TL;DR
- Japan’s Zaif exchange lost 6.7 billion yen ($60 million) in a hot wallet breach on September 14, 2018
- Of the stolen funds, 4.5 billion yen belonged to customers while only 2.2 billion yen were company assets
- The attacker siphoned 5,966 BTC ($37.8 million), plus Bitcoin Cash and MonaCoin, in under two hours
- This was the second major Japanese exchange hack of 2018, following Coincheck’s $530 million loss in January
- The incident accelerated the push toward decentralized exchange solutions and self-custody protocols
On September 14, 2018, between 17:00 and 19:00 local time, an attacker breached the hot wallet infrastructure of Zaif, a Japanese cryptocurrency exchange operated by Tech Bureau Corp. The hacker transferred Bitcoin, Bitcoin Cash, and MonaCoin to wallets under their control, making off with approximately 6.7 billion yen — roughly $60 million at the time. The exchange discovered the breach on September 17 and publicly disclosed it the following day after confirming the scope of the loss with law enforcement.
BREAKING DOWN THE $60 MILLION HEIST
The stolen assets were overwhelmingly Bitcoin. Of the 6.7 billion yen taken, approximately 5,966 BTC — worth $37.8 million — was Bitcoin alone. The remaining losses came from Bitcoin Cash and MonaCoin, though Tech Bureau noted it was still investigating the exact breakdown of those assets. Critically, 68% of the stolen funds — about 4.5 billion yen — belonged to Zaif customers. Only 2.2 billion yen, roughly 32%, came from the company’s own reserves.
The breach followed a pattern that had become disturbingly familiar in the cryptocurrency industry. Hot wallets, which maintain lighter security measures to facilitate rapid transactions, have consistently served as the primary attack vector for exchange hacks. The Zaif attacker exploited this vulnerability during a two-hour window, moving funds before the exchange’s monitoring systems detected the anomaly.
JAPAN’S REGULATORY RECKONING
The Zaif hack landed just eight months after the Coincheck disaster in January 2018, where attackers stole $530 million worth of NEM tokens from the Tokyo-based exchange. Together, the two incidents represented over $590 million in losses from Japanese exchanges alone in a single year — a staggering figure that forced regulators to act.
Japan’s Financial Services Agency (FSA) launched emergency inspections of cryptocurrency exchange operators’ asset management practices in the aftermath. The country had become the first in the world to regulate cryptocurrency exchanges in 2017, requiring registration with the FSA and imposing reporting obligations. Despite these measures, the frequency and scale of the breaches exposed significant gaps in enforcement and exchange-level security standards.
In a bid to make customers whole, Tech Bureau sold a majority stake in Zaif to Fisco Ltd., a Japanese financial services firm, for 5 billion yen ($44.6 million). The investment was earmarked specifically to reimburse users who lost funds in the attack.
WHY HOT WALLETS REMAIN THE WEAKEST LINK
The Zaif incident crystallized a fundamental tension in cryptocurrency exchange operations: the trade-off between accessibility and security. Hot wallets must remain connected to the internet to process deposits, withdrawals, and trades in real time. This connectivity, however, creates a persistent attack surface that determined adversaries can exploit through social engineering, insider threats, or direct technical intrusion.
By contrast, cold storage wallets — which require multiple authentication steps and remain offline — are far more resistant to remote attacks. Industry best practices dictate that exchanges should keep only a small percentage of total funds in hot wallets, with the vast majority secured in cold storage. The fact that Zaif lost $60 million from its hot wallet alone raised serious questions about the proportion of customer funds exposed to internet-facing systems.
THE DEFI IMPERATIVE
The cascade of exchange hacks throughout 2018 — from Coincheck to Zaif and beyond — served as a powerful catalyst for the decentralized finance movement. If centralized exchanges could not be trusted to safeguard user funds, the reasoning went, then the solution lay in protocols that eliminated the custodial middleman entirely.
Ethereum, trading at $221 on September 16, 2018, was already home to early DeFi experiments like MakerDAO and decentralized exchange protocols such as 0x. The Zaif hack reinforced the core value proposition of these projects: users who control their own private keys face no counterparty risk from exchange collapses or security breaches. Bitcoin, at $6,517, continued to serve as the benchmark asset against which all crypto security discussions were measured.
The incident also highlighted the emerging role of security auditing and formal verification in blockchain development. As the DeFi ecosystem would grow exponentially in subsequent years, the lessons of 2018 exchange failures would inform the design of smart contract security standards, multi-signature wallet architectures, and insurance protocols designed to protect against the exact type of loss Zaif customers experienced.
Why This Matters
The Zaif hack was not just another exchange breach — it was a tipping point that accelerated the crypto industry’s shift from centralized custodial services toward trustless, decentralized alternatives. Every DeFi protocol that now allows users to trade, lend, or earn yield without surrendering custody of their assets owes part of its momentum to the painful lessons of 2018. The $60 million stolen from Zaif customers was a high price to pay, but it helped forge the security-first mindset that underpins modern decentralized finance.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions.
breach on friday, discovered monday. 3 days of zero monitoring on customer funds after coincheck already lost 530M. the FSA should have shut them down
Tech Bureau knew about the breach Friday and waited til Monday to disclose. that alone should have killed the company but somehow they kept operating
MonaCoin sitting next to 5966 BTC in a hot wallet is peak 2018 energy. japanese exchanges were treating meme coins like they were BTC reserves
monacoin was just whatever sat liquid next to the btc, attacker dumped everything they could touch. it was never a reserve asset, pure collateral damage
5966 BTC gone in under two hours and nobody noticed for three days. hot wallets were basically an open vault back then
the 3 day delay between the hack and discovery is the craziest part. any exchange not monitoring outgoing txs in real time deserved to get hit
5,966 BTC in a hot wallet months after Coincheck lost $530 million. some exchange operators really needed to touch grass
5,966 BTC in hot wallet after Coincheck hack? unbelievable negligence
4.5 billion yen of customer funds out of 6.7 billion total. the proportion of customer money vs company assets in these hacks is always depressing. also MonaCoin being part of the haul is somehow funny
monacoin being stolen alongside btc and bch is the most 2018 thing ever. japanese exchange running meme coin infrastructure in hot wallets
monacoin was a legit meme coin in japan, had actual community and mining. not every altcoin in 2018 was a total joke
coincheck in january, zaif in september. two japanese exchanges losing half a billion combined and somehow they kept their licenses
coincheck kept operating too. japans FSA basically gave everyone a slap on the wrist and told them to file better paperwork
FSA basically gave everyone a slap on the wrist for losing half a billion
the FSA basically did nothing after coincheck either. zaif should have been shut down after the first incident
5,966 BTC siphoned in under 2 hours and nobody noticed until 3 days later. exchange security in 2018 was genuinely terrifying
5966 BTC in a hot wallet. in what universe does an exchange need 5966 BTC liquid at any given moment. thats 100% negligence
Zaif claimed the wallet was sized for withdrawal flows, which is at least plausible for an exchange doing MonaCoin volume back then. Skeleton ops though. Nobody in 2018 had modeled the worst case
5966 BTC in a hot wallet 8 months after Coincheck lost 530M. Zaif basically watched their neighbor house burn down and left their own stove on
5966 BTC in a hot wallet 8 months after Coincheck lost 530M. Zaif watched their neighbor burn to the ground and still left the stove on. criminal negligence
hot_wallet_skeptic_ 5966 BTC in a hot wallet is not liquidity management. thats negligence dressed up as convenience. no exchange needs that much hot
the breach happened Friday and they noticed Monday. 3 days of zero monitoring on customer funds. FSA paperwork was apparently more important than actual security
Sakamoto R. 3 days is wild. even Mt Gox noticed faster than that and they were famously incompetent
the FSA response was paperwork and warnings. two exchanges lose a combined 600M and nobody loses a license. japanese regulators were asleep at the wheel in 2018
everyone remembers the 5966 btc but the detail that got buried was 4.5 billion yen of customer money vs only 2.2 billion of company assets in that hot wallet. custodians in name only