Trading robots turned against their owners. In Japan, GMO Internet confirms the theft of customer information on “Onamae.com Desktop Cloud”, its virtual server service rented by thousands of forex traders to run MT4 and MT5. The in-house exchange GMO Coin says it has not noticed any fraudulent transactions on its own accounts.
GMO Coin spared but on guard
GMO Coin, the group's crypto exchange, issued a warning on October 23. It specifies that no unauthorized transaction has been confirmed at this stage on its customer accounts.
The exchange still asks its users to check their order history and balances, activate a passkey and connection notifications. Above all, she advises them to delete unused or unknown API keys. An API key is the key that allows third-party software, a bot for example, to place orders for you.
The group's stablecoins do not appear in any of the five reports published by GMO Internet. GYEN and ZUSD, issued by GMO Trust in New York, are being liquidated anyway. Their holders can redeem them at parity until November 11, 2026, with no known link to the attack.
What happened on GMO servers
It all started with a customer message on October 19. The next day, GMO Internet discovered malicious programs installed on certain servers. On October 21 at 4 a.m., the host cuts all offers.
The figure of 26,739 servers circulates a lot on X. It is correct, but it designates the machines potentially exposed. GMO specifies that this is not the number of servers actually compromised.
The problem is what these machines contained. Traders left their MT4 and MT5 software running there, permanently connected to their brokers, including their identifiers. Clients then saw orders placed that they had never given. The Japanese press cites an individual from Kanagawa who lost around 4 million yen in two seconds.
OANDA Japan, XMTrading, Titan FX, AXIORY and IronFX have asked their customers to change their passwords. As of October 22, the Financial Services Agency (FSA) has asked forex brokers, through their professional association, to monitor abnormal transactions.
Ransom refused and appeal to the State
GMO's fourth report, dated October 24, confirms that customer information was indeed exfiltrated. The company doesn't say which ones. She also reveals having received a ransom demand, the amount of which is not communicated.
The threats are detailed in the official GMO press release. The attacker promises to continue placing destructive orders on accounts opened at more than 70 Japanese and foreign brokers, publishing customer data and launching ransomware. This figure of 70 therefore comes from the pirate himself. No official report confirms this.
GMO refuses to pay and has referred its exchanges to the police. The group will reimburse losses made on fraudulent orders and pay 5,000 yen to each customer, affected or not. Service will not be restored.
More unusual, GMO asked the government to apply active cyber defense, which came into force on October 1. This law authorizes the police or the Self-Defense Forces to remotely neutralize an attacker's servers. Questioned by the press, Secretary General of the Government Minoru Kihara refused to comment on a particular case. According to him, the State will judge the advisability of neutralization with or without a request from the company.
According to Nikkei, the government is bringing together the relevant ministers this Monday evening to deal with a series of cyberattacks.
Crypto bots and VPS: the same Achilles heel
Replace MT5 with grid trading bot and forex broker with Binance. The diagram remains the same. Many crypto traders rent a VPS to run their scripts day and night, with API keys stored in the clear on the machine.
Japan knows the price of these flaws. In May 2024, DMM Bitcoin lost 4,502.9 BTC, or approximately $305 million. The FBI and Japanese police attributed the theft to the North Korean group TraderTraitor, an arm of Lazarus. The exchange announced its closure in December 2024.
For GMO, there is nothing to identify the author to date. The method also differs. No one emptied a wallet. The hacker used the victims' access to destroy their capital with losing orders.
If a bot runs on a rented server, its API keys should never have the right to withdraw and should be limited to the IP address of that server. GMO customers will receive refund details by November 6.
