Verify a decision

{"actor":"system:backfill","investigation_id":"e8972dc5-6b5b-4ab9-9e05-1974d92b8c54","kind":"publish","page_slug":"dmm-bitcoin","published_at":"2026-05-20T15:26:59.244Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DMM Bitcoin","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.financemagnates.com/cryptocurrency/news/dmm-bitcoin-coming-january/"},{"credibility":3,"name":"","type":"other","url":"https://www.forexgdp.com/news/crypto-exchange-farewell/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom"},{"credibility":3,"name":"","type":"other","url":"https://techcrunch.com/2024/05/31/hackers-steal-305-million-from-dmm-bitcoin-crypto-exchange/"},{"credibility":3,"name":"","type":"other","url":"https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2024/05/31/japanese-crypto-exchange-dmm-bitcoin-suffers-305m-hack"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/fbi-reveals-dmm-crypto-hack-300m-north-korea"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/lazarus-group-suspected-moving-stolen-funds-dmm-bitcoin-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-dmm-flow-of-funds-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/"},{"credibility":3,"name":"","type":"other","url":"https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/lazarus-transfers-funds-from-dmm-bitcoin-hack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/380286/japan-crypto-exchange-reserve-mandate"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/japans-fsa-require-crypto-exchanges-050024196.html"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/japan-fsa-weighs-registration-rules-095902067.html"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2024/12/02/japanese-crypto-exchange-dmm-bitcoin-to-shut-down-after-305-m-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/328890/japanese-exchange-dmm-bitcoin-to-shut-down-transfer-assets-to-sbi-group-unit-after-300-million-hack"},{"credibility":3,"name":"","type":"other","url":"https://cryptopotato.com/sbi-vc-trade-completes-acquisition-of-hacked-crypto-exchange-dmm-bitcoin-assets/"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/294452/japanese-crypto-exchange-shut-down-300m-hack-transfer-accounts-sbi"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/tokyo-fintech/dmm-bitcoin-receives-business-improvement-order-004693593b8d"}]}],"sources_used":[],"summary":"DMM Bitcoin was a licensed Japanese cryptocurrency exchange operated by DMM Group (DMM.com) that launched in January 2018. In May 2024 it suffered the eighth-largest crypto theft in history when North Korean state-sponsored hackers attributed to the TraderTraitor subgroup of Lazarus Group stole 4,502.9 BTC (approximately $305–308 million USD) through a sophisticated supply-chain attack targeting Ginco, a third-party wallet management provider. Following the hack, Japan's Financial Services Agency issued a business improvement order, the exchange restricted operations, and in December 2024 announced full closure with all customer assets transferred to SBI VC Trade by March 2025.","timeline":[{"date":"2018-01-10","event":"DMM Bitcoin launches trading platform under DMM Group, offering spot and leverage trading in Japan.","source":""},{"date":"2024-03-01","event":"TraderTraitor operative posing as a LinkedIn recruiter contacts a Ginco employee and delivers a malicious Python script disguised as a pre-employment coding challenge.","source":""},{"date":"2024-05-01","event":"Attackers exploit harvested session cookies to impersonate the compromised Ginco employee and access Ginco's unencrypted internal communications system.","source":""},{"date":"2024-05-31","event":"4,502.9 BTC (approximately $305–308 million) is illegally transferred from DMM Bitcoin wallets via manipulation of a legitimate DMM employee transaction request. DMM Bitcoin publicly confirms the breach.","source":""},{"date":"2024-07-12","event":"Tether blacklists a Tron wallet address linked to the laundering chain, freezing approximately $28–30 million in USDT connected to Huione Guarantee.","source":""},{"date":"2024-07-15","event":"ZachXBT publicly reports over $35 million from the DMM Bitcoin hack has been laundered through Huione Guarantee in Cambodia, identifying Lazarus Group laundering signatures.","source":""},{"date":"2024-09-01","event":"Japan's FSA (Kanto Local Finance Bureau) issues a formal business improvement order against DMM Bitcoin under Article 63-16 of the Payment Services Act, citing concentrated authority in operations and security as a systemic failure.","source":""},{"date":"2024-10-28","event":"FSA deadline for DMM Bitcoin to submit a business improvement plan with specific measures and implementation timeline.","source":""},{"date":"2024-12-02","event":"DMM Bitcoin announces it will cease all operations and transfer all customer accounts and assets to SBI VC Trade by March 2025.","source":""},{"date":"2024-12-23","event":"The FBI, U.S. DC3, and Japan's NPA issue a joint public statement formally attributing the DMM Bitcoin theft to North Korean cyber actors operating as TraderTraitor (also tracked as Jade Sleet, UNC4899, Slow Pisces).","source":""},{"date":"2025-03-08","event":"SBI VC Trade completes transfer of all DMM Bitcoin customer accounts and assets. DMM Bitcoin ceases operations entirely.","source":""}]},"v":1}