DMM Bitcoin outflow incident detailed analysis（2024-05）— 4,502.9 BTC attributed to Lazarus

Wiki route

This entry sits under exchanges index. Read it against Coincheck Nem Hack Detailed Analysis for peer / contrast context and FSA crypto-asset exchange registration system — number system / Local Finance Bureau jurisdiction / registration requirements for the broader system / regulatory boundary.

1. Incident overview

On the evening of 2024-05-31, 4,502.9 BTC（equivalent to approx. 482 億円）was illicitly drained from DMM Bitcoin. At the time, it was the largest domestic outflow incident after the jp-exchange-coincheck NEM incident（2018, 580 億円）. It was later attributed, in a joint statement by the FBI + the National Police Agency + DC3 （the US Department of Defense Cyber Crime Center）in 2024-12 , to TraderTraitor（a unit under North Korea’s Lazarus）.

2. Technical cause (within publicly available information)

• The presumed path was a social-engineering attack via a contractor / outsourced-vendor system
• An operational error in the hot-key management process was a contributing factor
• The detailed intrusion path is undisclosed as the investigation continues
• Segregated management of customer assets was functioning; the outflow was limited to the company’s own assets (per DMM’s claim)

3. Emergency response + protection of customer assets

• 2024-05-31 Halted all crypto-asset trading
• 2024-06-05 DMM Bitcoin raised funds from its own group and procured, in the market, BTC equivalent to the customer-asset portion to safeguard it
• 2024-09 fsa-business-improvement-orders-history issued a business-improvement order
• 2024-12-01 Full service suspension + announcement of business closure
• 2025-03-08 Transfer of customer assets / accounts to jp-exchange-sbi-vc-trade completed; the DMM Bitcoin legal entity dissolved

4. Attribution confirmation (Lazarus / TraderTraitor)

• 2024-12-23 A joint statement by the FBI + the National Police Agency + DC3 formally attributed it as “carried out by TraderTraitor（under Lazarus）”
• As a North Korea state-linked crypto-asset theft, it was among the largest in scale for 2024 年
• In coordination with forensic vendors such as Chainalysis, fund-flow tracing continues
• Blocking off-ramping via mixers is a challenge

5. Institutional significance

• The business-closure + transfer-to-competitor model — this is the 3 pattern（Coincheck 2018 = absorbed via subsidiary-ization; FTX Japan 2023 = survived through segregated management + 100% returns; DMM 2024 = closure + transfer）
• Highlighted contractor / outsourcing risk（an argument running parallel to the EU CTPP / DORA）
• Domestic substantiation of the global Lazarus threat
• Regulatory revision underway（strengthening outsourcing management toward 2026 ）

Related

• jp-exchange-dmm-bitcoin
• jp-exchange-sbi-vc-trade
• jp-vasp-incident-history
• coincheck-nem-hack-detailed-analysis（comparison）
• fsa-business-improvement-orders-history
• jp-vasp-ma-consolidation-history
• forensic identity anchor chain
• bytecode forensic 3-tier verify
• Bybit Lazarus Hack Detailed Analysis
• Global crypto-asset forensics-vendor layer — Chainalysis / Elliptic / TRM / Crystal comparison

Source: compilation of public information（DMM Bitcoin/SBI VC Trade IR disclosures, FSA business-improvement order, National Police Agency/NPA announcements, Chainalysis/Elliptic public traces, Lazarus-group tracking reports）