Story image

Coincheck promises £380m refund after massive cryptocurrency breach

30 Jan 18

​Tokyo-based cryptocurrency company Coincheck announced on Sunday that it would refund around £380 million of the virtual money it recently had stolen.

This amounts to almost 90 percent of the 58 billion yen worth of NEM coins the company lost from its roughly 260,000 customers.

CEO of web security company High-Tech Bridge Ilia Kolochenko says both the breach and Coincheck’s actions afterwards are groundbreaking.

"This case is undoubtedly the largest breach in the foggy realm of crypto-currencies,” says Kolochenko.

“Nonetheless, I would certainly refrain from panic: Coincheck's announcement to compensate the victims of the breach is laudable and boosts trust towards digital currencies.”

Coincheck discovered the attack on Friday last week and was forced to suspend withdrawals of all cryptocurrencies except bitcoin.

The company held a press conference on late Friday and disclosed that its NEM coins were stored in a ‘hot wallet’ as opposed to the more secure ‘cold wallet’ outside the Internet.

When asked why, Coincheck president Koichiro Wada pointed to technical difficulties and a lack of sufficient staff capable of dealing with them.

Incident detection in eight hours is also comparatively good timing: many large companies detect similar incidents in a few months. We can clearly see the difference between amateurs operating Mt. Gox in 2014, and well-prepared professionals behind Coincheck,” says Kolochenko.

“It is unclear how the breach took place, but I would not exclude insider activities or a at least an accomplice. Hopefully, a technical investigation will shed some light on the incident.”

Kolochenko says the steady growth and wider adoption of digital coins continuously increases their attractiveness for cybcercriminals.

“Unlike fraudulent bank or PayPal transactions, theft of digital coins is very difficult to trace and virtually impossible to revert,” Kolochenko says.

“Despite persistent lack of qualified personnel and insufficient governmental funding, law enforcement agencies managed to build decent teams and effective processes to detect, investigate and prosecute theft from bank accounts.”

And in spite of the recent and growing spate of attacks involving cryptocurrencies, Kolochenko says proper investigation of incidents is still nascent in most countries.

“Lack of regulation, opaque ownership and decentralization - make digital coins a low hanging fruit for cyber gangs who can easily grow their profits without increasing their efforts. I would expect many similar incidents in 2018, unfortunately,” Kolochenko concludes.

JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.
WatchGuard appoints new channel distributors in A/NZ
The appointments will enable WatchGuard to expand its regional channel reseller footprint.
Tensions on the rise after Huawei CFO arrest
“Recently our corporate CFO, Meng Wanzhou, was provisionally detained by the Canadian authorities on behalf of the United States of America."
Palo Alto Networks integrates RedLock and VM-Series with AWS Security Hub
AWS Security Hub is designed to provide users with a comprehensive view of their high-priority security alerts and compliance status.