North Korean Hackers Steal $308M in Bitcoin from DMM Bitcoin

December 25, 2024

3

Authorities from Japan and the United States have identified North Korean cyber actors as the culprits behind the theft of $308 million worth of cryptocurrency from DMM Bitcoin in May 2024. This cyber heist was officially attributed to North Korean-linked TraderTraitor threat activity, which is also recognized under aliases such as Jade Sleet, UNC4899, and Slow Pisces.

TraderTraitor: A Persistent Threat in the Web3 Sector

The hacking group’s activities often involve highly coordinated social engineering efforts targeting multiple employees within the same organization simultaneously, according to statements from the U.S. Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center, and Japan’s National Police Agency. This disclosure follows DMM Bitcoin’s decision to cease its operations earlier this month as a direct result of the breach.

TraderTraitor is a persistent threat group that has been active since at least 2020. It frequently targets companies operating in the Web3 sector, often by enticing victims to download malware-infected cryptocurrency applications. This approach enables the group to facilitate theft on a significant scale.

In recent years, the group has executed a variety of attacks leveraging job-related social engineering tactics. These campaigns include reaching out to potential targets under the guise of recruiting or collaborating on GitHub projects, which often result in the distribution of malicious npm packages. One of the group’s most infamous exploits was its unauthorized access to JumpCloud’s systems last year, targeting a select group of downstream customers.

Recent Attack Strategies and the DMM Bitcoin Heist

The attack on DMM Bitcoin followed a similar pattern. In March 2024, a TraderTraitor operative posed as a recruiter to approach an employee of Ginco, a cryptocurrency wallet software company based in Japan. The operative shared a malicious Python script hosted on GitHub, disguised as part of a pre-employment test. Unfortunately, the employee, who had access to Ginco’s wallet management system, inadvertently compromised the company’s security by copying the script to their personal GitHub account.

In mid-May 2024, the attackers escalated their efforts by exploiting session cookie information to impersonate the compromised Ginco employee. This allowed them to access Ginco’s unencrypted communications system. By late May 2024, the threat actors manipulated a legitimate transaction request from a DMM Bitcoin employee, ultimately stealing 4,502.9 BTC, valued at $308 million at the time. The stolen funds were traced to wallets under TraderTraitor’s control.

This disclosure aligns with findings from Chainalysis, a blockchain intelligence firm, which also linked the DMM Bitcoin hack to North Korean cybercriminals. According to Chainalysis, the attackers exploited infrastructure vulnerabilities to execute unauthorized withdrawals.

🚨🇰🇵NORTH KOREAN HACKERS HIT IT BIG IN 2024
They doubled their 2023 haul, stealing $1.3 billion in crypto this year, according to Chainalysis.
Using tactics like posing as remote IT workers, they infiltrated firms to fund Pyongyang’s weapons programs and dodge sanctions.
Major… pic.twitter.com/RppswOHaRC
— Mario Nawfal (@MarioNawfal) December 23, 2024

Chainalysis reported that the hackers transferred millions in cryptocurrency to intermediary addresses before utilizing a Bitcoin CoinJoin Mixing Service. After successfully obfuscating the funds, the attackers routed portions through various bridging services. The stolen assets eventually reached HuiOne Guarantee, an online marketplace affiliated with Cambodia’s HuiOne Group, which has previously been implicated in cybercrime activities.

Meanwhile, the AhnLab Security Intelligence Center (ASEC) recently exposed another North Korean threat group. A sub-cluster of the Lazarus Group, known as Andariel, has been deploying the SmallTiger backdoor to target South Korean asset management and document centralization solutions.

This series of revelations underscores North Korea’s growing role in cybercrime, particularly within the cryptocurrency sector, as they continue to exploit sophisticated techniques and infrastructure vulnerabilities to fund their operations.

Simplifying Meme Coin Investments with Meme Index

Meme Index is a decentralized platform designed to simplify investments in the meme coin market by offering exposure through four unique indexes: Titan, Moonshot, MidCap, and Frenzy. Each index is tailored to accommodate different risk levels, ranging from stable, well-established meme coins like DOGE and SHIB in the Titan index to high-risk, high-reward exotic tokens in the Frenzy index. Investors can use the $MEMEX token to access these indexes and participate in governance, ensuring the platform evolves with market trends and community input.

What sets Meme Index apart is its emphasis on diversification and community-driven decision-making. Rather than investing in individual meme coins, users gain exposure to a curated basket of tokens, reducing risk while capitalizing on market trends. $MEMEX holders can also stake their tokens for high APY rewards, both during the presale and after the token launch. This staking mechanism not only enhances returns but also supports the platform’s growth. With governance privileges, $MEMEX holders can vote on proposals, including adding or removing meme coins from the indexes, making the platform dynamic and community-centric.