Article
TraderTraitor: North Korea’s Crypto Heist Machine
TraderTraitor profile (Jade Sleet, UNC4899): North Korea-aligned, part of Lazarus, with crypto theft, trojanized developer tools and supply chain abuse.
Read more
Significant cyber incident
DMM Bitcoin crypto theft, 2024
In May 2024 about 4,502.9 BTC, worth about 48.2 billion yen, left the wallets of the Japanese crypto exchange DMM Bitcoin without authorization.
In short
In May 2024 about 4,502.9 BTC, worth about 48.2 billion yen, left the wallets of the Japanese crypto exchange DMM Bitcoin without authorization. On 24 December 2024 Japan's National Police Agency (NPA), the US FBI and the US Defense Department's Cyber Crime Center said North Korean actors called TraderTraitor did it. The NPA says the attackers began by posing as a recruiter on LinkedIn and approaching an employee of a wallet software company.
What happened
DMM Bitcoin was a crypto-asset exchange in Japan. In May 2024 crypto assets it managed were sent out without authorization, and 4,502.9 BTC of customer assets flowed out. The Kanto Local Finance Bureau, the regulator, dates the unauthorized transfer to 31 May 2024. The FSA’s English summary gives 13 May 2024, so the sources differ on this date.
The Bureau asked for reports from the company on 31 May and 2 July 2024. By 26 September 2024 it said those reports had still not made the facts clear. It also said the exact method of the outflow had not yet been established.
On 24 December 2024 the NPA, the FBI and the US Department of Defense Cyber Crime Center (DC3) named TraderTraitor as the actor. The NPA says that in late March 2024 the actor posed as a recruiter on LinkedIn and approached an employee of a Japanese company that makes crypto wallet software. The employee was sent a link to a harmful Python script presented as a pre-hiring test. The employee copied the code to their own GitHub page and was compromised.
From mid-May 2024 the actor used session cookie information to act as that employee. It reached the wallet software company’s unencrypted communication system. In late May it is judged to have used that access to tamper with a legitimate transaction request made by a DMM employee. The stolen assets ended up in wallets controlled by TraderTraitor.
Timeline
-
Late March 2024
The NPA says the actor posed as a recruiter on LinkedIn and approached an employee of a Japanese company that makes wallet software for businesses.
-
Late March 2024
The employee was sent a link to a harmful Python script described as a pre-hiring test, copied it to their own GitHub page and was compromised.
-
Mid-May 2024
From this point the actor used session cookie information to act as the compromised employee and reached the company's unencrypted communication system.
-
13 May 2024
The FSA's English summary gives this date for the unauthorized transfer. The Kanto order gives 31 May, so the sources differ.
-
Late May 2024
The NPA says the actor used the access to tamper with a legitimate transaction request by a DMM employee. 4,502.9 BTC was lost.
-
31 May 2024
The Kanto Local Finance Bureau dates the unauthorized transfer to this day and orders DMM Bitcoin to report under the Payment Services Act.
-
2 July 2024
The Bureau orders a second report from DMM Bitcoin.
-
3 September 2024
The FBI publishes a note on North Korean social engineering against crypto firms.
-
26 September 2024
The Kanto Local Finance Bureau issues a business improvement order to DMM Bitcoin after an on-site inspection.
-
26 September 2024
The FSA asks the Japanese crypto exchange association to have its members check their own response to outflow risk.
-
24 December 2024
The NPA, FBI and DC3 name TraderTraitor. The NPA, NISC and FSA publish a joint alert with attack examples and mitigations.
How the attack worked
The official account comes from the NPA and its US partners. They describe a chain that started with a person, not with a software flaw. They do not give ATT&CK technique numbers. The approach through a social network matches Spearphishing via Service (T1566.003) in MITRE ATT&CK.
Step 1: a fake recruiter
In late March 2024 the actor contacted an employee of a Japanese wallet software company on LinkedIn, posing as a recruiter. The NPA says TraderTraitor’s method is targeted social engineering against several employees of the same firm at the same time.
Step 2: a harmful test
The employee was sent a link to a Python script on GitHub, described as a pre-hiring test. The employee copied the code to their own GitHub page and was compromised. The NPA alert adds that such actors may ask to move the chat to another app, and may ask the target to run or fix a small program.
Step 3: stolen sessions
From mid-May 2024 the actor used session cookie information to act as the compromised employee. The NPA alert says credentials and session cookies kept on an infected PC can be used to reach crypto systems while posing as the target. The actor reached the wallet company’s unencrypted communication system.
Step 4: a changed transaction
In late May the actor is judged to have used that access to tamper with a legitimate transaction request by a DMM employee. 4,502.9 BTC was lost. The assets were then moved to wallets controlled by TraderTraitor.
Weak points the regulator found at DMM Bitcoin
The Kanto bureau looked at DMM Bitcoin itself and found that one person did the signing work for crypto transfers, that private keys were managed in bulk against FSA guidance, that no executive was in charge of systems, that the firm had not considered how long to keep logs, and that internal audit was not independent. The Bureau said these problems needed fixing whatever the exact method of the theft turned out to be.
- Fake recruiterThe actor contacts a wallet software employee on LinkedIn, posing as a recruiterTechnique T1566.003 (MITRE ATT&CK, opens in a new tab)
- Harmful testA link to a Python script presented as a hiring test; the employee copies the code and is compromised
- Session theftFrom mid-May the actor uses session cookie information to act as the employee
- Reach the wallet systemThe actor reaches the wallet software company’s unencrypted communication system
- Alter a transactionIn late May a legitimate DMM transaction request is tampered with
- Funds moved4,502.9 BTC ends up in wallets controlled by TraderTraitor
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the NPA, the FBI and the US Department of Defense Cyber Crime Center (DC3), 24 December 2024, to North Korean actors called TraderTraitor. The NPA says TraderTraitor is considered part of the Lazarus Group, which is said to be subordinate to the North Korean authorities. The attribution came seven months after the theft. In September 2024, when the Kanto bureau issued its order, it said the method of the outflow had not yet been established.
Impact
4,502.9 BTC of customer assets left DMM Bitcoin. The NPA puts this at about 48.2 billion yen at the time; the joint FBI, DC3 and NPA text puts it at 308 million US dollars. The Kanto Local Finance Bureau issued a business improvement order on 26 September 2024. The official pages opened do not say how customers were repaid or what happened to DMM Bitcoin's business afterwards, so this page does not report it.
Government and regulator response
- 31 May and 2 July 2024: the Kanto Local Finance Bureau ordered reports from DMM Bitcoin under the Payment Services Act.
- 26 September 2024: after an on-site inspection the Bureau issued a business improvement order. It required DMM Bitcoin to establish the facts and root cause, keep protecting affected customers and explain to them, strengthen system risk management, set up a proper response to outflow risk, and clarify management responsibility.
- 26 September 2024: the FSA asked the Japan Virtual and Crypto assets Exchange Association to raise awareness among exchange operators and have them run self-inspections on outflow risk.
- 24 December 2024: the NPA, FBI and DC3 named TraderTraitor. The NPA, NISC and FSA published an alert with attack examples and mitigations for crypto firms.
Lessons
-
A hiring approach can be an attack
The first step was a fake recruiter on LinkedIn. Staff who hold access to wallet or payment systems need to know that job offers and coding tests can be the lure.
-
Personal repositories and work access do not mix
The employee copied the code to a personal GitHub page and was compromised. Work with sensitive systems should not run on personal accounts or machines.
-
A stolen session can replace a stolen password
The actor used session cookie information to act as the employee. Multi-factor authentication helps, and so does watching for sessions from unusual devices and places.
-
Transfers need more than one pair of eyes
The Bureau found that one person did the signing work and that private keys were managed in bulk. Splitting signing duties and spreading keys limit what one compromise can move.
-
Keep the logs that you will need later
The Bureau found that DMM Bitcoin had not decided how long to keep evidence logs. The NPA advises central log storage so logs survive a clean-up by malware.
-
Regulators look at the whole control system
The order covered management, audit independence and system risk, not only the theft itself.
What to check in your own organization
-
Recruiter and test approaches
Tell staff with wallet, payment or admin access that unsolicited recruiters and coding tests are a known lure. Ask them to report and to ask for a video call, as the NPA advises.
-
Where test code runs
Make sure code from outsiders is never run on a work PC. Use a virtual machine, and read the code first.
-
Session and device checks
Alert on logins and sessions from devices that are not company-issued, from unusual places or at unusual hours, as the NPA alert suggests.
-
Multi-factor authentication
Confirm that every system that can move assets or approve payments needs multi-factor authentication.
-
Signing and key handling
Check that no single person can sign and release a transfer, and that keys are not all held in one place.
-
Log retention
Check that logs are stored centrally and kept long enough to reconstruct a theft after the event.
-
Independent audit
Check that internal audit is independent of the teams it reviews and covers system security.
-
Contact route
Know whom you would call at your regulator and national police before an incident, and keep a clean-up plan that isolates a suspect PC while keeping it powered on.
Where it happened
- Industry Financial services Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.
- Country Japan Japan faces cyber espionage linked by its police to China and North Korea, ransomware against manufacturers and smaller firms, and theft of crypto assets. Asia Pacific
Questions
How much was stolen from DMM Bitcoin?
4,502.9 BTC. The NPA puts this at about 48.2 billion yen at the time. The joint FBI, DC3 and NPA text puts it at 308 million US dollars.
Who was behind it?
On 24 December 2024 the NPA, the FBI and DC3 attributed it to North Korean actors called TraderTraitor. The NPA says this group is considered part of the Lazarus Group.
How did the attackers get in?
The NPA says they posed as a recruiter on LinkedIn, sent an employee of a wallet software company a harmful Python script as a hiring test, and then used session cookie information to act as that employee.
When did it happen?
Sources differ on the date of the transfer. The Kanto Local Finance Bureau says 31 May 2024. The FSA's English summary says 13 May 2024. The NPA says the attackers tampered with a transaction in late May.
What did the regulator do?
On 26 September 2024 the Kanto Local Finance Bureau issued a business improvement order after an on-site inspection. It found serious gaps in system risk management and in handling outflow risk.
Did the attack use a software vulnerability?
The official sources opened do not describe one. They describe social engineering, a harmful script, stolen session information and a changed transaction request.
Sources
- Alert on TraderTraitor attacks on crypto-asset businesses (24 December 2024) National Police Agency, Japan
- Alert: Cyberattack by North Korean Cyber Actors, TraderTraitor (provisional translation) National Police Agency, Japan
- Press release on TraderTraitor and the DMM Bitcoin theft (24 December 2024) National Police Agency, Japan
- Provisional translation of the joint FBI, DC3 and NPA text (24 December 2024) National Police Agency, Japan
- Alert on cyberattacks by TraderTraitor, with examples and mitigations (24 December 2024) NPA, NISC and FSA, Japan
- Administrative action against DMM Bitcoin (26 September 2024) Kanto Local Finance Bureau, Ministry of Finance, Japan
- FSA Weekly Review No. 605 (September 2024) Financial Services Agency, Japan
- TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies CISA
- Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet, Group G0032 | MITRE ATT&CK MITRE
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.