Coincheck lost ¥58B of NEM from a hot wallet and refunded most of it

In January 2018, Tokyo-based exchange Coincheck held 523 million NEM tokens in a hot wallet — storage connected to the internet. On the night of January 26, hackers moved the coins out of the exchange's NEM address. COO Yusuke Otsuka put the loss at 58 billion yen ($534 million), which at the time made it the biggest digital-currency theft ever, surpassing Mt. Gox's 2014 loss.

The coins were kept in a hot wallet for ease of trading, the company acknowledged, while a cold wallet would have kept them offline. Coincheck froze deposits and withdrawals of every cryptocurrency except bitcoin, reported the theft to police and Japan's Financial Services Agency, and said it was still counting how many customers were affected.

Two days later Coincheck promised to use its own funds to reimburse more than 46 billion yen ($423 million) — nearly 90% of the NEM's value at detection. The FSA issued a business improvement order, and in April 2018 Monex Group bought all of Coincheck for 3.6 billion yen ($33.6 million), folding the tainted exchange into a mainstream brokerage.

523M NEM worth ¥58B (~$534M) stolen from a hot wallet; Coincheck refunded ¥46.3B (~90%) and was sold to Monex for ¥3.6B.

Customer assets sat in an internet-connected hot wallet with no stated balance limit.

The theft hit on a Friday and was only counted after the fact, so withdrawals had to be frozen across the exchange.

Japan's exchange licensing did not prevent an operator from storing coins insecurely.

Coincheck could not immediately confirm how many customers were affected, deepening the panic.

Money held online is money at risk: keep most customer funds in cold storage, limit hot-wallet balances, and treat a breach as an eventuality with controls already in place.

Coincheck refunded about ¥46.3 billion to customers from its own funds, and Japan's FSA ordered it to improve consumer protection and anti-money-laundering controls. NEM fell 11% in the 24 hours after the theft was disclosed. Monex Group completed its ¥3.6 billion acquisition of all Coincheck shares on April 16, 2018, letting the exchange restart under a mainstream brokerage's governance.