Zaif's ¥6.7B hot-wallet hack: management out, exchange sold to FISCO

Zaif, an Osaka exchange run by Tech Bureau, was hacked on September 14, 2018: unauthorized access hit the server managing the hot wallet used for customer deposits and withdrawals, draining bitcoin, Monacoin and bitcoin cash worth about ¥6.7 billion — roughly $60 million — of which ¥4.5 billion belonged to customers. The anomaly was detected on September 17 and disclosed on September 20; the estimate was later revised up to about ¥7 billion.

The company had spent 2018 on the regulator's watchlist — the Financial Services Agency issued business improvement orders in March and again in June — yet the hot-wallet architecture stayed. After the hack the FSA issued a report-submission order and moved to on-site inspection, and president Takao Asayama and the incumbent management resigned.

On October 10 Tech Bureau signed a formal agreement transferring the Zaif business to FISCO Crypto Exchange, and set compensation: BTC and BCH returned at the same amounts in kind, while MONA holders got 60% in MONA and the remaining 40% in yen at ¥144.548 per coin — above Zaif's own market price, because stolen MONA was too illiquid to repurchase. Everything traded in deep markets came back whole; the one thin market ate a 40% haircut.

Services resumed in stages under FISCO — MONA spot trading reopened in April 2019 — and the two FISCO-run exchanges were slated to merge their systems within 2019.

¥6.7B (~$60M) stolen, ¥4.5B of it customer crypto; MONA holders ate 40% of their loss in yen

Customer assets sat in a hot wallet administered on a single server; one intrusion during a two-hour window was enough to drain it.

Regulators had flagged the company twice in six months, but improvement orders changed paperwork, not the architecture that failed.

MONA's thin market meant the stolen amount could not be repurchased without moving the price, so part of the loss was settled in yen — illiquidity converted directly into customer losses.

A hot wallet online is a standing offer to attackers. Regulatory warnings change nothing if the architecture stays — and stolen coins too illiquid to buy back mean users eat the gap.

Under FISCO the exchange resumed services gradually through 2019, with MONA trading relaunched in April 2019 and the exchange systems integrated soon after. Tech Bureau's own ¥2.2 billion in assets went down with the hot wallet, and its management left with the company. The rescuer itself did not stay: in May 2026 FISCO, the listed parent, removed crypto and blockchain from its business segments and exited the sector.