DMM Bitcoin promised to replace 4,502 stolen BTC — then liquidated

DMM Bitcoin, the crypto arm of Japan's DMM group, held customer bitcoin in wallets serviced by outside infrastructure. In March 2024, according to the FBI and Japan's National Police Agency, a North Korean group known as TraderTraitor posed as a recruiter on LinkedIn and lured an employee of wallet provider Ginco into running a disguised GitHub 'recruitment test'. The compromise let the attackers impersonate Ginco's communications, pose as DMM staff and manipulate a legitimate transaction request. On 31 May 2024 the exchange confirmed an 'unauthorized leak': 4,502.9 BTC, about $305 million.

DMM's first answer was to make customers whole: all stolen customer deposits would be guaranteed, with the equivalent bitcoin procured with support from group companies. The hole proved too large to close that way. By late 2024 the exchange had abandoned its comeback: it announced liquidation of the business, stopped withdrawals, new accounts and trading, and began moving customer assets to SBI VC Trade, a subsidiary of the SBI group, with the transfer expected to complete by March 2025.

On 24 December 2024 the FBI and the Japanese police publicly attributed the theft to TraderTraitor, describing it as revenue generation for the North Korean regime. The exchange that had promised to buy back every coin ended as a queue of transfers to a competitor.