DMM Bitcoin: the trap begins with a recruitment proposal

A person contacted on a professional network believes to exchange with a recruiter. The proposed exercise must show its skills. According to the joint FBI, US Department of Defense and Japanese police investigation, this approach paves the way for a major theft at DMM Bitcoin.

The initial target is not directly a client of the platform: it is an employee of Ginco, a provider of portfolio management services. The file transmitted under cover of recruitment compromises its environment. Attackers then exploit session information to impersonate him.

They access internal communications and, according to the authorities, can manipulate a legitimate transaction request. On May 31, 2024, 4,502.9 bitcoins were transferred without authorization, with an estimated value of about $308 million.

The incident becomes visible by the exit of assets and leads DMM Bitcoin to restrict operations. Investigations link the path of the attack to the provider’s environment. They show that a company can suffer the consequences of a compromised identity in a partner.

The authorities attribute the operation to TraderTraitor, actors linked to North Korea. DMM Bitcoin then announces a takeover of customers’ assets and, in December 2024, the cessation of its activity after planned transfer of accounts to another operator.

The breakage reminds that a front door can look like a career opportunity. The decisive point is not the reassuring appearance of the contact: it is the access then obtained to people and procedures capable of moving real funds.