Japan, US blame North Koreans for US$300 million crypto theft

The TraderTraitor group – believed to be part of Lazarus Group, which is allegedly linked to the Pyongyang authorities – carried out the heist

    • It described a “targeted social engineering” operation where a hacker pretended to be a recruiter on LinkedIn to contact an employee of a different crypto wallet software company.
    • It described a “targeted social engineering” operation where a hacker pretended to be a recruiter on LinkedIn to contact an employee of a different crypto wallet software company. PHOTO: AFP
    Published Tue, Dec 24, 2024 · 11:46 AM

    A NORTH Korean hacking group stole cryptocurrency worth over US$300 million from the Japan-based exchange DMM Bitcoin, according to Japanese police and the United States’ FBI.

    The TraderTraitor group – believed to be part of Lazarus Group, which is allegedly linked to the Pyongyang authorities – carried out the heist, Japan’s National Police Agency said on Tuesday (Dec 24).

    Lazarus Group gained notoriety a decade ago when it was accused of hacking into Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong Un.

    The FBI detailed “the theft of cryptocurrency worth US$308 million dollars from the Japan-based cryptocurrency company DMM by North Korean cyber actors” in a separate statement dated on Monday.

    It described a “targeted social engineering” operation where a hacker pretended to be a recruiter on LinkedIn to contact an employee of a different crypto wallet software company.

    They sent the employee what appeared to be a pre-employment test, which actually contained a malicious line of code.

    BT in your inbox

    Start and end each day with the latest news stories and analyses delivered straight to your inbox.

    That allowed the hacker to compromise their system and impersonate the employee, the FBI said.

    “In late May 2024, the actors likely used this access to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 Bitcoin, worth US$308 million at the time,” it said.

    “The FBI, National Police Agency of Japan, and other US government and international partners will continue to expose and combat North Korea’s use of illicit activities – including cybercrime and cryptocurrency theft – to generate revenue for the regime,” it said.

    North Korea’s cyber-warfare programme dates back to at least the mid-1990s.

    It has since grown to a 6,000-strong cyber-warfare unit known as Bureau 121 that operates from several countries, according to a 2020 US military report. AFP

    Share with us your feedback on BT's products and services