Coincheck

On January 26, 2018, hackers stole approximately 58 billion yen (around $530 million USD) worth of NEM (XEM) tokens from Coincheck — one of the largest crypto thefts in history. The breach occurred because the NEM was held in a hot wallet without multi-signature protection, leaving it fully exposed. Coincheck reimbursed all ~260,000 affected users from its own capital at a rate of ¥88.549 per XEM. The exchange was subsequently acquired by Monex Group in April 2018, which overhauled its security and compliance infrastructure.

Following the hack, Coincheck overhauled its security infrastructure significantly. The exchange migrated the majority of customer assets to cold storage wallets and implemented multi-signature authorization for fund movements. Monex Group's acquisition brought stronger corporate governance and compliance frameworks. Coincheck also strengthened its KYC and AML procedures, enhanced internal risk management systems, and operates under ongoing supervision by Japan's Financial Services Agency (FSA), which issued a business improvement order requiring these structural changes.

Coincheck is licensed by Japan's Financial Services Agency (FSA) under the Payment Services Act, and is listed on Nasdaq since December 2024. FSA registration requires strict standards for capital adequacy, customer asset segregation, AML/KYC controls, and cybersecurity practices. That said, its 2018 incident remains the benchmark against which its security posture is judged. Users should enable 2FA and avoid leaving large balances on any custodial exchange. No major security breaches have occurred since the 2018 event.

Coincheck is primarily designed for Japanese residents and optimized for JPY deposits and withdrawals. While users from certain countries can technically register, access is restricted for US, China, Russia, North Korea, Iran, and other sanctioned jurisdictions. The platform's UI, customer support, and fiat banking integrations are largely Japan-centric. International users face limited fiat access and higher friction than Japanese account holders.

As of 2024–2025, Coincheck does not publicly publish a cryptographically verifiable Proof of Reserves. Independent evaluators such as CoinGecko rate Coincheck's PoR transparency as unavailable. The FSA regulatory framework provides some oversight of asset management practices, but this is not equivalent to the self-attestation or Merkle-tree-based PoR that exchanges like Kraken publish. Users cannot independently verify that their balances are backed 1:1 on-chain.