DMM Bitcoin: 4,502.9 BTC (about ¥48.2 billion) stolen via contractor Ginco; police attribute it to North Korea-linked TraderTraitor

On 31 May 2024 the crypto exchange DMM Bitcoin in Chuo, Tokyo announced that 4,502.9 BTC (about ¥48.2 billion) had been stolen from it, and said it would fully cover customers' losses with bitcoin procured with its group's support. On 24 December the National Police Agency, together with the FBI and DC3, announced it had identified the North Korea-linked group TraderTraitor as responsible. According to that alert, in late March 2024 the attackers posed as a recruiter on LinkedIn and contacted an employee of Ginco, a maker of enterprise crypto wallet software, who had access to its wallet management system, sending a link to a malicious Python script disguised as a pre-employment test. From mid-May they used session cookies to impersonate that employee and got into Ginco's unencrypted communication system, and in late May they tampered with a legitimate transaction request by a DMM employee. On 26 September the Kanto Finance Bureau issued a business improvement order to DMM Bitcoin, citing among other things that private key signing was done by one person alone and the keys were managed in one place. On 1 December the company said it would close its business and move accounts and customer assets to SBI VC Trade.