{"investigation":{"slug":"coincheck","entity_name":"Coincheck","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Coincheck is a Tokyo-based cryptocurrency exchange that suffered what was, at the time, the largest cryptocurrency hack in history on January 26, 2018, when approximately 523 million NEM (XEM) tokens valued at roughly $534 million were stolen from a low-security hot wallet. The exchange was operating without a Financial Services Agency (FSA) license at the time of the breach, had failed to implement standard multisignature security for NEM holdings, and received multiple business improvement orders from Japanese regulators in the aftermath. Coincheck was subsequently acquired by Monex Group in April 2018, obtained its FSA license in January 2019, and listed on the Nasdaq in December 2024 via a SPAC merger under the ticker CNCK.","sections":[{"content":"On January 26, 2018, at approximately 3:00 a.m. Japan Standard Time, approximately 523 million NEM (XEM) tokens were transferred out of Coincheck's hot wallet without authorization. The funds were valued at approximately 58 billion yen, or roughly $534 million USD at prevailing prices, making it one of the largest thefts in cryptocurrency history at the time — surpassing the 2014 Mt. Gox hack in dollar terms. Investigators believe attackers first gained access on January 25, 2018, at approximately 17:57 UTC and remained undetected for an estimated eight hours. The attack vector was a phishing email that installed the Mokes and Netwire malware on employee computers, enabling the extraction of private keys controlling the NEM hot wallet. Coincheck publicly confirmed the breach on January 27, 2018, and halted NEM deposits and withdrawals, subsequently freezing most other trading activity. The NEM Foundation declined to execute a hard fork or blockchain rollback to recover the stolen assets, and the stolen NEM was fully sold off by approximately March 22, 2018. A 2019 investigation by Japanese media outlet Asahi Shimbun identified Mokes and Netwire — both associated with Russian threat actors — on affected machines, though no definitive attribution to specific individuals or groups has been publicly confirmed by law enforcement.","heading":"The January 2018 Hack","sources":[{"url":"https://www.cnbc.com/2018/01/26/japanese-cryptocurrency-exchange-loses-more-than-500-million-to-hackers.html","name":"cnbc.com","type":"other","credibility":3},{"url":"https://fortune.com/2018/01/31/coincheck-hack-how/","name":"fortune.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/report-record-breaking-coincheck-hack-084700348.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://www.sciencedirect.com/science/article/pii/S2665910721000724","name":"sciencedirect.com","type":"other","credibility":3},{"url":"https://securitytoday.com/articles/2019/06/18/report-reveals-russian-hackers-may-be-responsible-for-530-million-cryptocurrency-hack.aspx","name":"securitytoday.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Post-incident analysis revealed multiple critical security failures at Coincheck. All 523 million NEM tokens were stored in a single internet-connected hot wallet rather than being kept in cold (offline) storage, which is the standard security practice for large cryptocurrency holdings. Critically, Coincheck did not implement NEM's native multisignature (multisig) security feature, which would have required multiple key approvals before any funds could be transferred. Bitcoin and Ether held by Coincheck were stored in cold storage wallets with Bitcoin additionally using multisig — making the decision to store NEM without equivalent safeguards a notable and consequential inconsistency in the exchange's security posture. During a post-breach press conference, Coincheck management acknowledged that the exchange lacked sufficient personnel and technical resources to implement proper security measures. Approximately 260,000 users were affected by the breach.","heading":"Security Failures and Operational Negligence","sources":[{"url":"https://cointelegraph.com/news/coincheck-stolen-534-mln-nem-were-stored-on-low-security-hot-wallet","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://fortune.com/2018/01/31/coincheck-hack-how/","name":"fortune.com","type":"other","credibility":3},{"url":"https://dn.institute/research/cyberattacks/incidents/2018-01-28-coincheck/","name":"dn.institute","type":"other","credibility":3},{"url":"https://crypto.security/crypto-blockchain-security/coincheck-hack/","name":"crypto.security","type":"other","credibility":3}],"severity":"medium"},{"content":"At the time of the hack, Coincheck was not a registered virtual currency exchange under Japan's Payment Services Act, which had required registration since April 2017. The exchange was permitted to continue operating while its application was pending under a grandfathering provision. On January 29, 2018 — three days after the breach — the Financial Services Agency (FSA) issued its first business improvement order to Coincheck, directing the exchange to strengthen its risk management and customer protection systems and report back to the regulator. On February 2, 2018, FSA inspectors conducted what was described as the first regulatory raid of a Japanese cryptocurrency exchange. In March 2018, the FSA issued a second business improvement order citing deficiencies in internal controls, AML/CFT measures, and customer asset protection. That same month, the FSA issued suspension orders to two other Japanese exchanges (Bit Station and FSHO) and issued improvement orders to five additional exchanges, reflecting a broader regulatory tightening triggered in part by the Coincheck incident. The FSA's enforcement actions against Coincheck and the industry were widely credited with catalyzing structural reform of Japan's cryptocurrency regulatory framework.","heading":"Regulatory Response — Japan FSA","sources":[{"url":"https://www.cnbc.com/2018/02/02/japanese-regulators-raid-coincheck-in-wake-of-crypto-heist.html","name":"cnbc.com","type":"other","credibility":3},{"url":"https://www.japantimes.co.jp/news/2018/01/29/business/fsa-raps-coincheck-massive-theft-customers-cryptocurrency-assets/","name":"japantimes.co.jp","type":"other","credibility":3},{"url":"https://coindesk.com/markets/2018/03/08/japans-finance-watchdog-suspends-two-crypto-exchanges/","name":"coindesk.com","type":"other","credibility":3},{"url":"https://talkingtech.cliffordchance.com/en/industries/fintech/japanese-fsa-issues-business-improvement-orders-and-suspension-o.html","name":"talkingtech.cliffordchance.com","type":"other","credibility":3},{"url":"https://financefeeds.com/japanese-financial-regulator-issues-business-improvement-order-coincheck/","name":"financefeeds.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Coincheck announced it would compensate all affected NEM holders using its own capital. The compensation rate was set at approximately 88.549 yen per XEM token — a figure lower than the pre-hack market price, calculated based on market rates between January 26 and January 31, 2018. Compensation payments to approximately 260,000 affected users began in March 2018. The total payout is reported to have been approximately $411 million. Coincheck was able to fund the compensation from existing capital without requiring external bailout financing, which distinguished the incident from the 2014 Mt. Gox collapse in which users were not promptly compensated.","heading":"User Compensation","sources":[{"url":"https://www.insurancejournal.com/news/international/2018/03/09/482824.htm","name":"insurancejournal.com","type":"other","credibility":3},{"url":"https://medium.com/@web3author/cracking-the-code-inside-the-coincheck-hack-what-you-need-to-know-948bca03256a","name":"medium.com","type":"other","credibility":3},{"url":"https://www.japantimes.co.jp/news/2018/04/06/business/online-brokerage-monex-acquire-cryptocurrency-exchange-coincheck/","name":"japantimes.co.jp","type":"other","credibility":3}],"severity":"medium"},{"content":"In April 2018, Monex Group — a publicly listed Japanese online brokerage firm — announced the acquisition of 100% of Coincheck's shares for approximately $33.5 million, a price widely described as a distressed-asset valuation. The acquisition was seen as a mechanism to recapitalize the exchange, restore operational credibility, and complete the pending FSA license application. Monex Group's involvement enabled Coincheck to overhaul management, institute stronger compliance and security frameworks, and re-engage with regulators. The acquisition was completed in mid-April 2018, at which point Coincheck became a wholly owned subsidiary of Monex Group.","heading":"Acquisition by Monex Group","sources":[{"url":"https://www.monexgroup.jp/en/news_release/irnews/auto_20180405405863/pdfFile.pdf","name":"monexgroup.jp","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/confirmed-monex-group-to-acquire-coincheck","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.japantimes.co.jp/news/2018/04/06/business/online-brokerage-monex-acquire-cryptocurrency-exchange-coincheck/","name":"japantimes.co.jp","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 11, 2019 — approximately 12 months after the hack — the FSA approved Coincheck's registration as a virtual currency exchange operator under Japan's Payment Services Act, administered through the Kanto Financial Bureau. The FSA cited improved risk management and governance systems, including concrete internal controls and enhanced customer protection measures, as the basis for approval. The license made Coincheck one of the registered exchanges in Japan and imposed ongoing AML/KYC compliance obligations.","heading":"FSA License Approval","sources":[{"url":"https://coindesk.com/markets/2019/01/11/coincheck-wins-crypto-exchange-license-12-months-after-major-hack/","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/breaking-japans-fsa-approves-license-for-hacked-crypto-exchange-coincheck-nikkei-reports","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://news.bitcoin.com/coincheck-becomes-the-first-licensed-japanese-bitcoin-exchange/","name":"news.bitcoin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In December 2024, Coincheck became the first Japanese cryptocurrency exchange to list on a U.S. stock exchange. The listing was completed through a SPAC (Special Purpose Acquisition Company) merger with Thunder Bridge Capital Partners IV. The business combination closed on December 5, 2024, and Coincheck Group N.V. began trading on the Nasdaq Global Market on December 11, 2024, under the tickers CNCK (ordinary shares) and CNCKW (warrants). At listing, the market capitalization was approximately $1.7 billion based on a closing price of $13.35 per share. Monex Group retained approximately 82% of the combined entity. Despite revenue growth, Coincheck Group reported a net loss of approximately $98.1 million as of February 2025.","heading":"Nasdaq Listing via SPAC Merger (2024)","sources":[{"url":"https://www.japantimes.co.jp/business/2024/12/12/companies/coincheck-us-nasdaq/","name":"japantimes.co.jp","type":"other","credibility":3},{"url":"https://www.coincheckgroup.com/news-events/press-releases/detail/97/thunder-bridge-capital-partners-iv-inc-and-coincheck-group-n-v-announce-closing-of-business-combination","name":"coincheckgroup.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/coincheck-makes-history-as-1st-japanese-crypto-exchange-to-debut-on-nasdaq/","name":"bitcoinist.com","type":"other","credibility":3}],"severity":"medium"},{"content":"A 2019 investigation by Japanese newspaper Asahi Shimbun, subsequently reported by multiple crypto news outlets, alleged that the Mokes and Netwire malware strains found on Coincheck employee computers have known associations with Russian threat actors. This finding shifted earlier speculation pointing toward North Korean groups. However, investigators noted that the presence of these tools does not constitute a definitive forensic trail to specific individuals or organizations. As of the time of this investigation, no criminal charges or formal attributions have been publicly filed by Japanese or international law enforcement related to the Coincheck hack. This claim is assessed as medium confidence pending official confirmation.","heading":"Alleged Attribution to Russian Hackers","sources":[{"url":"https://www.theblock.co/linked/27577/coincheck-hack-investigation-shows-possible-link-to-russian-cyber-group-report","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/app/public/index.php/news/report-record-breaking-coincheck-hack-perpetrated-by-virus-tied-to-russian-hackers/amp","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://securitytoday.com/articles/2019/06/18/report-reveals-russian-hackers-may-be-responsible-for-530-million-cryptocurrency-hack.aspx","name":"securitytoday.com","type":"other","credibility":3},{"url":"https://coingeek.com/coincheck-hacking-investigation-points-to-russian-hackers/","name":"coingeek.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2012","event":"Coincheck founded in Tokyo, Japan by Koichiro Wada and Yusuke Otsuka.","source":"","date_original":"2012-01-01"},{"date":"2017-04","event":"Japan's Payment Services Act takes effect, requiring cryptocurrency exchanges to register with the FSA. Coincheck files an application but is permitted to continue operating while the application is pending.","source":"","date_original":"2017-04-01"},{"date":"2018-01-25","event":"Attackers allegedly gain initial access to Coincheck's systems at approximately 17:57 UTC, believed to be via phishing emails that installed Mokes and Netwire malware on employee computers.","source":""},{"date":"2018-01-26","event":"At approximately 3:00 a.m. JST, 523 million NEM (XEM) tokens valued at approximately $534 million are transferred from Coincheck's hot wallet to attacker-controlled addresses. Coincheck detects the breach and halts NEM withdrawals.","source":""},{"date":"2018-01-27","event":"Coincheck publicly confirms the security breach and announces it will compensate affected users. The exchange suspends most trading and withdrawals.","source":""},{"date":"2018-01-29","event":"Japan's FSA issues its first business improvement order to Coincheck, directing the exchange to strengthen risk management and customer protection systems.","source":""},{"date":"2018-02-02","event":"FSA inspectors conduct an on-site raid of Coincheck's offices — described as the first such regulatory action against a Japanese cryptocurrency exchange.","source":""},{"date":"2018-03-07","event":"FSA issues a second business improvement order to Coincheck; separately issues suspension orders to two other Japanese exchanges and improvement orders to five more, reflecting industry-wide regulatory tightening.","source":""},{"date":"2018-03-09","event":"Coincheck begins compensating approximately 260,000 affected NEM holders, paying out approximately $411 million in total.","source":""},{"date":"2018-03-22","event":"The stolen NEM tokens are reportedly fully sold off by the attackers.","source":""},{"date":"2018-04-06","event":"Monex Group announces acquisition of 100% of Coincheck shares for approximately $33.5 million. The exchange becomes a wholly owned subsidiary.","source":""},{"date":"2019-01-11","event":"Japan's FSA approves Coincheck's registration as a licensed virtual currency exchange operator under the Payment Services Act, administered by the Kanto Financial Bureau.","source":""},{"date":"2019-06","event":"Asahi Shimbun reports that malware found on Coincheck employee computers — Mokes and Netwire — has known links to Russian threat actors, shifting earlier suspicion away from North Korea.","source":"","date_original":"2019-06-01"},{"date":"2024-12-05","event":"Shareholders of Thunder Bridge Capital Partners IV approve the business combination with Coincheck Group N.V.","source":""},{"date":"2024-12-11","event":"Coincheck Group N.V. begins trading on the Nasdaq Global Market under tickers CNCK and CNCKW, becoming the first Japanese cryptocurrency exchange listed on a U.S. exchange. Market capitalization at listing was approximately $1.7 billion.","source":""}],"sources_used":[{"url":"https://www.cnbc.com/2018/01/26/japanese-cryptocurrency-exchange-loses-more-than-500-million-to-hackers.html","name":"cnbc.com","type":"other","archive_url":"http://web.archive.org/web/20260203123653/https://www.cnbc.com/2018/01/26/japanese-cryptocurrency-exchange-loses-more-than-500-million-to-hackers.html","credibility":3,"archive_timestamp":"2026-02-03T12:36:53+00:00"},{"url":"https://fortune.com/2018/01/31/coincheck-hack-how/","name":"fortune.com","type":"other","archive_url":"http://web.archive.org/web/20260604020028/https://fortune.com/2018/01/31/coincheck-hack-how/","credibility":3,"archive_timestamp":"2026-06-04T02:00:28+00:00"},{"url":"https://finance.yahoo.com/news/report-record-breaking-coincheck-hack-084700348.html","name":"finance.yahoo.com","type":"other","archive_url":"https://web.archive.org/web/20260829192949/https://finance.yahoo.com/news/report-record-breaking-coincheck-hack-084700348.html","credibility":3,"archive_timestamp":"2026-08-29T19:29:49+00:00"},{"url":"https://www.sciencedirect.com/science/article/pii/S2665910721000724","name":"sciencedirect.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://securitytoday.com/articles/2019/06/18/report-reveals-russian-hackers-may-be-responsible-for-530-million-cryptocurrency-hack.aspx","name":"securitytoday.com","type":"other","archive_url":"http://web.archive.org/web/20260609052550/https://securitytoday.com/articles/2019/06/18/report-reveals-russian-hackers-may-be-responsible-for-530-million-cryptocurrency-hack.aspx","credibility":3,"archive_timestamp":"2026-06-09T05:25:50+00:00"},{"url":"https://cointelegraph.com/news/coincheck-stolen-534-mln-nem-were-stored-on-low-security-hot-wallet","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260101124302/https://cointelegraph.com/news/coincheck-stolen-534-mln-nem-were-stored-on-low-security-hot-wallet","credibility":3,"archive_timestamp":"2026-01-01T12:43:02+00:00"},{"url":"https://dn.institute/research/cyberattacks/incidents/2018-01-28-coincheck/","name":"dn.institute","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.security/crypto-blockchain-security/coincheck-hack/","name":"crypto.security","type":"other","archive_url":"http://web.archive.org/web/20260307081427/https://crypto.security/crypto-blockchain-security/coincheck-hack/","credibility":3,"archive_timestamp":"2026-03-07T08:14:27+00:00"},{"url":"https://www.cnbc.com/2018/02/02/japanese-regulators-raid-coincheck-in-wake-of-crypto-heist.html","name":"cnbc.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.japantimes.co.jp/news/2018/01/29/business/fsa-raps-coincheck-massive-theft-customers-cryptocurrency-assets/","name":"japantimes.co.jp","type":"other","archive_url":"http://web.archive.org/web/20260107154217/https://www.japantimes.co.jp/news/2018/01/29/business/fsa-raps-coincheck-massive-theft-customers-cryptocurrency-assets/","credibility":3,"archive_timestamp":"2026-01-07T15:42:17+00:00"},{"url":"https://coindesk.com/markets/2018/03/08/japans-finance-watchdog-suspends-two-crypto-exchanges/","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://talkingtech.cliffordchance.com/en/industries/fintech/japanese-fsa-issues-business-improvement-orders-and-suspension-o.html","name":"talkingtech.cliffordchance.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://financefeeds.com/japanese-financial-regulator-issues-business-improvement-order-coincheck/","name":"financefeeds.com","type":"other","archive_url":"https://web.archive.org/web/20260829193002/https://financefeeds.com/japanese-financial-regulator-issues-business-improvement-order-coincheck/","credibility":3,"archive_timestamp":"2026-08-29T19:30:02+00:00"},{"url":"https://www.insurancejournal.com/news/international/2018/03/09/482824.htm","name":"insurancejournal.com","type":"other","archive_url":"http://web.archive.org/web/20260315200028/https://www.insurancejournal.com/news/international/2018/03/09/482824.htm","credibility":3,"archive_timestamp":"2026-03-15T20:00:28+00:00"},{"url":"https://medium.com/@web3author/cracking-the-code-inside-the-coincheck-hack-what-you-need-to-know-948bca03256a","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.japantimes.co.jp/news/2018/04/06/business/online-brokerage-monex-acquire-cryptocurrency-exchange-coincheck/","name":"japantimes.co.jp","type":"other","archive_url":"https://web.archive.org/web/20260829202732/https://www.japantimes.co.jp/news/2018/04/06/business/online-brokerage-monex-acquire-cryptocurrency-exchange-coincheck/","credibility":3,"archive_timestamp":"2026-08-29T20:27:32+00:00"},{"url":"https://www.monexgroup.jp/en/news_release/irnews/auto_20180405405863/pdfFile.pdf","name":"monexgroup.jp","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/confirmed-monex-group-to-acquire-coincheck","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251210113551/https://cointelegraph.com/news/confirmed-monex-group-to-acquire-coincheck","credibility":3,"archive_timestamp":"2025-12-10T11:35:51+00:00"},{"url":"https://coindesk.com/markets/2019/01/11/coincheck-wins-crypto-exchange-license-12-months-after-major-hack/","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/breaking-japans-fsa-approves-license-for-hacked-crypto-exchange-coincheck-nikkei-reports","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260121194446/https://cointelegraph.com/news/breaking-japans-fsa-approves-license-for-hacked-crypto-exchange-coincheck-nikkei-reports","credibility":3,"archive_timestamp":"2026-01-21T19:44:46+00:00"},{"url":"https://news.bitcoin.com/coincheck-becomes-the-first-licensed-japanese-bitcoin-exchange/","name":"news.bitcoin.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.japantimes.co.jp/business/2024/12/12/companies/coincheck-us-nasdaq/","name":"japantimes.co.jp","type":"other","archive_url":"http://web.archive.org/web/20250912100850/https://www.japantimes.co.jp/business/2024/12/12/companies/coincheck-us-nasdaq/","credibility":3,"archive_timestamp":"2025-09-12T10:08:50+00:00"},{"url":"https://www.coincheckgroup.com/news-events/press-releases/detail/97/thunder-bridge-capital-partners-iv-inc-and-coincheck-group-n-v-announce-closing-of-business-combination","name":"coincheckgroup.com","type":"other","archive_url":"http://web.archive.org/web/20260418163038/https://www.coincheckgroup.com/news-events/press-releases/detail/97/thunder-bridge-capital-partners-iv-inc-and-coincheck-group-n-v-announce-closing-of-business-combination","credibility":3,"archive_timestamp":"2026-04-18T16:30:38+00:00"},{"url":"https://bitcoinist.com/coincheck-makes-history-as-1st-japanese-crypto-exchange-to-debut-on-nasdaq/","name":"bitcoinist.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.theblock.co/linked/27577/coincheck-hack-investigation-shows-possible-link-to-russian-cyber-group-report","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/app/public/index.php/news/report-record-breaking-coincheck-hack-perpetrated-by-virus-tied-to-russian-hackers/amp","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coingeek.com/coincheck-hacking-investigation-points-to-russian-hackers/","name":"coingeek.com","type":"other","archive_url":"http://web.archive.org/web/20251213093205/https://coingeek.com/coincheck-hacking-investigation-points-to-russian-hackers/","credibility":3,"archive_timestamp":"2025-12-13T09:32:05+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:55:01.49806+00:00","updated_at":"2026-08-29T20:45:07.229033+00:00"}}