On December 23, 2024, the FBI, the U.S. Department of Defense Cyber Crime Center and Japan’s National Police Agency attributed the May 2024 theft of 4,502.9 bitcoin from Japan-based DMM Bitcoin to North Korean cyber actors associated with the TraderTraitor campaign. The bitcoin was worth approximately $308 million at the time of the theft. The agencies’ account describes a social-engineering operation that began with an apparent recruitment approach to an employee of wallet-software provider Ginco—not a publicly described direct exploit of DMM Bitcoin’s exchange software.
What happened to DMM Bitcoin?
In late May 2024, 4,502.9 BTC was transferred from DMM Bitcoin’s official wallet to wallets controlled by the attackers, according to the joint FBI, DC3 and NPA statement. The agencies valued the bitcoin at approximately $308 million at the time. That dollar figure is a historical conversion, not a current valuation; the amount of bitcoin reported stolen was 4,502.9 BTC.
The theft occurred in May. The agencies announced their attribution on December 23, 2024, so the announcement date should not be mistaken for the date of the loss.
How did the attackers allegedly gain access?
The FBI’s public reconstruction traces the operation from a recruiter impersonation to the manipulation of a transaction. The agency says the attackers likely used their access to interfere with a legitimate transaction request from a DMM Bitcoin employee.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
- Late March 2024 — a recruitment lure. An actor posing as a LinkedIn recruiter contacted an employee of Ginco, a Japanese enterprise cryptocurrency-wallet software company.
- A malicious coding test. The employee received a link to a Python script presented as a pre-employment test. The script was hosted through a GitHub page. The FBI says the employee copied the code to a personal GitHub page and was subsequently compromised.
- Impersonation through session information. After mid-May, the attackers allegedly used session-cookie information to impersonate the employee and access Ginco’s unencrypted communications system.
- A transaction was manipulated. The FBI says the actors likely used that access to alter a legitimate DMM Bitcoin transaction request, resulting in the transfer of 4,502.9 BTC.
The GitHub detail does not mean GitHub itself was breached. In the FBI’s account, the site was part of the route used to deliver or handle the malicious test; the subsequent compromise involved the employee’s access and identity.
Why was Ginco involved?
DMM Bitcoin was the company that lost the bitcoin. The employee reportedly targeted first worked for Ginco, a wallet-software provider whose employee had access to Ginco’s wallet-management system. The distinction matters: the publicly described route was through a trusted service-provider and employee relationship, followed by manipulation of a transaction—not simply an unexplained intrusion into DMM Bitcoin’s public-facing exchange systems.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Who are TraderTraitor and its aliases?
TraderTraitor is the designation used by U.S. authorities for the North Korean-linked activity they attributed to the DMM Bitcoin theft. The FBI says the actors are also tracked as Jade Sleet, UNC4899 and Slow Pisces. Threat-intelligence organizations do not always use the same naming conventions, and the aliases should not be treated as proof that every organization defines the groups identically.
The FBI described the perpetrators as North Korean cyber actors and connected their activity to efforts to generate revenue for the North Korean regime. That is an official government attribution. The cited public statement does not identify individual hackers or establish that a person was convicted in court for this theft; it also does not say that North Korea admitted responsibility.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
What the public attribution establishes—and what it does not
The December 23, 2024 statement identifies the victim, the amount, the general attack sequence and the agencies’ attribution. Its account says the attackers “likely” manipulated a legitimate transaction request, a qualification that signals the public description does not disclose every step as a settled technical finding.
The statement is not a publicly released, full forensic report or a court-tested judgment. It does not announce recovery of all 4,502.9 BTC. That means the release alone cannot establish the current recovery status, the complete path the funds took afterward, or the identities of the individuals behind the operation.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
What the attack means for crypto companies and customers
The reported chain shows why a crypto theft may begin outside the exchange or blockchain itself. A convincing recruitment approach, a malicious coding exercise, stolen session information and access to trusted communications can create a path to a high-value transaction. The FBI also says TraderTraitor activity often involves targeted social engineering of multiple employees at the same company.
Practical safeguards suggested by this attack chain include:
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Verify recruiters and job-related coding tests through a separate, trusted channel before opening or running code.
- Treat unsolicited scripts and repositories as untrusted, including when they appear to be part of a legitimate hiring process.
- Protect session cookies and other authentication material, and limit their usefulness through strong identity controls and monitoring.
- Independently verify transaction instructions, particularly changes to destination addresses or other details of large transfers.
- Require multiple authorized people to approve significant withdrawals, and restrict wallet-management access to the tasks and systems that require it.
- Monitor unusual employee and supplier access, and keep communications used to authorize transactions auditable and protected.
These are security implications of the reported attack path, not controls the FBI said DMM Bitcoin or Ginco used or failed to use. The broader lesson is that protecting digital assets requires attention to people, accounts, suppliers and transaction workflows as well as wallet and blockchain technology.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
