FBI reveals North Korea used LinkedIn to steal $305 million from Japan’s DMM Bitcoin
North Korean-linked hackers, identified as TraderTraitor (also known as Jade Sleet, UNC4899, and Slow Pisces), orchestrated a $305 million breach of the Japanese crypto exchange DMM Bitcoin in May 2024. The attack involved sophisticated social engineering targeting employees of Ginco, a crypto wallet software firm. A North Korean operative posed as a recruiter on LinkedIn, sharing a malicious Python script that compromised an employee's session cookie data. This allowed the hacker to impersonate the employee and manipulate a transaction request, resulting in the theft of 4,502.9 BTC. The breach has been linked to the Lazarus Group, known for significant crypto heists. DMM Bitcoin plans to cease operations by March 2025 and has halted withdrawals and trading, intending to transfer all funds to SBI VC Trade. North Korean hackers have stolen over $1.3 billion in 47 incidents this year.
