Coincheck says it was hacked, will reimburse customers
Regulators are grappling with booming crypto markets
At 2:57 a.m. on Friday morning in Tokyo, someone hacked into the digital wallet of Japanese cryptocurrency exchange Coincheck Inc. and pulled off one of the biggest heists in history.
The Coincheck incident adds to a long list of thefts at cryptocurrency exchanges and wallets, stretching back to the robbery of Tokyo-based Mt. Gox in 2014. A lack of confidence in such platforms has prompted many institutional investors to spurn cryptocurrencies, although some are now dipping into the market after CME Group Inc. and Cboe Global Markets Inc. introduced regulated Bitcoin futures in the U.S. last month.
Coincheck, one of Japan’s biggest cryptocurrency exchanges, will use its own capital to reimburse customers who lost money in the theft, according to a statement posted on its website Sunday. The exchange — whose shareholders include 27-year-old Chief Executive Officer Koichiro Wada, Chief Operating Officer Yusuke Otsuka and two investment firms — said it has been in touch with Japan’s Financial Services Authority and the Tokyo Metropolitan Police.
The thief was able to seize such a large sum in part because Coincheck lacked basic security protocols. It kept customer assets in what’s known as a hot wallet, which is connected to external networks. Exchanges generally try to keep a majority of customer deposits in cold wallets, which aren’t connected to the outside world and thus are less vulnerable to hacks.
Coincheck also lacked multi-signature, a security measure requiring multiple sign-offs before funds can be moved. While the safeguard failed to prevent a $65 million heist from Bitfinex in August 2016, NEM’s blockchain had multi-signature functions that experts say would have made the theft more difficult.
‘Lack of Staff’
“I really wish they would have been using NEM’s multi-signature contract,” Jeff McDonald, vice president of the NEM Foundation, said in a Youtube video. “That would have probably saved them all these problems.”
The exchange hadn’t implemented the security measures due to “the difficulty of the technology and a lack of staff able to carry out the task,” Wada, who also serves as Coincheck’s chief technology officer, told a roomful of unusually combative reporters during a 90-minute press conference at the Tokyo Stock Exchange headquarters that stretched into the early hours of Saturday morning.
The theft sparked a social-media firestorm in Japan, one of the world’s biggest cryptocurrency markets, and spurred angry customers to gather in the bitter cold outside Coincheck’s headquarters — just an eight-minute walk from the site where Mt. Gox imploded four years earlier.
It was exactly the kind of scene that the country’s financial regulator had been hoping to avoid when it introduced a licensing system for cryptocurrency exchanges last April.
Coincheck was four months past its deadline for receiving such a license, but was allowed to continue operating — and advertising on television — while awaiting a final decision from the FSA.
The exchange’s fate remains unclear. While Coincheck executives have said they plan to eventually restart trading, they hadn’t outlined a timeline by Sunday evening. They did, however, pledge to compensate all 260,000 users impacted by the theft, at a rate of 88.549 yen (82 U.S. cents) for each NEM coin.
Coincheck also said it was cooperating with other exchanges in the hope of tracing the missing tokens.
“We know where the funds were sent,” Otsuka, the Coincheck COO, said during the late-night press conference. “We are tracing them and if we’re able to continue tracking, it may be possible to recover them.”
The FSA has said it’s looking into the incident.
Regardless of how it plays out, the Coincheck theft is likely to push policy makers to enforce stricter security requirements at cryptocurrency exchanges, according to David Shin, a founding member of the Bitcoin Association of Hong Kong and president of the Singapore-based Asia Fintech Society.
“A lot of regulators don’t know yet how to regulate this area,’’ Shin said. “This episode will definitely get their attention.’’
— With assistance by Yuki Hagiwara, and Nao Sano