted internal communications system.","source":""},{"date":"2024-05-31","event":"4,502.9 BTC (approximately $305–308 million) is illegally transferred from DMM Bitcoin wallets via manipulation of a legitimate DMM employee transaction request. DMM Bitcoin publicly confirms the breach.","source":""},{"date":"2024-07-12","event":"Tether blacklists a Tron wallet address linked to the laundering chain, freezing approximately $28–30 million in USDT connected to Huione Guarantee.","source":""},{"date":"2024-07-15","event":"ZachXBT publicly reports over $35 million from the DMM Bitcoin hack has been laundered through Huione Guarantee in Cambodia, identifying Lazarus Group laundering signatures.","source":""},{"date":"2024-09-01","event":"Japan's FSA (Kanto Local Finance Bureau) issues a formal business improvement order against DMM Bitcoin under Article 63-16 of the Payment Services Act, citing concentrated authority in operations and security as a systemic failure.","source":""},{"date":"2024-10-28","event":"FSA deadline for DMM Bitcoin to submit a business improvement plan with specific measures and implementation timeline.","source":""},{"date":"2024-12-02","event":"DMM Bitcoin announces it will cease all operations and transfer all customer accounts and assets to SBI VC Trade by March 2025.","source":""},{"date":"2024-12-23","event":"The FBI, U.S. DC3, and Japan's NPA issue a joint public statement formally attributing the DMM Bitcoin theft to North Korean cyber actors operating as TraderTraitor (also tracked as Jade Sleet, UNC4899, Slow Pisces).","source":""},{"date":"2025-03-08","event":"SBI VC Trade completes transfer of all DMM Bitcoin customer accounts and assets. DMM Bitcoin ceases operations entirely.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 73aed346-590a-4964-a074-9e652157ec87copy
2. #2reviewby reviewerreviewer

   2026-06-15 19:29:59Z
   Score: 10 → 10 (no score change)
   The DMM Bitcoin investigation page is substantially accurate in its core narrative: the May 2024 North Korean TraderTraitor hack, the 4,502.9 BTC amount, FSA business improvement order, and December 2024 closure announcement to SBI VC Trade are all confirmed by authoritative sources including the FBI and FSA. The main factual errors are two timeline dates that are off by weeks (the LinkedIn social engineering was 'late March' not March 1; the session cookie exploitation was 'after mid-May' not May 1), and the FSA order date is wrong by 25 days (September 26, not September 1). The 'eighth-largest theft in history' claim is approximately correct at time of writing but may be stale. The characterization of the attack as a 'supply-chain attack' is a slight overstatement of what was actually a social engineering attack on a vendor employee.
   anchoranchored

   chain

   ●mainnet-betaslot 426,697,948

   sig

   4F6ibMhw4BuF…uy5bG8AAcopyexplorer ↗

   hash

   9z7Cq5Fi2M17…nbhoJm3pcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1194 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-15T19:29:59.396Z","decision":"review","investigation_id":"e8972dc5-6b5b-4ab9-9e05-1974d92b8c54","new_score":10,"page_slug":"dmm-bitcoin","prev_score":10,"reason":"The DMM Bitcoin investigation page is substantially accurate in its core narrative: the May 2024 North Korean TraderTraitor hack, the 4,502.9 BTC amount, FSA business improvement order, and December 2024 closure announcement to SBI VC Trade are all confirmed by authoritative sources including the FBI and FSA. The main factual errors are two timeline dates that are off by weeks (the LinkedIn social engineering was 'late March' not March 1; the session cookie exploitation was 'after mid-May' not May 1), and the FSA order date is wrong by 25 days (September 26, not September 1). The 'eighth-largest theft in history' claim is approximately correct at time of writing but may be stale. The characterization of the attack as a 'supply-chain attack' is a slight overstatement of what was actually a social engineering attack on a vendor employee.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0bfff814-07e6-4e82-a59f-23cbb684ff8ccopy
3. #3review approveby judgejudge

   2026-06-15 19:29:59Z
   Score: 10 → 52 (+42)
   The page's core narrative is confirmed by authoritative sources including the FBI/DC3/NPA joint statement and official FSA records. The single 'disputed' finding (claim_findings[12]) is a timeline date 25 days off for the FSA business improvement order — a minor precision error, not a dispute of any substantive allegation. The four 'partially_supported' findings are similarly limited to timeline date imprecision and a characterization nuance ('supply-chain' vs. social engineering), none of which affect the page's core conclusions. The content warrants approval. Separately, the current score of 10 (CRITICAL) is a significant mis-calibration under fraud-likelihood semantics: the primary incident is a suffered North Korean state-sponsored hack confirmed by the FBI, customers were fully transferred to SBI VC Trade with no loss, and the FSA order addressed operational negligence rather than fraud. Under the anti-conflation principle, being hacked does not equal fraud; the correct band is CAUTIONARY. A score of 52 is applied, reflecting the hack-victim status offset by confirmed own-negligence in security architecture.
   anchoranchored

   chain

   ●mainnet-betaslot 426,697,952

   sig

   4keemdcGq6C5…vnBW3xU9copyexplorer ↗

   hash

   F29fy7nNV4JZ…wavsW2K8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1483 B) ▸

   {"actor":"judge","decided_at":"2026-06-15T19:29:59.396Z","decision":"review_approve","investigation_id":"e8972dc5-6b5b-4ab9-9e05-1974d92b8c54","new_score":52,"page_slug":"dmm-bitcoin","prev_score":10,"reason":"The page's core narrative is confirmed by authoritative sources including the FBI/DC3/NPA joint statement and official FSA records. The single 'disputed' finding (claim_findings[12]) is a timeline date 25 days off for the FSA business improvement order — a minor precision error, not a dispute of any substantive allegation. The four 'partially_supported' findings are similarly limited to timeline date imprecision and a characterization nuance ('supply-chain' vs. social engineering), none of which affect the page's core conclusions. The content warrants approval. Separately, the current score of 10 (CRITICAL) is a significant mis-calibration under fraud-likelihood semantics: the primary incident is a suffered North Korean state-sponsored hack confirmed by the FBI, customers were fully transferred to SBI VC Trade with no loss, and the FSA order addressed operational negligence rather than fraud. Under the anti-conflation principle, being hacked does not equal fraud; the correct band is CAUTIONARY. A score of 52 is applied, reflecting the hack-victim status offset by confirmed own-negligence in security architecture.","score_delta":42,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3b72dfbf-195f-4c3d-904f-163af4f826b3copy
4. #4rescoreby systemsystem

   2026-10-10 18:51:05Z
   Score: 52 → 50 (-2)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +10, regulated +5; no longer operating, so capped at 50; fact-check adjustments (+42) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 455,371,267

   sig

   4ueiEjqjUV1y…EuH4c5QVcopyexplorer ↗

   hash

   DiPMDqdYnjSS…oZcnMFUncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (774 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:51:05.497Z","decision":"rescore","investigation_id":"e8972dc5-6b5b-4ab9-9e05-1974d92b8c54","new_score":50,"page_slug":"dmm-bitcoin","prev_score":52,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +10, regulated +5; no longer operating, so capped at 50; fact-check adjustments (+42) now shown as page reliability, not in the score.","score_delta":-2,"score_model":"v2","sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5995354f-e723-4299-a6af-ba735535d866copy
5. #5reviewby reviewerreviewer

   2026-10-16 05:29:17Z
   Score: 50 → 50 (no score change)
   The page's core narrative — the May 31, 2024 theft of 4,502.9 BTC via a Ginco supply-chain compromise, the FBI/DC3/NPA attribution to TraderTraitor/Lazarus Group, the FSA business improvement order, and the exchange's wind-down into SBI VC Trade — is well supported by both the cited reporting and independent primary sources (the Kanto Local Finance Bureau's own notice, FinCEN's Huione release, and multiple outlets' coverage of the TRM Labs and ZachXBT findings). Two factual errors were found: the Coincheck comparison cites '$523 million in NEM token losses,' which conflates the count of NEM tokens stolen with the dollar value (commonly reported near $530 million), and the Huione Guarantee sentence misattributes Elliptic's $11 billion on-chain-flow estimate to the FinCEN finding, when FinCEN's own release cites a different, smaller figure (~$4 billion). One sentence overstates Chainalysis's role by saying it 'independently confirmed' North Korean attribution, when the cited Chainalysis post merely labels the hack as North Korea-affiliated without presenting confirming evidence. Three sourcing problems were found: a TechCrunch citation's stored archive snapshot points to an unrelated 2026 article (an easy fix with a valid replacement snapshot found), and two citations (a Medium 'tokyo-fintech' post and a ForexGDP post) returned HTTP 403 and could not be found via search, matching the page's own 'unarchivable' metadata for both. The underlying claims attached to the Medium citation are independently confirmed via the primary Japanese regulator notice; the ForexGDP citation's relevance to its section is unclear and it should likely be removed. No accepted_submissions exist for this page, so there is no community evidence to review.
   anchoranchored

   chain

   ●mainnet-betaslot 457,520,977

   sig

   4yh8Drh5oHng…prs7z7gLcopyexplorer ↗

   hash

   21sHgh9wK2fZ…pNKCFHPdcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2352 B) ▸

   {"actor":"reviewer","artifact_identity":"c86a855855fcc1f40874117b4988480e","decided_at":"2026-10-16T05:29:17.363Z","decision":"review","disputed_pct":0.16,"findings_hash":"6NJQ7bKLr2LfjYdCaDzpXR6TjZmWc6sGCLKxQnrtFhDx","investigation_id":"e8972dc5-6b5b-4ab9-9e05-1974d92b8c54","mode":"findings_only","new_score":50,"page_content_hash":"a89d36dc3329dfeaac013fe77fa6447af3a003fc9828549cd8cac4919af48640","page_slug":"dmm-bitcoin","prev_score":50,"reason":"The page's core narrative — the May 31, 2024 theft of 4,502.9 BTC via a Ginco supply-chain compromise, the FBI/DC3/NPA attribution to TraderTraitor/Lazarus Group, the FSA business improvement order, and the exchange's wind-down into SBI VC Trade — is well supported by both the cited reporting and independent primary sources (the Kanto Local Finance Bureau's own notice, FinCEN's Huione release, and multiple outlets' coverage of the TRM Labs and ZachXBT findings). Two factual errors were found: the Coincheck comparison cites '$523 million in NEM token losses,' which conflates the count of NEM tokens stolen with the dollar value (commonly reported near $530 million), and the Huione Guarantee sentence misattributes Elliptic's $11 billion on-chain-flow estimate to the FinCEN finding, when FinCEN's own release cites a different, smaller figure (~$4 billion). One sentence overstates Chainalysis's role by saying it 'independently confirmed' North Korean attribution, when the cited Chainalysis post merely labels the hack as North Korea-affiliated without presenting confirming evidence. Three sourcing problems were found: a TechCrunch citation's stored archive snapshot points to an unrelated 2026 article (an easy fix with a valid replacement snapshot found), and two citations (a Medium 'tokyo-fintech' post and a ForexGDP post) returned HTTP 403 and could not be found via search, matching the page's own 'unarchivable' metadata for both. The underlying claims attached to the Medium citation are independently confirmed via the primary Japanese regulator notice; the ForexGDP citation's relevance to its section is unclear and it should likely be removed. No accepted_submissions exist for this page, so there is no community evidence to review.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a6886972-ffdb-4729-92cd-988ca56de2dccopy