The GMO Internet cyberattack hit the servers Japanese retail traders rent to run their trading bots, not a crypto exchange. GMO Internet said on 21 October that malware had been found in customer environments of Onamae.com Desktop Cloud, its Windows virtual server service, and that 26,739 servers may have been exposed. In its fourth report, current as of 11:50 Tokyo time on 24 October, the company confirmed that customer information had been taken outside, said it had received a demand for money it will not pay, and promised every current customer a flat 5,000 yen (about $32) plus compensation for trades it confirms as unauthorised, according to the GMO group alert.
The damage did not happen inside GMO’s walls. Customers used these rented machines to keep MetaTrader 4 and MetaTrader 5 running day and night, with their broker logins saved on them. Once the attackers were in, those saved logins let them place losing trades in customers’ accounts at third-party FX and securities brokers. Some users have reported balances wiped out in minutes.
GMO Coin, the regulated crypto exchange of the same group, said it had so far found no unauthorised activity in its customer accounts, as reported by TokenPost on 24 October. No source has said why its clients appear untouched. The exchange still told users to delete API keys they no longer use or do not recognise.
26,739 servers shut down: the timeline of the Onamae.com Desktop Cloud breach
GMO’s own notices give a day-by-day account. The investigation started on 19 October, after a customer inquiry. The next day staff found an unauthorised program installed in some customer server environments, and GMO suspended new sign-ups and the control panel.
At 04:00 Japan time on 21 October, GMO began shutting down the servers of every Desktop Cloud plan, one after another. Its first notice on Onamae.com gave the figure of 26,739 servers that may have been affected and warned that information stored on them may have been viewed. At that point it had not confirmed any leak of personal data. It noted that it holds no card payment details for the service, and it set no date for a restart.
That 26,739 figure is the number of servers potentially in scope. It is not a count of victims, and GMO has not said how many machines were actually infected.
From 21 October customers began reporting operations they did not recognise in their brokerage and FX accounts. GMO shared the details with partner firms and asked them to help warn users. On 22 October it consulted the police and published a second report at 16:59. A third followed on 23 October at 16:10.
The fourth report, on 24 October, changed the scale of the story. GMO wrote that it had confirmed unauthorised access to its environment and that customer information had been carried out of it. It did not say how much, or which fields.
| Date (Japan time) | What GMO reported |
|---|---|
| 19 Oct | Investigation starts after a customer inquiry |
| 20 Oct | Unauthorised program found on some customer servers; sign-ups and control panel suspended |
| 21 Oct, 04:00 | All plans shut down in sequence; 26,739 servers possibly affected; first report |
| 21 Oct onward | Customers report unknown activity in brokerage and FX accounts |
| 22 Oct, 16:59 | Police consulted; second report |
| 23 Oct, 16:10 | Third report |
| 24 Oct (as of 11:50) | Fourth report: data taken, ransom demand refused, compensation plan |
| 30 Oct, 23:59 | Deadline for emails on the 5,000 yen payment and the replacement service |
| 6 Nov | Deadline to publish how to claim compensation for losses |
How the attackers got in: saved logins on rented servers
A desktop cloud is a Windows computer that lives in a data centre. Traders rent one so that their expert advisers, the automated strategies of MetaTrader, keep running when their own PC is off. To do that, the trading platform has to stay logged in to the broker. So the broker credentials sit on the rented machine.
That is what made this breach costly. An attacker who controls the server does not need to phish anyone. The platform is already open and authenticated. GMO’s first instruction to customers was to change every ID and password stored or used on those servers, and the same passwords anywhere else they had been reused.
GMO has not published the entry route. It has not said whether the malicious program came through a flaw in its own infrastructure, a shared management tool or something else, and it has not named the attacker.
The losses reported so far come from individual users, not from GMO or the brokers. J-CAST, quoted on Infoseek News on 26 October, described one trader who found about 3 million yen gone from a securities account during a routine morning balance check, a total loss in the trader’s words, and another who saw 1.8 million yen drop to zero after reading similar posts on X. Neither account was tied to a named broker. Bitcoin.com, citing the Asahi Shimbun, reported about 2.4 million yen lost through repeated trades in roughly 84 seconds. South Korea’s Financial News, summarising Japanese reports, described a Hiroshima office worker in his 60s whose FX balance fell from about 4 million yen to about 1.6 million yen. And Journal du Coin cited a trader in Kanagawa who lost about 4 million yen in two seconds.
Several victims then received emails from a group calling itself a hacker team, with a link to a site describing the intrusion and the state of the accounts. GMO told users not to reply and not to open any link or file in those messages.
A ransom refused, and a threat aimed at more than 70 brokers
GMO confirmed on 24 October that it had received a demand for money. It did not give the amount. It said it will not pay, because paying would not guarantee that the stolen data is deleted or that it will not be misused.
According to GMO, the attacker made three threats. The first is to keep placing unauthorised orders on customer accounts opened at more than 70 securities and FX firms in Japan and abroad. That number comes from the attacker, relayed by GMO; no broker list has been published and no one has confirmed it. The second is to publish information about the service and about customers’ PCs that were connected to it, and to launch ransomware. The third is to publish information about GMO’s own systems and operations.
GMO warned that what the attacker publishes may not match the facts. It handed all its evidence, communication records included, to the police cybercrime unit and asked for a criminal investigation.
GMO also asked the state to step in. Its fourth report describes the case as “activation No. 1” (発動第1号 in the Japanese text) of Japan’s active cyber defence, the framework that lets the authorities identify and neutralise attack servers, and says the company sent government agencies an urgent request for state-led action to trace, block and disable the attack infrastructure. That label is GMO’s, not the government’s.
Tokyo has been cautious. A government official told the Yomiuri Shimbun that the system is not activated at the request of an individual company, and another told the Asahi Shimbun that it is meant for cases with a significant impact, such as attacks on operators of critical infrastructure, according to a summary by Financial News on 25 October. An official at the Prime Minister’s Office said more analysis was needed before deciding.
For containment, GMO said it asked major exchanges and brokers to block access coming from the service and to force-close every active session. Journal du Coin listed OANDA Japan, XMTrading, Titan FX, AXIORY and IronFX among the brokers that asked clients to change passwords. TokenPost reported that OANDA delayed some withdrawals after a hosting security incident. We have not read those brokers’ own notices.
5,000 yen for every customer, and what GMO will repay
Every current Desktop Cloud customer gets a flat 5,000 yen as a goodwill payment, whether or not they lost money. Details are due by email by Friday 30 October at 23:59 Japan time.
Losses are handled separately. GMO will pay realised losses and fees from trades it confirms as unauthorised, after checking trading and access logs. Losses caused by market moves, lost profits and other indirect damage are excluded. Customers may be asked for identity documents and a view-only password for MT4 or MT5. If a broker refunds part of the loss, GMO pays only the rest; if the broker refunds nothing, GMO covers the eligible amount. How to apply, which documents, and when money arrives will be announced by Friday 6 November.
The old platform will not come back. GMO said it is redesigning its security architecture and will offer customers who still want a Windows desktop a replacement on separate cloud infrastructure, free for six months after they move. Moving requires the customer’s consent. GMO also stressed that during the claim process it will never ask for passwords or PINs, except that view-only trading password.
Investors sold on Monday. GMO Internet Group, the listed parent, was down 13.6% at 3,256 yen during the Tokyo session, Investing.com reported. By the close at 06:30 UTC it had fallen further, to 3,179 yen, 15.7% below Friday’s 3,769 yen, according to Yahoo Finance data. GMO Internet, Inc., the listed subsidiary that runs Onamae.com, closed 14.9% lower at 418 yen.
GMO Coin says it found no unauthorised activity so far
GMO Coin is one of Japan’s large regulated crypto exchanges and belongs to the same group, which is why many crypto readers saw the headlines and checked their accounts. The exchange issued a warning about suspected unauthorised trades placed through automated trading tools running on GMO Internet servers. It said it had so far found no unauthorised activity in GMO Coin customer accounts, TokenPost reported.
No source explains why. Two facts frame it. The breach hit customers’ rented servers, not GMO Coin’s systems. And a GMO Coin client would be exposed only if they had run a bot on one of those servers with their exchange login or API key saved on it. Journal du Coin also noted that no crypto wallet was reported emptied: the attackers used victims’ broker access to place losing orders rather than to withdraw coins.
Neither GMO’s notices nor any source we found says that accounts at GMO Click Securities, the group’s online broker, were taken over. GMO’s group alert does not mention it.
GMO Coin’s advice to its users, as TokenPost relayed it, was concrete. Check trading records, positions and balances. Turn on passkey login and login notifications. Delete any API key you no longer use or do not recognise. Those steps are the same whatever the exchange, and our guide to how a centralised exchange holds your account and your coins explains why the login is the real key to the account.
What crypto traders running bots should check now
The crypto link here is not the stolen money. It is the setup. Many crypto traders run grid bots, arbitrage scripts or copy-trading tools on a rented VPS, with exchange API keys stored in a config file. If that server is compromised, the attacker inherits whatever the key allows.
- An API key used by a bot should have trading rights only. Withdrawal rights on a key that lives on a server are rarely needed and turn a bad trade into an empty account.
- Most large exchanges let you restrict a key to a fixed IP address. A key bound to your server’s address is useless if it is copied elsewhere, though not if the attacker uses the server itself.
- Keys and passwords stored on a machine you rent should not be reused anywhere else. GMO’s first request to its customers was exactly that: change every credential the servers held.
- An attacker on the server reaches only what the bot can reach. Coins in a wallet whose keys never touch that machine, or on an account no bot is connected to, are outside this kind of attack.
Self-custody does not make a trading bot safe, since a bot needs live access to a venue to trade. What it does is limit the amount at risk to what you leave on that venue. Our explainer on where crypto hacks really happen shows that most losses come from accounts, keys and servers around the chain, not the chain itself. A recent example is the weak certificate keys that forced updates on crypto bots and servers last week.
Japan’s brokerage account takeovers in 2025 were a different attack
Japan has seen hijacked trading accounts before, on a large scale. In April 2025 the Financial Services Agency warned of a sharp increase in unauthorised access and trades through phishing sites imitating brokers. As of 16 April 2025 it counted 12 firms, more than 3,300 illegal accesses and 1,454 fraudulent trades, with about $350 million of shares sold and $315 million bought, the proceeds pushed into small Chinese stocks, The Record reported. Rakuten Securities was first hit in late March, followed by Nomura, SMBC Nikko and SBI.
The pattern then was phishing of end users, one account at a time. This time a single hosting service used by bot traders appears to have handed the attackers thousands of logged-in platforms at once. Brokers that pushed passkeys and extra login checks after 2025 protect the login page. A platform that is already logged in on a compromised server skips that page entirely.
Crypto has its own Japanese precedent. In May 2024 the exchange DMM Bitcoin lost 4,502.9 BTC, which the FBI valued at $308 million. In December 2024 the FBI, the US Defense Department’s Cyber Crime Center and Japan’s National Police Agency attributed the theft to TraderTraitor, a group backed by North Korea; the police agency’s notice put the loss at about 48.2 billion yen. Worldwide, thefts keep climbing: our report on the $1.18 billion stolen in crypto hacks in the third quarter of 2026 has the latest count.
What GMO has still not said
Many basic numbers are missing. GMO has not published how many customers or broker accounts were hit, the total loss, which data fields were stolen, the ransom amount, how the attackers got in or who they are. Beyond individual testimonies, there is no confirmation that clients of a given broker lost money. Journal du Coin reports that the Financial Services Agency asked FX brokers, through their trade association, on 22 October to watch for abnormal trades; we found no FSA statement on the case.
The next dates are set by GMO. By 23:59 Japan time on Friday 30 October, customers should receive emails on the 5,000 yen payment and on the replacement service. By Friday 6 November, GMO is due to publish how to claim compensation for unauthorised trades. Until then, its advice stands: change every password the servers held and any copy of it used elsewhere, and do not reply to the self-styled hacker team.