Coincheck: Hundreds of millions disappear from a connected wallet

In January 2018, the Japanese platform Coincheck discovered that a very large reserve of NEM was transferred without authorization. Its subsequent corporate documents account for 526.3 million NEM tokens, or 46.6 billion yen of customer funds lost. The dollar conversions published at the time varied.

Tokens are kept in a wallet connected to operational systems, commonly referred to as a hot wallet. This choice facilitates daily operations, but it exposes the means of transfer to a compromise of the system that uses them. The problem is not that the NEM protocol would have stopped working.

The discovery of the exits leads Coincheck to suspend services and investigate. Public analyses place weakness in asset custody and access security. They do not make it possible to transform each infection scenario mentioned in the press into a definitively proven mechanism.

The Japanese regulatory agency inspects the company and demands improvements. Coincheck announces and then implements compensation in yen. The calculation of this compensation itself becomes a subject of dispute: repaying a value calculated at a given moment does not necessarily amount to making exactly the same tokens.

Monex acquires Coincheck in 2018 and the company describes a redesign of its controls and governance. The existence of suspicious prosecutions and transactions is not sufficient to publicly attribute the entire theft to a specific individual.

This story reveals an essential shift in risk. A blockchain can be used without being hacked, while losing the assets entrusted to the intermediary who keeps them.