TOKYO-BASED cryptocurrency exchange Coincheck Inc says it will return about 46.3 billion yen ($524 million) of the virtual money it lost to hackers two days ago in one of the biggest-ever thefts of digital money.

That amounts to nearly 90 per cent of the 58 billion yen worth of NEM coins the company lost in an attack that forced it to suspend on Friday withdrawals of all cryptocurrencies except bitcoin.

Coincheck said in a statement it would repay about 260,000 owners of NEM coins in Japanese yen, though it was still working on timing and method.

The theft underscores security and regulatory concerns about bitcoin and other virtual currencies even as a global boom in them shows little signs of fizzling.

Two sources with direct knowledge of the matter said Japan’s Financial Services Agency sent a notice to the country’s roughly 30 firms that operate virtual currency exchanges to warn of further possible cyber-attacks, urging them to step up security.

The financial watchdog was also considering administrative punishment for Coincheck under the financial settlements law, one of the sources said.

Japan started to require cryptocurrency exchange operators to register with the government only in April 2017. Pre-existing operators such as Coincheck have been allowed to continue offering services while awaiting approval. Coincheck’s application, submitted in September, is still pending.

Coincheck told a late-Friday news conference that its NEM coins were stored in a “hot wallet” instead of the more secure “cold wallet”, outside the internet. Asked why, company President Koichiro Wada cited technical difficulties and a shortage of staff capable of dealing with them.

World leaders meeting in Davos last week issued fresh warnings about the dangers of cryptocurrencies, with US Treasury Secretary Steven Mnuchin relating Washington’s concern about the money being used for illicit activity.