FBI, DC3, and NPA Track $308 Million Cryptocurrency Theft to North Korean Hackers

### Executive Summary The FBI, DC3, and Japan's NPA linked a May 2024 theft of 4,502.9 BTC (~$308M) from DMM to North Korean cyber actors (tracked as TraderTraitor/UNC4899); attackers used social engineering to lure a Ginco employee into hosting a malicious Python script, deployed malware to steal session cookies and credentials, and then impersonated the employee to redirect a legitimate cryptocurrency transaction. Investigations are ongoing and highlight a broader nation-state-driven campaign of cybercrime targeting the cryptocurrency sector.