According to statements released by US and Japanese law enforcement on Monday, the cyberattack that resulted in the theft of $308 million from Japanese cryptocurrency exchange DMM in May has been linked to North Korean hackers. The stolen 4,502.9 bitcoins, valued at $87,149.09, has forced the exchange to shut down.
The FBI, in collaboration with the Department of Defense Cyber Crime Center and the National Police Agency of Japan, stated that the incident was connected to a group known as TraderTraitor. Chainalysis' annual report revealed that North Korean hackers have been responsible for the majority of cryptocurrency-related crimes this year.
The Democratic People's Republic of Korea (DPRK) has been implicated in over half of the total cryptocurrency value stolen in 2024, with its operatives accounting for the theft of $1.34 billion across 47 incidents, more than double the $660 million stolen the previous year. TraderTraitor, also known by other aliases such as Jade Sleet, UNC4899, and Slow Pisces, typically employs targeted social engineering tactics.
In this instance, malicious code was embedded in a Python script used for a fake pre-employment test and sent by a poseur recruiter on LinkedIn to a job candidate working at an external company, cryptocurrency wallet provider Ginco. The victim copied the code to their personal Github page, granting TraderTraitor access to session cookie information that allowed it to infiltrate Ginco's communication system. Months later, the group likely utilized this access to intercept a legitimate transaction request from a DMM employee, ultimately leading to the theft, as reported by the agencies.