Coincheck: Japan's $530 Million Wake-Up Call

In the early hours of Friday 26 January 2018, while Tokyo slept, someone began moving NEM coins out of Coincheck, one of Japan's biggest crypto exchanges. The first transfer went out at around 3 a.m. Over the next hours, in a string of transfers, 523 million coins left. Staff did not notice until late morning. By then about 58 billion yen, roughly $530 million, was gone.

It was the largest crypto theft ever recorded at that point, bigger in dollars than the Mt. Gox collapse, which had also happened in Tokyo four years earlier. Around 260,000 customers held the stolen coins. Most were ordinary Japanese retail investors who had bought in during the price boom of late 2017.

One wallet, one key

NEM, also traded under the ticker XEM, was then one of the ten largest cryptocurrencies, a token designed for fast payments. Coincheck kept almost all of its customers' NEM in a hot wallet. A hot wallet is a crypto account connected to the internet so it can pay out instantly, the equivalent of the cash drawer at a bank counter. A cold wallet is kept offline, more like the vault. Sensible exchanges keep a small float in the drawer and the rest in the vault. Coincheck kept the whole vault in the drawer.

Access to a crypto wallet comes down to a private key, a long secret number that works as both password and signature. Whoever holds it can move the money, and no bank can reverse the payment. NEM supported multi-signature, where several separate keys must approve each transfer, like a cheque that needs two directors to sign. Coincheck had not set it up. Its chief operating officer, Yusuke Otsuka, told the press the work had been technically difficult and that staff were short.

How the attackers got the key came out later. Staff computers had been infected through phishing emails, fake messages carrying malware, which let the attackers operate the machines remotely and lift the key. In 2019 the Asahi Shimbun reported that the malware found, known as Mokes and Netwire, was linked to Russian hacker groups. South Korean intelligence and the security firm Group-IB had earlier pointed at North Korea's Lazarus Group. Neither attribution has been proved.

A press conference at midnight

Coincheck stopped NEM trading just after noon, then froze yen withdrawals and almost everything else. That night chief executive Koichiro Wada and Otsuka bowed in front of the cameras in Tokyo and apologised. Within two days they made a promise nobody expected: every NEM holder would be paid back in yen, from the company's own money, at 88.549 yen per coin, the average market price after trading stopped.

The total came to about 46.3 billion yen, around $433 million at the time. Payments went into customers' Coincheck accounts from 12 March 2018. There was no bankruptcy, no years of claims, no creditor committee. That was the sharpest contrast with Mt. Gox, whose customers waited more than a decade for repayment.

The catch was that customers got yen at a post-crash price, not their coins. Anyone who had planned to hold NEM did not get NEM back.

The regulator steps in, a broker buys in

Japan had started licensing crypto exchanges in April 2017. Coincheck was operating as a "deemed" exchange: it had applied and was allowed to keep trading while the Financial Services Agency (FSA, Japan's financial regulator) reviewed it, but it was not yet registered. The FSA issued a business improvement order on 29 January 2018 and a second one in March, then inspected exchanges across the country. Several smaller ones were ordered to suspend business.

In April 2018 Monex Group, an online stockbroker run by Oki Matsumoto, bought all of Coincheck for 3.6 billion yen, about $34 million. Wada had owned about 45 percent of the shares. He and Otsuka gave up their posts as chief executive and director, and Monex's Toshihiko Katsuya took over. The FSA registered Coincheck as a licensed exchange in January 2019.

The episode reshaped Japanese law. Amendments passed in 2019 and in force from 2020 required exchanges to keep customer coins mostly in cold storage and to hold matching reserves for anything kept online.

Where the coins went

The NEM Foundation, the body that promoted the token, built a system that tagged the stolen coins so any account receiving them was flagged. Major exchanges refused tagged NEM. The thieves sold most of it anyway, at a discount, through a website on the dark web, the part of the internet reached only through anonymising software. In March 2018 the foundation stopped tracking, saying the coins had largely been traded away.

The hackers themselves were never identified. Tokyo police went after the buyers instead. In March 2020 they arrested two men accused of acquiring stolen NEM through the dark web site while knowing where it came from. In January 2021 around 30 more people were arrested or referred to prosecutors on the same suspicion. The cases rested on Japan's law against receiving criminal proceeds, not on the hack.

From the worst theft to Nasdaq

Coincheck survived, and did well. On 11 December 2024 its holding company, Coincheck Group, began trading on Nasdaq in New York under the ticker CNCK, after merging with Thunder Bridge Capital Partners IV, a shell company created to take businesses public. Monex kept a majority stake. In 2025 the group bought Next Finance Tech, a staking services firm, and Aplo, a Paris crypto broker for institutions. In February 2026 it completed the purchase of 3iQ, a Canadian manager of crypto investment funds, in a deal valued at about $112 million.

The theft that might have killed the company instead became the template Japan built its exchange rules on. The lesson was not that Coincheck had good security. It had bad security and enough cash to pay for the mistake.