Writing
DMM Bitcoin, May 2024: what the public record says about the withdrawal path
The public record describes a chain of events, not one failure. It also leaves the most useful question open: who approved and signed the altered transaction, and what did they see.
On 31 May 2024 DMM Bitcoin lost 4,502.9 BTC, about ¥48.2 billion at the time, from its wallet. Japan’s National Police Agency (NPA), the FBI and DC3 attribute the theft to the North Korea-linked group TraderTraitor. The record shows a social-engineering approach to an employee of the company that supplied DMM’s wallet software, access to that company’s production environment, and tampering with a legitimate transaction request made by a DMM employee.
This note separates what the sources state from what they do not, then lists the questions a withdrawal-path review asks of any exchange with a similar structure. Every statement is tagged by source. Nothing here is a finding about the internal controls of any named company beyond what a source says.
What the sources state
| Date | What | Source |
|---|---|---|
| Late March 2024 | A recruiter profile on LinkedIn approached an employee of Ginco, a wallet-software company, with a link to a Python script presented as a pre-employment test. | NPA release of 24 Dec 2024; FBI, DC3 and NPA statement (Japanese translation); Ginco statement of 28 Jan 2025 |
| From mid-May 2024 | The attacker used stolen credentials or session data to access Ginco’s systems. The sources differ on the detail (below). | NPA; Ginco |
| 24 to 31 May 2024 | Traces of access to Ginco’s Kubernetes production environment using the employee’s credentials. | Ginco |
| Late May 2024 | A legitimate transaction request made by a DMM employee was tampered with. | NPA; FBI, DC3 and NPA |
| 31 May 2024, about 13:26 JST | DMM detected an unauthorised outflow of 4,502.9 BTC. | DMM notice of 31 May 2024 (archived) |
| 26 Sep 2024 | The Kanto Local Finance Bureau ordered DMM to improve its business. Its findings include single-person signing and keys managed together. It said the specific method had not yet been established. | Kanto Local Finance Bureau |
| 24 Dec 2024 | The NPA, FBI and DC3 attributed the theft to TraderTraitor. The NPA, NISC and FSA issued an alert with generic mitigations. | NPA; FSA |
| 8 Mar 2025 | DMM Bitcoin ended its services; accounts and assets moved to SBI VC Trade. | DMM notices of 2 Dec 2024 and 13 Feb 2025 (archived) |
Where the sources differ
How the employee was compromised. The police describe the employee copying the code to their own GitHub page and then being compromised, followed by abuse of session cookies against an unencrypted communication system. Ginco describes the employee being induced to run the script, which compromised their work terminal, and credentials that opened a Kubernetes production environment. The two accounts are not contradictory in outline, but they name different mechanisms, and neither source reconciles them.
Where the altered data was added. Ginco says the attacker added unauthorised data to a legitimate transaction instruction by interfering with low-layer communication processing. It also says the fraudulent transfer was not sent from its software, and that it is not in a position to obtain or publish information about DMM’s own work environment and operations.
What the sources do not say
- Who approved the altered transaction, who signed it, with which key and device, and how it reached the chain.
- What the signer or approver saw at the time.
- Which party’s controls were meant to detect a changed request.
- What DMM changed afterwards, beyond the withdrawal and trading restrictions it announced. Ginco says it has implemented recurrence-prevention and security-strengthening measures but does not describe them.
- Any DMM-published root-cause report. None was found.
What the regulator said about controls
The Kanto Local Finance Bureau’s findings, translated: signing work was carried out by one person alone without a check; private keys were managed collectively; the company had not decided how long to keep evidence logs; and outflow risk was not discussed when an external wallet was introduced. The Bureau also said the specific method had not yet been established, so these are findings about DMM’s controls, not a description of how the attack worked. The FSA’s later request to the industry association asked firms to check, among other things, that cold-wallet procedures involve several staff so that checks work in practice, not only that keys are held offline.
Questions a withdrawal-path review asks
These are the questions we put to any exchange whose wallet software, instruction servers or operator screens are run by a third party. They are our analysis of a structure the public record describes, not a statement that any company lacked a control.
Sources
- Kanto Local Finance Bureau, administrative order on DMM Bitcoin, 26 Sep 2024: lfb.mof.go.jp
- National Police Agency, press release and NPA/NISC/FSA alert, 24 Dec 2024: press release, alert
- FBI, DC3 and NPA joint statement, Japanese provisional translation: npa.go.jp (the English original on fbi.gov could not be read)
- Ginco, statement on a cyber attack on its service, 28 Jan 2025: ginco.co.jp
- DMM Bitcoin notices of 31 May, 5 Jun and 14 Jun 2024, 2 Dec 2024 and 13 Feb 2025, read from web.archive.org snapshots
- FSA letters to the industry association, 26 Sep and 24 Dec 2024: September, December
Dates are as printed on the sources, in Japan time; the US publication date of the FBI and DC3 statement was not read. Quotations were translated by us from Japanese. If you represent a company named here and see an error, write to research@deebug.io and we will correct it.