Authorities in Japan and the United States have accused North Korean hackers of orchestrating a massive cryptocurrency theft, targeting the Japan-based exchange DMM Bitcoin. The heist, valued at over $300 million, was allegedly executed by the TraderTraitor group, which is believed to be part of the notorious Lazarus Group, reportedly linked to North Korea’s regime.
The National Police Agency of Japan and the FBI have confirmed the group’s involvement, highlighting the sophisticated tactics employed in the attack. The FBI revealed that the hackers used a social engineering strategy, where a member of the group posed as a recruiter on LinkedIn to approach an employee of a crypto wallet software company. Under the guise of a pre-employment test, the hacker sent a malicious code embedded in a file, compromising the employee’s system.
In May 2024, the attackers allegedly leveraged this breach to manipulate a legitimate transaction request, resulting in the theft of 4,502.9 Bitcoin, valued at $308 million at the time.
This incident underscores North Korea’s reliance on cybercrime as a source of revenue. The country’s cyber-warfare capabilities, which reportedly began in the mid-1990s, have since expanded into a 6,000-strong unit known as Bureau 121, operating from multiple international locations.
Both the FBI and Japan’s National Police Agency are actively collaborating with global partners to counter North Korea’s cyber activities, emphasizing the need for vigilance against such threats. The Lazarus Group, infamous for its role in the 2014 Sony Pictures hack, remains a persistent cyber threat linked to high-profile financial crimes worldwide.
