$530-mn Coincheck heist sheds light on Japan's rush to create crypto rules

After the Mt. Gox cryptocurrency exchange was stung by a half-billion-dollar theft in 2014, Japanese regulators swung into action.

Their goal was to craft rules that both protected traders and allowed a promising sector to flourish. By last April, they thought they had arrived at a set of guidelines that did just that.

Japan's national system to oversee cryptocurrency trading was the world's first, rolled out even as policymakers elsewhere grappled with how to deal with the sector. Under the Japanese framework, some exchanges would be allowed to operate - even though they hadn't yet won regulatory approval.

One of those was Coincheck Inc. Last month, hackers stole about $530 million from the Tokyo-based exchange, a theft rivalling Mt. Gox's as one of the biggest ever for the digital currency.

The Coincheck heist exposed flaws in Japan's system. And for some experts, it raised questions over the country's dash to regulate the industry - a sharp contrast to clampdowns by countries like South Korea and China.

Interviews with a dozen government officials, lawmakers and cryptocurrency industry leaders depict a regulator that opted for relatively loose rules to help nurture an industry largely populated by start-ups.

Japan's Financial Services Agency declined to comment.

But proponents of its regulatory approach say the system and the hack were not connected.

"It's too much to say that the FSA or institutional design was lax because there was one hack," said former information technology vice-minister Mineyuki Fukuda, previously a supporter in the parliament of promoting and regulating cryptocurrencies.

"It's not money"

In the wake of the Mt. Gox bankruptcy, Japan didn't know what to make of bitcoin - or even who should be in charge.

"It's not money," Finance Minister Taro Aso told reporters days after the exchange collapsed. "Does the Financial Services Agency have jurisdiction? The Finance Ministry? The Consumer Affairs Agency? The Ministry of Economy, Trade and Industry?"

Amid the vacuum of oversight, the governing Liberal Democratic Party, seeing the fin-tech sector as a way to stimulate growth, initially called for the cryptocurrency industry to form a body to regulate itself.

That led to the formation of the Japan Authority of Digital Assets (JADA), comprising blockchain and cryptocurrency start-ups and entrepreneurs.

When the FSA was later tasked with creating regulations for cryptocurrencies, it turned to JADA for help. The group lobbied for rules friendly to start-ups, like low capital requirements.

"We had constant discussions with the FSA, giving technical information and ideas," said So Saito, a founding member of JADA and now general counsel of its successor, the Japan Blockchain Association (JBA).

The FSA's rules required exchanges to register, operate robust computer systems and address risk management.

But they left the storage of assets to a set of non-binding guidelines. Exchanges should keep the encrypted keys needed to access digital money in "cold wallets" - for example, USB drives not connected to the internet - only if doing so didn't overly inconvenience customers, the guidelines said.

In effect, the clause left no obstacle to Coincheck's holding $530 million worth of NEM crypto-coins in an online "hot wallet" - essentially a digital folder stored on a server - from which the funds were stolen.

"The FSA was quite relaxed on protecting consumers on things like cold wallets and hot wallets," said the chief financial officer of a major Japanese cryptocurrency exchange.

Japan vs the world

Policymakers across the world have grappled with how to deal with cryptocurrencies. Most have been sceptical about trade in digital assets.

U.S. regulators may ask Congress to legislate more oversight of digital money, the head of the Securities and Exchange Commission said this month.

In Asia, South Korea is embracing strong oversight of cryptocurrency trading, at one point saying it might shut down local exchanges. China, concerned about financial stability, last year ordered some exchanges to close. India this month vowed to stamp out the use of cryptocurrencies altogether.

Statistics on cryptocurrencies are patchy because their trading is unregulated in most countries. But Japan accounts for between a third and half of all global bitcoin trade, exchange operators say - a share of the market that has grown as other jurisdictions have cracked down.

As Japan's rules came into effect last April, exchanges were given six months to register.

But even those that registered but weren't approved could continue to operate.

Coincheck was among the exchanges that didn't win approval. By the time it filed its application in mid-September, bitcoin was surging towards a record high of $19,458, which it hit in December.

The exchange had grown to one of Japan's biggest amid a sharp increase in trading, moving to a new headquarters from a dingy backstreet office. Its share of domestic bitcoin trades soared to 55 percent in December from only 7 percent a year earlier, data from Jpbitcoin.com show.

In an interview with Reuters last year, Kaga Kawabata, Coincheck's business development manager, was dismissive of the FSA's oversight, even as the exchange prepared to register.

"They have no knowledge. Every year someone moves, and it's a big pain to educate them," he said.

The FSA said last week it didn't approve Coincheck partly because of worries about weaknesses in the exchange's systems, declining to give further details. It allowed Coincheck to continue operating, calling for improvements without a specific timeline.

The regulator was in a bind, industry insiders said: Coincheck had grown so big that the FSA couldn't reject its application.

"Consumers would be upset. It was politically difficult to close down Coincheck," said Masakazu Masujima, a lawyer and adviser to the Japan Cryptocurrency Business Association, an industry body. "So they kept requesting it to improve its systems."