Japan orders broader checks after $660 million cryptocurrency theft

JAPANESE authorities have imposed administrative measures on virtual currency exchange Coincheck after hackers stole hundreds of millions of dollars in digital assets from the Tokyo-based firm in one of the biggest heists ever.

Units of the cryptocurrency NEM worth A$660 million were taken — based on the exchange rate on Friday — exceeding even the $593 million in bitcoin stolen from the MtGox exchange in 2014.

Coincheck suspended trading of all cryptocurrencies except bitcoin on Friday, and said it had lost 523 million units of NEM, the 10th biggest cryptocurrency in the world based on market capitalisation.

The Financial Services Agency (FSA) said in a statement that it had ordered Coincheck to investigate the cause of the incident, “properly” deal with clients, strengthen risk management and take preventive measures.

The financial watchdog told the exchange to respond to the orders by February 13, warning that the agency would raid its office if necessary.

Coincheck President Koichiro Wada bowed and apologised at a press conference after the hack was revealed at a press conference last Friday night. He said the company may seek financial assistance, according to Kyodo News service.

Japanese TV footage showed a small group of customers standing outside the company’s Tokyo head office Friday night. Coincheck, which calls itself the leading Bitcoin and cryptocurrency exchange in Asia, said it detected the unauthorised access to its system about 3am (5am AEDT) last Friday morning.

Coincheck has said it will use its own funds to reimburse about 46.3 billion yen (around A$531 million) — at a rate of 88.549 yen per NEM — to all 260,000 customers who lost their holdings.

The company said it would reimburse customers in yen, not cryptocurrency. The FSA said at a briefing Monday that it was checking to ensure Coincheck had the ability to make those refunds.

The watchdog added that it was carrying out checks at other exchanges in the wake of the theft to detect potential security problems.

The agency will supervise Coincheck to ensure the measures are being implemented and contracts are being honoured, Chief Cabinet Secretary Yoshihide Suga said at a regular briefing.

“While examining the cause of the incident and taking necessary measures, we want the ministries and agencies concerned to urgently study what further measures we’d need,” the top government spokesman said.

Japan’s Finance Minister Taro Aso told parliament on Monday that the government would take “necessary administrative measures, including an on-site inspection.” Coincheck “did not store the important things separately. I think they lacked fundamental knowledge or common sense,” he said.

One unit of NEM was trading at 95 cents on Monday morning, according to coinmarketcap.com.

Japan is a leading market for cryptocurrencies, with nearly one third of global bitcoin transactions in December denominated in yen, according to specialist website jpbitcoin.com.

As many as 10,000 businesses in Japan are thought to accept bitcoin, and bitFlyer — the country’s main bitcoin exchange — saw its user base grow beyond one million in November.

Many Japanese, especially younger investors, have been seduced by the idea of strong profits as the economy has seen years of ultra-low interest rates offering little in the way of traditional returns.

In the wake of the MtGox scandal, Japan passed a law on cryptocurrencies that requires exchanges to be regulated by the FSA.

The law went into effect in 2017.

Coincheck had submitted an application to the FSA for a licence and was allowed to continue operating while it awaited a decision, the agency said.

It comes as the national tax office in the Netherlands says its website briefly went offline because of a DDoS cyber attack, after the country’s largest banks were targeted. ABN Amro and ING on Monday said they were both targeted by hackers, temporarily disrupting online and mobile banking services over the weekend. The tax office said it’s website went down for five to 10 minutes after a DDos attack.

Rabobank also fell victim to an attack on Monday, while ABN Amro and ING In Distributed Denial of Service (DDoS), attackers use computer networks they control to send such a large number of requests for information from websites that servers that host them can no longer handle the traffic and the sites become unreachable.