DMM Bitcoin May 2024 Incident Analysis

Context

When 4,503 BTC disappeared from DMM Bitcoin's cold wallet in May 2024, the public record offered limited detail. OneInfinity's R&D team traced the on-chain evidence to reconstruct what likely happened, and found a pattern of address manipulation and operational negligence that a standard security audit would have flagged.

Key takeaways

1. 1The exploited wallet used a two-of-three multi-signature scheme. Only two compromised or negligent signers were needed to authorise the transfer of 4,503 BTC. The on-chain evidence shows the transaction went through the standard signing flow, not around it.
2. 2The attacker's address shared the first four and last two characters with DMM Bitcoin's operational hot wallet. This is consistent with address poisoning, a technique designed to exploit visual verification during routine approvals. A signer checking only the beginning and end of the address would see a match.
3. 3DMM Bitcoin’s security practices relied on visual checking during cold-to-hot wallet transfers. Secure address whitelisting with cryptographic verification, transaction thresholds with automated alerts, and independent confirmation channels would have disrupted this attack at multiple points. OneInfinity’s underwriting process identifies exactly these gaps.

Contributors

• Rex ZhangOneInfinity
• OneInfinity R&D teamOneInfinity