Japan’s Financial Services Agency delivered a watershed moment for cryptocurrency security on February 10, 2026, releasing a new framework policy draft that establishes mandatory cybersecurity standards for all registered cryptocurrency exchanges operating in the country. The announcement marks a decisive shift from asset-focused security to comprehensive ecosystem defense, acknowledging that cold wallet storage alone can no longer protect against the sophisticated threats targeting the digital asset industry.
The Threat Landscape
The FSA’s policy announcement comes at a time of escalating cyber threats against cryptocurrency infrastructure. According to a comprehensive defense-in-depth report published by Fireblocks on the same day, hackers stole over $3.4 billion worth of cryptocurrency in 2025 alone, with total stolen amounts since 2020 surpassing $17 billion. North Korea’s state-sponsored hacking operations account for three-quarters of all attacks on crypto platforms, with operations nearly five times larger on average than other threat actors.
The FSA specifically observed that while offline cold wallets protect assets from direct remote hacking, modern threat actors have adapted by targeting the human and operational infrastructure supporting digital asset management. The agency acknowledged that recent high-profile breaches in 2024 exposed vulnerabilities in employee training, phishing protocols, third-party vendor management, and data integrity protections.
Core Principles
The new regulatory framework introduces mandatory Cybersecurity Self-Assessments (CSSA) for all registered crypto exchanges. The CSSA requires exchanges to systematically evaluate multiple security domains: technical infrastructure including wallet security and network architecture, human and operational risks covering employee training and phishing protocols, third-party vendor management, and data integrity protections compliant with Japan’s Personal Information Protection Act.
The framework rests on three interconnected pillars designed to create a multi-layered defense system. The self-help pillar places primary responsibility on individual exchanges, requiring all registered platforms to conduct mandatory assessments starting in fiscal year 2026 beginning April 1. The mutual assistance pillar leverages collective intelligence through industry collaboration, strengthening the security committee functions of the Japan Virtual and Crypto Assets Exchange Association (JVCEA) while encouraging exchanges to actively share threat intelligence and attack patterns across the sector.
Tooling and Setup
Under the public help pillar, the FSA will continue the international joint blockchain research on emerging threats that began in fiscal year 2025, while involving the entire crypto exchange sector in the Delta Wall joint cybersecurity exercise for financial organizations within three years of the policy’s adoption. During fiscal year 2026, the FSA plans to conduct real penetration tests on specific operators and may hire ethical hackers to attempt intrusions into live exchange systems.
These authorized attacks will identify vulnerabilities before malicious hackers can exploit them, with findings shared confidentially to help affected exchanges patch weaknesses. This approach provides objective monitoring that complements self-assessments and raises the baseline security posture across the entire Japanese crypto industry.
Ongoing Vigilance
The FSA will accept public comments until March 11, giving exchanges and security experts three weeks to provide feedback before the regulations are finalized for implementation. The three-pillar structure creates accountability at every level: exchanges bear primary responsibility for their own security, the industry shares collective intelligence to raise standards, and governmental oversight provides testing and support.
With the cryptocurrency market experiencing a correction phase in early February 2026—Bitcoin trading at approximately $68,794, roughly 40 percent below its October 2025 peak—the timing of these regulations is particularly significant. Market downturns often correlate with increased attack activity as threat actors exploit operational distractions and reduced security staffing during restructuring periods.
Final Takeaway
Japan’s FSA has recognized a fundamental truth that the global crypto industry must confront: perimeter defenses and cold storage are necessary but insufficient. The mandatory cybersecurity framework establishes a precedent that other regulators are likely to follow, pushing exchanges toward a defense-in-depth approach that addresses human factors, supply chain risks, and institutional resilience alongside traditional technical safeguards. For exchanges operating in or connected to the Japanese market, compliance preparation should begin immediately.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any security-related decisions.
Japan FSA taking the lead again. $3.4B stolen in 2025 alone and most exchanges still treat security as an afterthought. This framework is overdue.
Japan FSA has been ahead on exchange regulation since the Coincheck hack. cold wallet mandates werent enough and they know it. this framework is overdue
Coincheck was the wake up call but Mt Gox should have been. Japan has been iterating on exchange regs longer than anyone
FSA mandating defense in depth while the SEC keeps doing enforcement by lawsuit. Japan actually protects users, the US protects lawyer budgets
the framework mentions ecosystem defense but nobody is talking about how many exchanges still share custody keys across team members. that is the actual problem
secops_grunt_ sharing custody keys across team members is how the Bybit hack happened. the FSA framework should be global baseline
the north korea stat is terrifying. 75% of all crypto platform attacks and 5x larger operations than other actors. state sponsored hacking is industrial scale now
Akira T. 75% stat came from the Fireblocks report same day as the FSA draft. coordination or convenient timing?
the NK stats get worse every year. they fund missile programs with exchange hacks and nobody in defi talks about it
Akira T. is right, the NK stats are staggering. 75% of all attacks and 5x the scale. this isnt hacking anymore, its parallel state economy
cold wallets are necessary but not sufficient. anyone who says otherwise hasnt been paying attention to the Bybit hack
FSA mandating defense in depth while US regulators argue about whether tokens are securities. different planets
Japan mandating defense in depth while the SEC is still arguing about whether ETH is a security. the gap in regulatory competence is embarrassing
tsuka_dev_ its not even competence its priorities. FSA cares about user protection, SEC cares about enforcement wins. different mandates different results
Yui H. FSA vs SEC comparison is spot on. one protects users, the other protects enforcement budgets. the cultural gap in regulatory philosophy is massive
NK at 75% of all crypto attacks and we still have CEXs sharing custody keys in slack. the FSA framework is a wake up call nobody asked for but everyone needed
kessho_ CEXs sharing custody keys in Slack is criminal. the fact that this is still happening after Bybit is beyond comprehension
the FSA framework requiring multi-sig and HSM is basically admitting that self-custody at exchange scale is unsolved. every major hack since Mt Gox traced back to single points of failure in key management
kenji_devops the HSM mandate is interesting because hardware security modules cost 6 figures minimum. smaller exchanges will just merge into bigger ones to afford compliance
Mikkel S. HSMs starting at 6 figures means small exchanges will just merge or shut down. which is probably the FSA goal tbh
3.4 billion stolen in 2025 and exchanges still resist mandatory security frameworks. the FSA is doing what every regulator should have done years ago
hiroshi_b the resistance is because compliance costs money. easier to blame hackers than invest in proper key management infrastructure
NK stealing 75% of all crypto and Japan is the first to actually mandate key management standards. every other regulator is still writing think pieces about whether staking is a security
compliance_tax_ 3.4B stolen in a single year and Japan is the only country treating it like the crisis it is. EU and US are still writing discussion papers
NK responsible for 75 pct of crypto thefts in 2025 and the FSA is the first regulator to actually mandate cold wallet alternatives. embarrassing it took this long