The Coincheck Hack (2018): The Biggest Crypto Theft at the Time
In January 2018 Japan's Coincheck lost 523 million NEM tokens from a hot wallet. See what happened, how regulators responded and what it changed for exchanges.
On 26 January 2018, the Tokyo-based exchange Coincheck announced that it had lost 523 million units of NEM (XEM), a cryptocurrency, in a theft. The value was reported as about 58 billion yen, or roughly 530 million US dollars at the time. It was the largest cryptocurrency theft in history up to that date and prompted tougher rules in Japan.
The exchange
Coincheck, founded in 2012, had grown quickly as Japan became one of the most active crypto markets. It offered trading in a long list of coins and was heavily advertised, including on television. In 2017, Japan had begun requiring exchanges to register with the Financial Services Agency, but firms already operating, including Coincheck, were allowed to continue while their applications were being processed.
What happened
On 26 January 2018, shortly after midnight Japan time, an unauthorised party began moving NEM out of a Coincheck wallet. The exchange detected unusual activity several hours later and suspended deposits, withdrawals and trading for NEM and other coins. Later in the day it held a press conference and explained the loss. Customers could not withdraw during the suspension, and the company said it was working with the police and the NEM Foundation. The NEM blockchain itself was not compromised; the weakness lay in how the exchange stored its keys. Coincheck's management apologised publicly.
Coincheck said the stolen NEM had been stored in a hot wallet, meaning one connected to the internet. The company acknowledged that it had not used multi-signature protection for these funds, which would have required several keys to approve a transfer, and that most of its NEM had not been held in offline storage. The Financial Services Agency later described additional weaknesses in risk management.
Response
- Customer compensation. Coincheck said it would reimburse affected customers from its own funds, in Japanese yen, at a set rate, amounting to about 46 billion yen. It made the repayments in the following months.
- Regulatory action. The FSA issued business improvement orders to Coincheck and ordered inspections of other exchanges. Authorities also required stronger security for registered operators.
- Tracking the funds. The NEM Foundation attempted to follow the stolen coins using a tagging system, but the thieves moved assets through multiple accounts and exchanged them for other currencies. A full recovery was not reported.
- Takeover. In April 2018, the Japanese financial firm Monex Group agreed to buy Coincheck. The exchange was later registered with the regulator.
Changes in Japan
| Area | After 2018 |
|---|---|
| Exchange registration | Stricter checks of security systems before approval |
| Self-regulation | An industry body, the Japan Virtual Currency Exchange Association, was given a more prominent role |
| Customer assets | Rules required segregating customer funds, with most kept offline |
| Later reforms | Amendments to Japanese law in 2019 strengthened requirements on custody and disclosure |
The incident came less than four years after the Mt. Gox collapse, which had also been in Japan. For authorities, the repeat demonstrated that registration alone was not enough without checks on how exchanges protect assets.
Why hot wallets are risky
A hot wallet is convenient because the exchange can process withdrawals immediately. The downside is exposure: anyone who gains access to the system can sign transfers. Common mitigations include:
- Keeping the bulk of customer funds in offline cold storage.
- Using multi-signature approval so no single key can move large amounts.
- Setting limits and delays on withdrawals from hot wallets.
- Monitoring wallets with automated alerts.
The attempt to tag the stolen coins
The NEM Foundation tried an unusual response. It attached a tag to the thieves' accounts so that other users and exchanges could identify and track the stolen tokens as they moved. In practice the thieves split the funds into many accounts and traded them for other currencies, and the tag could not follow the proceeds beyond that point. The episode showed that tracing is possible on a public ledger, but that stopping the movement of funds is a different matter.
Hot and cold storage compared
| Storage | Connected to the internet? | Typical use |
|---|---|---|
| Hot wallet | Yes | Day-to-day withdrawals |
| Cold wallet | No | Bulk of customer funds |
The principle is the same for any business: keep only what you need for daily operations in the most exposed place. Backups and credentials need the same care; see our knowledge base for practical guides.
A note on the numbers
Because the loss was quoted in yen and dollars, and the price of NEM changed rapidly in early 2018, the dollar value of the theft varies by source. The 523 million XEM is the constant figure. The identity of the thieves has not been established publicly in a way this article can confirm, so it makes no claims about them.
A practical lesson for site owners
If a convenience setting turns out to expose something valuable, the convenience is not free. The same goes for web servers: keep credentials out of public folders, apply the principle of least privilege and make regular backups. A quick overview of what we provide is on the security page.
