TOKYO EXCHANGE REPORTS $530 MILLION CRYPTOCURRENCY THEFT

TOKYO, 2018-01-26. — A Japanese cryptocurrency exchange disclosed tonight that digital money worth approximately ¥58 billion, or $530 million, has been stolen from its systems, confronting the rapidly expanding industry with what may be its largest theft measured in dollars. Coincheck, based in Tokyo, said roughly 523 million units of the cryptocurrency NEM had been transferred without authorisation. The company has suspended withdrawals while it investigates the loss and attempts to establish whether the missing assets can be recovered. At a late-night news conference, executives apologised to customers but could not provide a settled account of how the intruders gained access or say whether customers would be fully compensated.

The disclosure followed a day of increasingly restrictive announcements on Coincheck’s website. The exchange first suspended deposits involving NEM, then stopped its trading and withdrawals before extending restrictions across other services. By the afternoon, customers could no longer withdraw either cryptocurrencies or yen. Company officials said the unauthorised transfer had occurred early in the morning and was discovered several hours later. The stolen holdings belonged to customers, making the incident more than a loss on the company’s own account. The immediate difficulty for users is twofold: some face the disappearance of assets held on their behalf, while others cannot move funds out of the exchange during the investigation.

Chief executive Koichiro Wada and chief operating officer Yusuke Otsuka appeared before reporters to explain the breach. Otsuka said the company had identified the destination of the missing currency, although identifying a digital address does not necessarily reveal the person controlling it. “We know where the funds were sent,” he said. “We are tracing them and if we’re able to continue tracking, it may be possible to recover them.” That statement offered customers a prospect of recovery rather than a guarantee. Executives said they were investigating the circumstances and had reported the incident to the authorities; they did not identify a suspect or establish the country from which the attack originated.

A central admission concerned the way Coincheck stored the currency. The missing NEM was held in a so-called hot wallet, connected to the internet, rather than in offline storage generally described as a cold wallet. Online wallets make assets readily available for transactions but also expose the systems controlling them to remote attack. Coincheck also acknowledged that it had not used NEM’s multiple-signature facility, which can require more than one authorisation before funds are transferred. Executives cited technical difficulties and staffing constraints in explaining their arrangements. These disclosures place the exchange’s custody practices at the centre of the inquiry, without yet establishing precisely how the theft was carried out.

NEM is a separate cryptocurrency from bitcoin, with its own network and transaction records. The loss announced tonight concerns Coincheck’s NEM holdings, not a reported disappearance of the exchange’s bitcoin reserves. Representatives of the NEM project stressed that a breach at an exchange should not be confused with a failure of the underlying currency’s technology. NEM Foundation president Lon Wong attributed the incident to weaknesses in the exchange’s security arrangements rather than to a defect in the NEM protocol. That distinction matters to the wider market: a functioning ledger may accurately record a transfer even when the authority to make that transfer has been stolen from a custodian.

Market prices nevertheless reflected the alarm. NEM fell sharply as reports of the disruption circulated, with market quotations showing a decline of roughly a fifth at points during the day. Bitcoin also weakened, although attributing every movement to Coincheck would be difficult in a market already experiencing large swings. The dollar value assigned to the theft is itself sensitive to the price and timing used to measure the missing coins. Coincheck’s estimate of ¥58 billion provides the basis for the figure of approximately $530 million, but neither that valuation nor the visibility of the transfers establishes how much an intruder could realise by attempting to sell such a large holding.

For Japan, the incident is an immediate test of a regulatory framework intended to bring cryptocurrency trading under closer supervision. Legislation that took effect last April requires exchanges to register with the Financial Services Agency and imposes obligations concerning customer identification and the management of assets. Coincheck has applied for registration but has continued operating under transitional arrangements while its application is considered. It is therefore not in the same position as an exchange that has already secured approval. The disclosure raises urgent questions about how customer funds are protected during that transition and whether the growth of trading businesses has outpaced their operational safeguards. No completed regulatory finding on the cause of the loss is available tonight.

The size and location of the theft inevitably recall Mt. Gox, the Tokyo bitcoin exchange whose collapse in 2014 shook confidence in the young industry. Mt. Gox initially reported approximately 850,000 bitcoins missing, then valued at roughly $480 million, although some were subsequently located. On the values being reported tonight, Coincheck’s loss could exceed that earlier episode in dollar terms. The comparison requires caution: the currencies differ, their prices fluctuate substantially, and a theft disclosure does not by itself establish that an exchange is insolvent. Coincheck has not announced bankruptcy. Its ability to resume normal business will depend on the extent of the damage and the resources available to meet customer obligations.

The exposure also illustrates a distinction frequently obscured during the boom in digital currencies. A cryptocurrency may operate without a central bank, but customers who leave their coins with an exchange still depend on a central business to safeguard access to them. They rely on that business’s software, staff, internal controls and financial strength. Japan has become an important centre for this trade, attracting customers drawn by rising prices and the convenience of buying through domestic platforms. Tonight’s suspension demonstrates how quickly that convenience can give way to uncertainty: a customer may still see an account balance while being unable to withdraw the asset it represents.

The outstanding questions are now practical as well as technical. Coincheck must establish how access was obtained, whether other holdings remain secure and when withdrawals can safely restart. It must also determine whether the stolen NEM can be recovered and what remedy, if any, it can offer customers if recovery fails. Investigators face the difficulty of following assets that can move across borders without passing through conventional banking channels. For customers awaiting answers tonight, the exchange’s promise to trace the transfers is only a beginning. The decisive test will be whether its records, security measures and financial resources can turn that investigation into the return of their money.