DMM Bitcoin hack
About $305M (4,502.9 BTC) was stolen from the Japanese exchange DMM Bitcoin in May 2024. The FBI, DC3, and Japan's NPA attributed it to North Korea's TraderTraitor, which used a fake-recruiter lure to compromise an employee at wallet vendor Ginco. DMM later wound down.
Also known as: DMM Bitcoin, Bitcoin.DMM.com
Summary
In May 2024, the Japan-based exchange DMM Bitcoin lost 4,502.9 BTC — about $305 million at the time — in an "unauthorized leak," at the time the largest crypto theft since FTX and the second-largest in Japan after Coincheck. DMM pledged to make customers whole with group-company support and later announced it would wind down. [1][2]
Attribution and method
In December 2024 the FBI, the DoD Cyber Crime Center, and Japan's National Police Agency attributed the theft to North Korea's TraderTraitor. According to the agencies, a threat actor posing as a recruiter on LinkedIn sent a malicious "pre-employment test" to an employee at Ginco, a Japanese wallet-software vendor; the attackers then used stolen session data to manipulate a legitimate DMM transaction and divert the funds. [1][3]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
