What Happened in the Coincheck Hack?
Coincheck lost around $530M in NEM in 2018 because all of it sat in one hot wallet without multisig. Here's what happened and how it changed exchange security.
In January 2018, Japanese exchange Coincheck lost around $530 million worth of NEM tokens in a single breach, at the time the largest crypto theft ever. The reason it was so large came down to a basic storage decision.
What Happened
Attackers gained access to Coincheck's systems and transferred roughly 523 million NEM tokens out of the exchange. Reports later indicated that the breach began with malware reaching employee computers, giving attackers a path to the wallet's private key.
The Core Problem: Everything Was in a Hot Wallet
Coincheck held essentially all of its customers' NEM in a single hot wallet, one whose key was connected to the internet. Exchanges normally keep only a small portion of funds in hot wallets for day-to-day withdrawals and store the rest offline in cold storage. Keeping everything online meant one compromise could reach all of it.
Multisig Wasn't Used Either
The NEM network supported multisig, which would have required multiple independent approvals for large transfers. Coincheck reportedly hadn't implemented it for this wallet, so a single compromised key was enough.
How Customers Were Treated
Coincheck announced it would compensate around 260,000 affected customers in Japanese yen, at a set rate per token, using its own funds. It also temporarily suspended withdrawals of various assets while it reviewed its security.
How Regulators Responded
Japan's Financial Services Agency issued business improvement orders to Coincheck and other exchanges, and inspections across the industry followed. Coincheck was later acquired by an established financial group. The incident helped push Japan toward some of the strictest exchange rules in Asia, including rules on segregating and securing customer assets.
Lesson One: Hot vs. Cold Storage Matters
How an exchange stores funds determines how much a single breach can take. Mature exchanges today use layered systems with most assets offline, which is why reports on newer incidents, like Bitget's this year, focus on whether cold wallets were affected.
Lesson Two: Available Safeguards Only Help If Used
Multisig existed on the network and wasn't used. Security features on paper protect nothing until they're actually implemented.
Lesson Three: Compensation Depends on the Exchange
Coincheck customers were compensated because the company had the means and chose to. That's not guaranteed elsewhere, as Mt. Gox customers learned.
Keep on exchanges only what you need for trading. How an exchange stores its funds is something you usually can't see until it's too late.