GMO cyberattack in Japan: trading accounts ransacked, GMO Coin says it was spared

Coin Encyclopedia Improve your knowledge of cryptos

All current Gate EU bonuses in one place, cumulative with the Rewards Hub (10,000+ USDC) Take advantage of Gate EU bonuses Commercial link

GMO Coin, the group's crypto exchange, issued a warning on October 23. It specifies that no unauthorized transaction has been confirmed at this stage on its customer accounts.

The exchange still asks its users to check their order history and balances, activate a passkey and connection notifications. Above all, she advises them to delete unused or unknown API keys. An API key is the key that allows third-party software, a bot for example, to place orders for you.

The group's stablecoins do not appear in any of the five reports published by GMO Internet. GYEN and ZUSD, issued by GMO Trust in New York, are being liquidated anyway. Their holders can redeem them at parity until November 11, 2026, with no known link to the attack.

It all started with a customer message on October 19. The next day, GMO Internet discovered malicious programs installed on certain servers. On October 21 at 4 a.m., the host cuts all offers.

The figure of 26,739 servers circulates a lot on X. It is correct, but it designates the machines potentially exposed. GMO specifies that this is not the number of servers actually compromised.

The problem is what these machines contained. Traders left their MT4 and MT5 software running there, permanently connected to their brokers, including their identifiers. Clients then saw orders placed that they had never given. The Japanese press cites an individual from Kanagawa who lost around 4 million yen in two seconds.

OANDA Japan, XMTrading, Titan FX, AXIORY and IronFX have asked their customers to change their passwords. From October 22, the Financial Services Agency (FSA) asked forex brokers, via their professional association, to monitor abnormal transactions.

GMO's fourth report, dated October 24, confirms that customer information was indeed exfiltrated. The company doesn't say which ones. She also reveals having received a ransom demand, the amount of which is not communicated.

The threats are detailed in the official GMO press release. The attacker promises to continue placing destructive orders on accounts opened at more than 70 Japanese and foreign brokers, publishing customer data and launching ransomware. This figure of 70 therefore comes from the pirate himself. No official report confirms this.

GMO refuses to pay and has referred its exchanges to the police. The group will reimburse losses made on fraudulent orders and pay 5,000 yen to each customer, affected or not. Service will not be restored.

Machine-translated from French