Coincheck hack
From Invertopedia, the encyclopedia of how things fail
Coincheck is a Tokyo cryptocurrency exchange that in December 2017 handled 55 percent of Japan's bitcoin trading volume[4]. In the early hours of January 26, 2018, about 523 million NEM coins, worth roughly 58 billion yen or $530 million, were sent out of an internet-connected "hot wallet" where Coincheck kept customers' NEM, and the exchange noticed more than eight hours later[1][3][4]. It said it would repay about 260,000 holders in yen from its own money[5][6], Japan's Financial Services Agency ordered it to fix its management[2], and in April 2018 it was sold to Monex Group for 3.6 billion yen[4].
Contents
The bet
In April 2017 Japan recognized bitcoin as a legal means of payment and required exchanges to register with the financial regulator[1]. Coincheck had not registered when it was hacked[8]. It was growing fast anyway: by December 2017 it carried 55 percent of Japan's bitcoin trading[4].
Its security was not the same for every coin. Customers' bitcoin sat in an offline "cold wallet," but their NEM sat online in a hot wallet, and Coincheck did not use multi-signature protection, which would have required at least two people to move it[9]. Asked why, president Koichiro Wada cited technical difficulties and a shortage of staff[1].
What happened
| Apr 2017 | Japan recognizes bitcoin as a legal means of payment and requires exchanges to register.[1] |
|---|---|
| Dec 2017 | Coincheck handles 55 percent of Japan's bitcoin trading volume.[4] |
| Jan 26, 2018, 0:02 a.m. | About 58 billion yen of NEM leaves Coincheck in eight transfers over 19 minutes, followed by three more between 3:35 and 8:26 a.m.[3] |
| Jan 26, 2018 | More than eight hours after the coins left, Coincheck notices the balance has dropped. It stops NEM sales and withdrawals.[1][5] |
| Jan 27-28, 2018 | Coincheck says it will repay all of about 260,000 NEM holders in yen, at 88.549 yen a coin, about 46.3 billion yen in all, from its own capital.[5][6] |
| Jan 29, 2018 | The Financial Services Agency issues a business improvement order, finding Coincheck's work on the cause, on customers and on prevention insufficient, and wants written reports by February 13. It does not suspend the exchange.[2] |
| By Jan 31, 2018 | The stolen NEM has been spread across 20 accounts. NEM's foundation tracks it and asks exchanges not to trade it.[3] |
| Apr 2018 | Monex Group agrees to buy Coincheck for 3.6 billion yen. Coincheck's share of Japanese bitcoin trading has fallen to 8.9 percent.[4] |
| 2020 | Police arrest two men accused of knowingly buying the stolen NEM on a dark web market, and a Tokyo court orders Japan's first seizure of cryptocurrency.[10] |
| Feb 2021 | Prosecutors indict 13 men and a company for exchanging NEM they knew was stolen, and summarily indict 14 more. The person who took it has not been identified.[7] |
The kill shot
Coincheck held hundreds of millions of dollars of customers' NEM online, behind one signature, with nothing watching the balance. Whoever got in only had to press send.
Coincheck used different security standards for different coins, and NEM got the weaker one: an online hot wallet with no multi-signature protection[9]. With no multi-signature protection, moving the funds did not need a second person[9]. The Asahi Shimbun later alleged that Coincheck employees' computers had been infected with a virus associated with Russian hackers[10].
Nobody noticed in time. The coins left in transfers between 0:02 and 8:26 a.m.[3], and Coincheck saw the drop in its balance more than eight hours after they began to go[1]. Three days later the Financial Services Agency found Coincheck's account of the cause, its handling of customers and its prevention plans all insufficient[2].
Red flags ignored
- Everything in the hot wallet. Customers' NEM was kept online instead of offline.[1]
- One key, no second person. The NEM funds had no multi-signature protection.[9]
- A lower standard for a smaller coin. Bitcoin went to cold storage; NEM did not.[9]
- Not registered. Coincheck was running without having registered with the regulator.[8]
- Eight hours of silence. The balance fell for hours before anyone at Coincheck noticed.[1][3]
The cost
About 523 million NEM, roughly 58 billion yen or $530 million[1][4], more than the 48 billion yen of bitcoin lost at Mt. Gox in 2014[9]. Coincheck said it would repay about 46.3 billion yen, around 90 percent of the value lost, at 88.549 yen a coin[5][6].
The exchange's share of Japanese bitcoin trading fell from 55 percent in December 2017 to 8.9 percent in March 2018[4]. Its owners sold it to Monex for 3.6 billion yen, and CEO Koichiro Wada and COO Yusuke Otsuka were to resign from Coincheck's board[4].
The inversion
Keep online only what today's withdrawals need, require more than one key to move anything, hold every coin to the same standard as the best-protected one, and put an alarm on any balance that drops.
What survived
The exchange, under Monex[4]. The hack also hardened the regulator: alongside its orders to Coincheck, the Financial Services Agency ordered two other exchanges to halt operations[4].
The trail of the coins. Investigators followed the NEM to ordinary exchanges and identified people who had traded it; by 2021, 31 people had been caught exchanging about 18.8 billion yen of it, but the person who took it was still unknown[7].
References
- ^ “Coincheck Cryptocurrency Hack: Everything You Need to Know”. Reuters via Fortune, January 29, 2018. About 58 billion yen stolen, 523 million NEM, the hot wallet, detection over eight hours later, Wada's explanation, and Japan's 2017 registration rule.
- ^ “NEM流出事件でコインチェックに業務改善命令、金融庁は「9月までのBSは把握済み」”. TechCrunch Japan, January 29, 2018 (Internet Archive copy, in Japanese). The January 26 outflow of about 58 billion yen of NEM, the FSA's business improvement order and its finding that Coincheck's response was insufficient, the February 13 deadline, and no suspension.
- ^ “Cryptocurrency hacked from Coincheck sent to 20 accounts”. The Japan News by the Yomiuri Shimbun, January 31, 2018 (Internet Archive copy). The transfer times on January 26, the spread to 20 accounts, and the NEM foundation's tracking.
- ^ “Japan's Monex to buy Coincheck for $34 million, eyes future IPO”. Reuters, April 6, 2018. The $530 million heist, the 3.6 billion yen sale, the FSA's orders, the market share fall from 55 to 8.9 percent, and the founders leaving the board.
- ^ “Hackers steal $660m in 'world's biggest cryptocurrency theft'”. The New Daily with agencies, January 28, 2018 (Internet Archive copy). The halt to NEM sales and withdrawals, and the promise to repay about 46.3 billion yen, around 90 percent, to about 260,000 holders from Coincheck's own capital (its dollar figures are Australian).
- ^ “コインチェックが不正送金されたNEMを保有者約26万人全員に日本円で返金”. CoinPost, January 2018 (in Japanese). Coincheck's compensation terms: all of about 260,000 holders, in yen, at 88.549 yen per coin.
- ^ “不正取得の仮想通貨ネムを交換、東京地検が組織犯罪処罰法違反で13人を起訴＝報道”. CoinPost, February 10, 2021 (in Japanese). 13 men and one company indicted for receiving criminal proceeds, 14 more summarily indicted, 31 people caught, 18.8 billion yen exchanged, and the thief not identified.
- ^ “Thieves steal at least $533 million in largest cryptocurrency heist ever”. CyberScoop, January 2018. Coincheck had not registered with the Financial Services Agency.
- ^ “Hack Costs Coincheck Cryptocurrency Exchange $530 Million”. Dark Reading, January 31, 2018 (Internet Archive copy). Different standards for different coins, bitcoin cold and NEM hot, no multi-signature on NEM, and the comparison with Mt. Gox's 48 billion yen.
- ^ “Japan seizes exchange hack crypto”. Asia Times, August 2020. Two men arrested and accused of knowingly buying the stolen NEM, Japan's first crypto seizure, and the Asahi Shimbun's allegation about infected employee computers.