Japan raids offices of currency exchange hit by digital heist
TOKYO — Japan’s financial regulator on Friday swooped on Coincheck Inc with surprise checks of its systems and said it had asked the Tokyo-based cryptocurrency exchange to fix flaws in its computer networks well before hackers stole $530 million of digital money last week.
Security gaps in Coincheck’s systems were among the reasons the exchange had not been given official approval to operate, the Financial Services Agency said. Coincheck had been allowed by the regulator to operate pending registration.
The comments came after 10 FSA officials conducted surprise checks on Coincheck’s office on Friday morning, as authorities stepped up efforts to pin down how hackers pulled off one of the world’s biggest cyber heists.
The inspection, launched at 8 am on Friday, focused on compensation for customers, financial conditions and system management at the exchange, and Coincheck’s efforts on consumer protection, a senior FSA official said.
Coincheck has said the virtual coins were stored in a “hot wallet” instead of the more secure “cold wallet”, which operates on platforms not directly connected to the internet. The exchange was also not using an extra layer of security known as a multisignature system.
The regulator’s knowledge of flaws in Coincheck’s systems before the theft will likely draw further focus on Japan’s approach to regulating cryptocurrency exchanges.
Japan last year became the first country to regulate exchanges at the national level — a move that won praise for boosting innovation and protecting consumers.
The theft highlights the vulnerabilities in trading an asset that policymakers are struggling to regulate, as well as the broader risks for Japan as it aims to leverage the fintech industry to stimulate economic growth.
The FSA earlier this week issued a business improvement order to Coincheck and said it would investigate all cryptocurrency exchanges in Japan for security gaps following the hack.
The regulator said on Friday it had ordered all cryptocurrency exchanges to submit a report on their system risk management.
Coincheck had been ordered to submit a report on the hack and measures for preventing a recurrence by Feb 13. But Friday’s surprise inspection was conducted ahead of the deadline to “ensure protection of users”, said Finance Minister Taro Aso.
The FSA has already conducted an interview-based hearing with Coincheck but questions remain, a source with direct knowledge of the matter said on Friday.
In 2014, Tokyo-based Mt. Gox, which once handled 80 percent of the world’s bitcoin trades, filed for bankruptcy after losing bitcoins worth nearly half a billion dollars to a hacking attack. More recently, South Korean cryptocurrency exchange Youbit shut down and filed for bankruptcy after being hacked twice last year.
Coincheck said on Sunday it would repay about 46.3 billion yen ($425 million) of the virtual money. The FSA has said it had yet to confirm whether the company had sufficient funds for the reimbursement.