To use this site, please disable the ad blocking feature and reload the page.
This website uses cookies to collect information about your visit for purposes such as showing you personalized ads and content, and analyzing our website traffic. By clicking “Accept all,” you will allow the use of these cookies.
Users accessing this site from EEA countries and UK are unable to view this site without your consent. We apologize for any inconvenience caused.
Yomiuri Shimbun file photo The National Police Agency in Tokyo
The Yomiuri Shimbun
15:50 JST, December 24, 2024
The North Korean hackers group TraderTraitor was involved in the May theft of bitcoins worth ¥48.2 billion from Japanese cryptocurrency exchange DMM Bitcoin, the National Police Agency and the U.S. Federal Bureau of Investigation announced Tuesday.
According to the announcement, a cyber actor masquerading as a headhunter approached an employee of DMM Bitcoin’s outsourcing partner and stole his access to the firm’s cryptocurrency transaction system.
TraderTraitor is believed to be part of the hacking outfit Lazarus, which belongs to North Korea’s Reconnaissance General Bureau. This is the first time that harm by the group was confirmed in Japan and the eighth time that the Japanese government has named the source of an attack, a practice called “public attribution.”
The Kanto Regional Police Bureau’s cybercrime special investigative team and the Metropolitan Police Department will continue to investigate the case on suspicion of violations of the Law on Prohibition of Unauthorized Computer Access.
According to the NPA, a member of TraderTraitor masqueraded as a corporate recruiter on the LinkedIn business-oriented social media site in late March. They contacted a employee of Ginco Inc., a Tokyo-based cryptocurrency wallet software firm that DMM Bitcoin had entrusted with managing its cryptocurrency trading.
The fraudulent recruiter allegedly told the employee, “We were impressed by your skills” and had him execute a program sent under the guise of a pre-employment test to check his skills. The employee was infected with a computer virus that compromised his privileges as a DMM Bitcoin employee.
TraderTraitor actors accessed Ginco’s cryptocurrency transaction system repeatedly from mid-May. They allegedly changed transaction amounts and remittance recipients in the system to steal ¥48.2 billion worth of bitcoins from DMM Bitcoin on May 31.
The stolen bitcoins were subsequently laundered, but some were eventually moved to a wallet that the FBI knew was controlled by TraderTraitor. In addition, the LinkedIn account used to contact the employee and the server connected to his device matched those acknowledged by U.S. authorities to have been linked to TraderTraitor.
The United Nations reported in March that North Korean cyberattacks on cryptocurrency-related companies between 2017 and 2023 were valued at $3 billion, which reportedly helped fund the country’s development of weapons of mass destruction.
The NPA, in conjunction with the National Center of Incident readiness and Strategy for Cybersecurity and the Financial Services Agency, released a joint document Tuesday to raise awareness. The document called for companies concerned to be aware of the hackers’ tactic of learning about their targets’ backgrounds and skills before making contact.
DMM Bitcoin announced this month that it would transfer its customers’ wallets to SBI Holdings Inc.’s cryptocurrency exchange unit from around next March and go out of business.
