Rain.com

Date (as written): 2024-04
Year: 2024
Country: Bahamas
Actors (as written): APT38
Actor pages: APT38
Tags (as written): Cryptocurrency FinancialGain
Dollar figures (as written): $16,300,000; 16.1 ($ Million); $16.13 million; $308 million; $50 million; approximately $16.13 million (valued at the time of relevant transfers); approximately $760,997.68 in SOL; approximately 2210.8222 SOL; $760,997.68; $14,800,000

Source entries (6)

lazarus.day

Rain.com · 2024-04

Rain disclosed and contained a cryptocurrency exchange security incident after reporting indicated the Bahrain-headquartered platform lost crypto assets in a confirmed exploit, while Rain stated customer fiat and crypto assets remained fully accounted for and held one-to-one under custody. Linked legal and policy evidence connects the case to cryptocurrency-enabled cybercrime tracing and broader DPRK-linked virtual-asset theft concerns, with existing incident attribution preserved as APT38.

https://lazarus.day/incidents/rain/

tayvano/lazarus-bluenoroff-research

Rain · 2024-04-29

Amt Stolen: $16,300,000

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/rain.md

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Rain · 2024-04-29

Table 2: DPRK Cryptocurrency Thefts, January - December, 2024. Date: 2024-04-29; Victim: Rain; DPRK APT: CryptoCore; Amount ($ Million): 16.1. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

US-Japan-ROK Joint Statement on Cryptocurrency Thefts by the DPRK, 2025-01-14 (US State Dept)

Rain Management · 2024 (attributed in 2024)

In 2024 alone, our governments have individually and jointly attributed multiple thefts, denominated in virtual asset value in U.S. dollars, to the DPRK: DMM Bitcoin for $308 million, Upbit for $50 million, and Rain Management for $16.13 million.

https://2021-2025.state.gov/office-of-the-spokesperson/releases/2025/01/joint-statement-on-cryptocurrency-thefts-by-the-democratic-peoples-republic-of-korea-and-public-private-collaboration

US court filing via CourtListener RECAP: United States v. APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY

Rain.com hot-wallet theft after employee device compromised by malware (TraderTraitor-type social engineering); funds traced to WhiteBIT · On or about April 29, 2024

On or about April 29, 2024, Rain.com was targeted by North Koreans Lazarus Group/APT38 actors using TraderTraitor malware. That targeting resulted in a financial loss to Rain.com of approximately $16.13 million (valued at the time of relevant transfers), including approximately $760,997.68 in SOL (valued at the time of relevant transfers). [Case No. 1:24-cv-03375, U.S. District Court for the District of Columbia; filing: AMENDED COMPLAINT For Forfeiture In Rem against APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY filed by UNITED STATES OF ]

https://storage.courtlistener.com/recap/gov.uscourts.dcd.275374/gov.uscourts.dcd.275374.10.0.pdf

SlowMist 2024 Blockchain Security and Anti-Money Laundering Annual Report, section 3.3 DPRK (table 'attributed to DPRK-affiliated groups, with data from SlowMist Hacked')

Rain · Apr-29, 2024

The following is a chronological list of significant incidents attributed to DPRK-affiliated groups, with data from SlowMist Hacked: ... Apr-29, 2024 Rain $14,800,000

https://www.slowmist.com/report/2024-Blockchain-Security-and-AML-Annual-Report(EN).pdf

Suggest a correction on GitHub