Skip to main content

Korea Criminals Nab a Bit of Coin: $308M Stolen by North Korean Hackers!


In a shocking revelation, Japanese and U.S. authorities have officially linked the $308 million cryptocurrency heist from DMM Bitcoin in May 2024 to North Korean cyber actors. These attackers, part of the TraderTraitor group (also known as Jade Sleet, UNC4899, or Slow Pisces), used sophisticated tactics to pull off this massive theft.

Who’s Behind It? 

TraderTraitor is notorious for:

  • Social Engineering: Targeting multiple employees simultaneously to breach systems.
  • Malware-Laced Apps: Disguising malicious tools as cryptocurrency-related software.
  • Sophisticated Scams: Pretending to be recruiters or collaborators, even on platforms like GitHub.

How They Did It 

Targeting Employees

In March 2024, a Ginco employee (a Japanese crypto wallet company) was duped by a fake recruiter into running a malicious Python script, setting the stage for the attack.

Compromising Systems

With the script, attackers gained access to Ginco’s communication systems using session cookies.

Exploiting Transactions

By May 2024, the attackers manipulated a legitimate transaction from DMM Bitcoin, successfully stealing 4,502.9 BTC (valued at $308M).

Where Did the Money Go? 

The stolen funds were funneled into TraderTraitor-controlled wallets and laundered using:

  • Bitcoin CoinJoin Mixing Services: To obscure transaction trails.
  • Bridging Services: To further shuffle the stolen money.
    Eventually, the funds ended up with HuiOne Guarantee, a company with ties to cybercrime operations.

What’s Next?

This heist is just the latest in a string of North Korean cyber activities, including:

  • Lazarus Group’s SmallTiger Backdoor: Targeting South Korean firms.
  • Web3 Sector Attacks: Focusing on decentralized platforms and cryptocurrency technologies.

How to Stay Safe 

Tips for Protection:

  • Verify Recruiters: Be wary of unsolicited job offers or collaborations, especially in cryptocurrency and tech.
  • Double-Check URLs: Ensure links are legitimate before clicking or downloading.
  • Secure Your Systems: Regularly update software and monitor for unusual activity.

As the Web3 ecosystem grows, so does the risk of these highly sophisticated attacks. Stay vigilant—don’t let these hackers outsmart you! 

Comments

Post a Comment

Popular posts from this blog

FBI Creates Fake Cryptocurrency to Bust Crypto Market Scams

In an unprecedented sting operation, the FBI has taken down a massive cryptocurrency fraud network by launching its own fake crypto token, NexFundAI . This cleverly disguised operation, part of Operation Token Mirrors , exposed illegal trading schemes like wash trading and pump-and-dump scams —and scammers are paying the price. How It Worked   The FBI created NexFundAI , a fake cryptocurrency marketed as a revolutionary bridge between finance and artificial intelligence . Behind the scenes, however, it was a trap designed to attract scammers engaged in market manipulation . Wash Trading : Scammers used fake trades with their own tokens to inflate the token's price, luring unsuspecting investors into buying. Once prices peaked, the fraudsters sold off their tokens for profit, leaving regular investors with worthless assets. Who Got Caught?   The operation led to the arrest of 18 individuals and entities involved in market manipulation schemes. Among those charged were major ...
Post a Comment
Read more

SPF 50 Won’t Even Protect You: Email Spoofing Surge Fuels Malspam Attacks!

Cybercriminals are ramping up email spoofing attacks , faking sender addresses to bypass security filters and trick victims into engaging with malicious content . While protocols like DKIM, DMARC, and SPF were designed to prevent spoofing, attackers are now exploiting neglected domains to slip past modern defenses. Old Tricks, New Domains   Hackers are leveraging abandoned or misconfigured domains to send fraudulent emails. These domains, unused for years, lack proper DNS records, allowing them to bypass email security systems undetected . Tactics in Play   Cybercriminals are using a mix of techniques to deceive users: Phishing with QR Codes : Fake tax-related emails (mainly in Mandarin) contain QR codes linking to phishing sites designed to steal IDs and card details . Brand Spoofs : Attackers impersonate trusted companies like Amazon, Mastercard, and SMBC , tricking users into entering credentials on fraudulent login pages. Extortion Scams : Fake emails claim hackers reco...
Post a Comment
Read more

DeepSeek and Destroy: AI Startup Exposes Sensitive Data in Major Security Breach!

DeepSeek , one of AI’s rising stars, just made a major security blunder—accidentally leaving a database wide open on the internet , exposing chat histories, secret keys, backend access, and more! This AI data leak raises serious concerns about security in the fast-growing AI industry. What Was Exposed?   Security researcher Gal Nagli (Wiz) discovered that DeepSeek’s ClickHouse database was completely accessible without any login , exposing: 1M+ log entries   Chat history & secret keys   Backend & API secrets   Full database control   This means hackers could have taken over DeepSeek’s systems with a simple web browser request!   Fixed… But Was It Too Late?   DeepSeek closed the security hole after Wiz reached out, but no one knows if cybercriminals got in first . The exposed database could have been a goldmine for espionage, AI manipulation, or unauthorized access to DeepSeek’s systems. AI’s Growing Pains  DeepSeek’s R1 reasoning mo...
Post a Comment
Read more