Identified: North Korean Hacker Group Linked to DMM Bitcoin Theft

A recent cyberattack by a North Korea-linked hacker group resulted in the theft of 48.2 billion yen ($307 million) from Tokyo-based cryptocurrency exchange, DMM Bitcoin Co. The police, working with the U.S. Department of Defense and the FBI, identified the hacker group as TraderTraitor. Following the attack, DMM Bitcoin announced its closure due to the unauthorized leakage of funds in May.

The stolen bitcoins were traced to an account controlled by the hacker group, which is believed to be connected to the Lazarus hacking group linked to the North Korean government. The investigation revealed that the breach occurred when an employee managing DMM Bitcoin’s cryptocurrency accounts was contacted through LinkedIn by someone posing as a headhunter. The perpetrator then planted malware in the wallet management system, manipulating transaction amounts and destinations of remittances.

In response, Japan’s Financial Services Agency ordered the exchange to enhance its operations, citing deficiencies in its risk management. Fortunately, no customers suffered financial losses as the exchange secured 55 billion yen from a group firm to compensate for the stolen assets. The police, along with the FBI and international partners, are committed to combating North Korea’s cybercrime activities, including cryptocurrency theft, to disrupt illicit revenue streams for the regime.

In light of this breach, it’s essential for individuals and businesses involved in cryptocurrency to remain vigilant against potential cyber threats and to implement robust security measures to safeguard their assets. It serves as a reminder of the importance of staying informed and taking proactive steps to protect digital assets in the ever-evolving landscape of cybercrime.