Cryptocurrency exchange Coincheck loses ¥58 billion in hacking attack

Echoing the Mt. Gox fiasco that happened nearly four years ago, Tokyo-based cryptocurrency exchange Coincheck disclosed Friday that a hacker had stolen about ¥58 billion ($532 million) worth of its holdings, sending clients into a panic about the fate of their virtual assets.

CEO Koichiro Wada (left) and board member Yusuke Otsuka face the media in Tokyo late Friday to announce the cryptocurrency exchange lost ¥58 billion in virtual NEM coins to a hacking attack.

If confirmed, the heist will surpass the ¥48 billion ($480 million at the time) lost in the collapse of bitcoin exchange Mt. Gox in February 2014.

Coincheck Inc., one of Japan’s major cryptocurrency exchanges, said it discovered a significant drop in the balance of its NEM virtual currency at around 11:25 a.m. Friday after about ¥58 billion of it was illegitimately transferred.

In a blog post at 12:07 p.m., customers were notified that their NEM deposits had been suspended and that they would be updated when more information became available. But the operational halt only grew bigger, and the startup subsequently froze all withdrawals, including in yen denominations, at 4:33 p.m.

It then froze all trading in virtual currencies except in bitcoins at 5:23 p.m.

“We are deeply sorry for troubling people with this issue,” Coincheck CEO Koichiro Wada said at a nearly 1½-hour-long news conference that lasted until about 1 a.m. Saturday.

Yusuke Otsuka, a Coincheck executive, said the firm is investigating but remains unsure about how it was hacked and how many customers were affected.

NEM is a virtual currency launched in March 2015. One NEM coin traded for ¥93 at 2 p.m. Saturday, down 16 percent from the previous day.

Jeff McDonald, vice president of the Singapore-based NEM Foundation, which created the currency platform, said in a YouTube video Saturday that the foundation is working with Coincheck to investigate the theft.

“We are trying to help them. We are tracking the funds that have been taken,” McDonald said while remaining vague on their prospects for recovering the stolen tokens.

Otsuka said it is unclear when the exchange will be able to resume transactions.

Coincheck has reported the incident to the police and the Financial Services Agency.

Otsuka said Coincheck is considering compensating clients if it cannot recover the tokens but declined to say whether Coincheck had enough cash to do so.

Asked whether the firm had sufficient security measures in place to protect clients, Otsuka said they were doing their best but admitted they might have come up short.

For instance, Coincheck’s website says that bitcoins are to be stored offline when they are not being traded. Wada said its bitcoins were indeed stored offline but that the more than 5 million NEM coins that were stolen were not.

The exchange explained that it was planning to move the assets offline but did not have enough manpower to do the job.

Since Coincheck has been running several internet and TV commercials featuring a well-known celebrity, some reporters asked whether its investment strategy was more focused on marketing instead of security.

“I am in deep remorse on that point,” Wada said.

As news of the hack broke, worried Coincheck users braved the frigid weather to gather at Coincheck’s headquarters in Shibuya district to get more information.

“I came here because I knew people were gathering and the media were also here. I thought I might be able to get some information,” said a 27-year-old man from Nerima Ward who requested anonymity.

He said he started investing in virtual currencies last May and had entrusted about ¥7 million to Coincheck. He also invested about ¥2 million in NEM.

“(Coincheck) needs to tell us what is happening now,” he said before the news conference got underway.

Due to the surging interest in blockchain technology and the collapse of bitcoin exchange Mt. Gox in 2014, Japan made legal revisions in April to tighten regulations on virtual currency exchanges.

Cryptocurrency exchanges are now required to register with the government and submit annual reports, and the FSA can conduct on-site inspections and issue business improvement orders.

Coincheck is not a registered operator but had applied to become one. As of Jan. 17, there were 16 registered cryptocurrency exchanges in Japan, which has become a major player in the new field thanks to new legislation.