Half a billion dollars in cryptocurrency that was stolen from Tokyo-based virtual currency exchange Coincheck in a hacking attack last week was transferred to eight separate digital addresses, sources with knowledge of the matter said Tuesday.
Of the ¥58 billion ($532 million) in NEM cryptocurrency that was taken, the bulk — ¥57.6 billion worth — was sent initially to a single address over a period of roughly 20 minutes from around midnight Thursday before being dispersed in an apparent attempt to hinder tracking, according to the sources, who declined to be named.
The financial watchdog began on Tuesday a broad review of virtual currency exchanges in Japan, as lax security measures at Coincheck are believed to have played a part in what has become the largest ever loss of cryptocurrency to hackers.
Finance Minister Taro Aso, who is also in charge of financial services, stressed Tuesday the need for stronger safeguards against such attacks, saying that “virtual currency exchanges need to improve the way they manage their systems.”
“It is greatly regrettable that a major breach like this happened. We need to strike the right balance between innovation and consumer protection,” he said.
The Metropolitan Police Department has launched an investigation and plans to look at the communications log for Coincheck’s server.
Many exchanges are still new and lack sufficient safeguards. The Financial Services Agency will question all exchanges on measures they have in place to protect customers’ assets. It will conduct on-site inspections if it sees an issue.
Coincheck, which started in 2012, has been criticized for keeping its customers’ NEM holdings in an online “hot” digital wallet rather than a much safer offline “cold” digital wallet.
The exchange said nearly all those holdings went missing in the early hours of Friday, though it did not discover the theft until half a day later. The exchange has promised to compensate all 260,000 affected customers for around ¥46 billion in cash.
Virtual currency exchanges in Japan are required by law to register with the government. There are 16 registered exchanges and another 16 exchanges, including Coincheck, that are pending approval.