Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →On May 31, 2024, Japan-based cryptocurrency exchange DMM Bitcoin reported an unauthorized transfer of 4,502.9 BTC from one of its wallets. The loss was valued at about ¥48.2 billion—roughly $305 million to $308 million, depending on the exchange rate and valuation used.
The FBI, the U.S. Department of Defense Cyber Crime Center and Japan’s National Police Agency later attributed the theft to North Korean cyber actors associated with TraderTraitor. Authorities said the attack began with social engineering targeting an employee of Ginco, a Japanese wallet-software company.
As an Amazon Associate I earn from qualifying purchases.
DMM Bitcoin said it would cover customers’ Bitcoin. The exchange ultimately ended its service on March 8, 2025, transferring customer accounts and assets to SBI VC Trade.
What happened to DMM Bitcoin?
DMM Bitcoin detected an unauthorized Bitcoin transfer at approximately 1:26 p.m. Japan time on Friday, May 31, 2024, according to contemporaneous reporting of the exchange’s customer notice. A total of 4,502.9 BTC had left the exchange’s wallet.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
DMM initially described the event as an “unauthorized leak” of Bitcoin. In operational terms, it was an unauthorized transfer of customer-held cryptocurrency. The company restricted some services while investigating and said it would guarantee customers’ Bitcoin deposits.
The Japan Financial Services Agency requested a report explaining the cause of the incident and DMM’s plan for compensating customers.
How much Bitcoin was stolen?
| Measure | Amount |
|---|---|
| Bitcoin | 4,502.9 BTC |
| Japanese yen | Approximately ¥48.2 billion |
| U.S. dollar estimate | Approximately $305 million to $308 million |
The dollar figures are not contradictory. Bitcoin’s price and the yen-to-dollar exchange rate change, and different reports used different valuation points. The BTC amount and the yen figure are the more stable references. The FBI’s later statement used approximately $308 million, while initial coverage commonly used $305 million.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How did the attackers gain access?
The most detailed public account came later from the FBI, DC3 and NPA. It describes a multi-stage social-engineering operation rather than a simple claim that attackers directly “broke into a cold wallet.”
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Late March 2024: An attacker allegedly posed as a recruiter on LinkedIn and contacted an employee of Ginco, a Japanese enterprise cryptocurrency-wallet software company.
- Malicious recruitment exercise: The attacker sent a URL containing a Python script hosted through a GitHub page. It was presented as a pre-employment test.
- Employee compromise: The Ginco employee copied the Python code to a personal GitHub page and was compromised.
- Mid-May: The attackers allegedly used session-cookie information to impersonate the employee and access Ginco’s unencrypted communications system.
- Late May: Authorities said the attackers manipulated a legitimate transaction request associated with DMM Bitcoin.
- May 31: The resulting transfer sent 4,502.9 BTC to wallets controlled by the attackers, after which DMM detected the unauthorized movement.
This account establishes the reported use of social engineering, malicious code, session-cookie abuse and transaction manipulation. It does not publicly establish every internal control that failed at DMM or Ginco. The available government statement also does not show whether private keys were stolen, whether the relevant wallet was classified as cold storage, or exactly how transaction approvals were bypassed.
Who was responsible?
On December 23, 2024, the FBI, DC3 and Japan’s NPA said North Korean cyber actors associated with TraderTraitor were responsible. The statement also identified the aliases Jade Sleet, UNC4899 and Slow Pisces.
That wording reflects an official government attribution. It is more precise than presenting the allegation as a fact established by a public criminal trial, and it does not indicate that North Korea admitted responsibility. The initial May 2024 reports did not identify the perpetrators; the attribution came months later.
Recommended Free Tools
Was this an exchange hack or an insider theft?
“Exchange hack” is a reasonable shorthand for what happened, but it hides the reported attack path. The public account describes an external cyber operation that compromised an employee associated with a third-party wallet-software provider and then manipulated a legitimate transaction request linked to DMM.
Rank #3
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
There is no basis in the available evidence for saying that a DMM employee intentionally stole the assets. Nor is there enough public detail to describe the incident specifically as a private-key theft or a direct compromise of DMM’s cold storage.
Were customers reimbursed?
DMM Bitcoin said it would fully guarantee customers’ Bitcoin deposits and obtain an equivalent amount of BTC with support from companies in the wider DMM group. The FSA said DMM had explained that it would compensate the full amount and that the regulator would monitor the response.
The available sources establish that promise and the regulatory oversight. They do not independently document a definitive completion date or a customer-by-customer reimbursement procedure. Those are different questions: a company’s commitment to make customers whole is not the same as a separately verified record showing when and how every claim was settled.
What happened to DMM Bitcoin afterward?
DMM Bitcoin is no longer operating as a standalone exchange. According to DMM Bitcoin’s service notice, its service ended on March 8, 2025. Customer accounts, Japanese-yen balances and crypto assets were transferred to SBI VC Trade.
Rank #4
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
Former customers were directed to use SBI VC Trade for account access and future inquiries. The migration could require initial login procedures using information sent by SBI VC Trade, so former customers should rely on official DMM or SBI communications rather than unofficial “recovery” services.
The closure should not be described as proof that the theft alone caused the shutdown. The available sources establish the service termination and transfer, but not that the incident was the sole cause.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the theft mattered
The DMM Bitcoin theft was among the largest cryptocurrency thefts of 2024. Chainalysis included DMM Bitcoin among the notable centralized-service hacks of the year.
Free tools Windows power users keep installed
One-click scans. No signup required.
Its broader importance is the attack path. A crypto exchange can be exposed through more than its core trading platform or wallet infrastructure:
Best Value
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
- Recruitment can become an attack surface: A fake hiring exercise can target employees with access to sensitive systems.
- Vendors can create concentration risk: A wallet-software or communications provider may connect attackers to an exchange’s transaction workflow.
- Session cookies have real value: Stolen session information can allow impersonation without relying only on a password.
- Transaction authorization matters: Custody protections do not eliminate risk if a legitimate transaction request can be altered or approved improperly.
- “Cold storage” is not a complete security answer: The label says little by itself about the systems, people and procedures used to move assets.
These are security lessons drawn from the reported attack chain, not proof of a specific undisclosed DMM control failure.
What remains unknown?
Public accounts leave several technical questions unanswered:
- Which precise internal DMM control authorized or failed to stop the transfer?
- Whether multiple-person approval was required and, if so, how it was bypassed
- Which specific Ginco software or communications component was exploited
- The complete laundering or recovery route for all stolen Bitcoin
- Whether any employee knowingly assisted the attackers
Filling those gaps with claims about private keys, cold wallets, insiders or a single employee would go beyond the evidence currently described by the cited sources.
Quick Recap
What former customers should do
- Use only official DMM Bitcoin and SBI VC Trade websites or contact channels.
- Check the official migration instructions and complete any required initial login or identity-verification steps.
- Do not pay an unofficial recovery agent that promises to retrieve funds or unlock an account.
- Keep records of account information, transfer notices and communications if a claim remains unresolved.
- For unresolved legal or financial issues in Japan, consult the relevant official channel or a qualified adviser.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
