Cyberattack on GMO in Japan: Trading Accounts Compromised, GMO Coin Claims to be Unaffected

Trading bots turned against their owners. In Japan, GMO Internet has confirmed the theft of customer information from "Onamae.com Desktop Cloud," its virtual server service rented by thousands of forex traders to run MT4 and MT5. The in-house exchange GMO Coin reports no fraudulent activity on its own accounts.

Key points of this article:

• GMO Internet has confirmed the theft of customer information from its "Onamae.com Desktop Cloud" service, used by thousands of forex traders.
• GMO Coin, the group's crypto exchange platform, has been spared from fraudulent operations but has advised its users to take additional security measures.
• After discovering malware on some servers, GMO refused to pay a ransom and sought state intervention for active cyber defense.

GMO Coin Spared but Vigilant

GMO Coin, the group's crypto exchange platform, issued a warning on October 23. It stated that no unauthorized transactions have been confirmed at this stage on its customer accounts.

Nevertheless, the exchange asks its users to check their order history and balances, activate a passkey and connection notifications. Most importantly, it advises them to delete unused or unknown API keys. An API key is the key that allows third-party software, such as a bot, to place orders on your behalf.

The group's stablecoins do not appear in any of the five reports published by GMO Internet. GYEN and ZUSD, issued by GMO Trust in New York, are in the process of liquidation anyway. Their holders can redeem them at par until November 11, 2026, with no known connection to the attack.

What Happened on GMO's Servers

It all started with a customer message on October 19. The next day, GMO Internet discovered malware installed on some servers. On October 21 at 4 AM, the host shut down all services.

The figure of 26,739 servers is circulating widely on X. It is accurate, but it refers to the machines that were potentially exposed. GMO clarifies that this is not the number of servers that were actually compromised.

The problem lies in what these machines contained. Traders left their MT4 and MT5 software running, constantly connected to their brokers, including their credentials. Some clients then saw orders that they had never placed. The Japanese press cites an individual from Kanagawa who reportedly lost about 4 million yen in two seconds.

OANDA Japan, XMTrading, Titan FX, AXIORY, and IronFX have asked their clients to change their passwords. As of October 22, the Financial Services Agency (FSA) has asked forex brokers, through their professional association, to monitor for abnormal transactions.

Ransom Refused and Call to the State

GMO's fourth report, dated October 24, confirms that customer information has indeed been exfiltrated. The company does not specify which information. It also reveals that it received a ransom demand, the amount of which has not been disclosed.

The threats are detailed in GMO's official statement. The attacker promises to continue placing destructive orders on accounts opened with more than 70 Japanese and foreign brokers, to publish customer data, and to launch ransomware. This figure of 70 comes from the hacker themselves. No official assessment confirms it.

GMO refuses to pay and has forwarded its communications to the police. The group will reimburse losses incurred from fraudulent orders and will pay 5,000 yen to each affected or unaffected client. The service will not be restored.

【Important】Apology and notification regarding unauthorized access to "Onamae.com Desktop Cloud" (Report 4)

We sincerely apologize for the significant inconvenience and concern caused to our customers.

We report that we have decided on the following measures:
① We will pay all customers a consolation payment of 5,000 yen...
--- GMO Internet Group (@GMOGroup) October 24, 2026

Unusually, GMO has requested the government to implement active cyber defense, which came into effect on October 1. This law allows the police or Self-Defense Forces to remotely neutralize an attacker's servers. When questioned by the press, the government's secretary-general Minoru Kihara refused to comment on a specific case. According to him, the state will assess the appropriateness of a neutralization with or without the company's request.

According to Nikkei, the government is gathering concerned ministers this Monday evening to address a series of cyberattacks.

Crypto Bots and VPS: The Same Achilles' Heel

Replace MT5 with a grid trading bot and a forex broker with Binance. The scheme remains the same. Many crypto traders rent a VPS to run their scripts day and night, with API keys stored in plain text on the machine.

Japan knows the cost of these vulnerabilities. In May 2024, DMM Bitcoin lost 4,502.9 BTC, worth about 305 million dollars. The FBI and Japanese police attributed the theft to the North Korean group TraderTraitor, a branch of Lazarus. The exchange announced its closure in December 2024.

For GMO, nothing currently identifies the perpetrator. The method also differs. No one emptied a wallet. The hacker used the victims' access to destroy their capital with losing orders.

If a bot runs on a rented server, its API keys should never have withdrawal rights and should be limited to the IP address of that server. GMO clients will receive reimbursement details by November 6.