Stolen Coincheck Cryptocurrency Traced to Canada: Researcher

(Bloomberg) -- Some of the funds stolen from Coincheck Inc. in the $500 million heist have been traced to a cryptocurrency exchange in Canada, according researcher BIG Blockchain Intelligence Group Inc.

Some of the stolen NEM coins are being transferred to a Vancouver-based exchange, where they are being converted to other cryptocurrencies and then possibly sent back to Japan, according to Shone Anstey, president and co-founder of BIG. Anstey declined to name the exchange, give the amount or the destination in Japan, but said the findings will be turned over to law enforcement.

“We felt it was a significant amount that warranted looking into,” Anstey said. “They are trying to move it before the door is closed, but there is a lot to move.”

One of the stranger aspects of the heist is that the stolen funds can be traced online, because transactions for Bitcoin and other cryptocurrencies are all public, although the identities of those sending and receiving can be kept anonymous. BIG used a combination of public ledger information available to anyone and proprietary knowhow to trace the coins. Coincheck has identified and published 11 addresses where all 523 million of the stolen coins ended up. More than 24 million coins from the heist have ended up in Japanese NEM exchange Zaif, Akahata, the newspaper published by the Japan Communist Party, reported on Friday.

NEM developers created a tracking tool that would let exchanges to automatically reject stolen funds. The 11 addresses have been labeled with a tag that reads “coincheck_stolen_funds_do_not_accept_trades : owner_of_this_account_is_hacker.”

It’s unclear whether Coincheck identified the cyber thieves. Coincheck didn’t immediately respond to a request seeking comment on the movement of the stolen NEM coins.

At least four of the addresses associated with the heist have shown activity in the past two days, transferring out more than 31 million NEM coins. Several of the transactions carried a cryptic message in awkward Japanese that read: “This purchase is to determine the bitcoin address of the criminal, insist that the purpose is not for self profit.”

To contact the reporters on this story: Pavel Alpeyev in Tokyo at palpeyev@bloomberg.net, Finbarr Flynn in Tokyo at fflynn3@bloomberg.net.

To contact the editors responsible for this story: Robert Fenner at rfenner@bloomberg.net, Reed Stevenson, Peter Elstrom

©2018 Bloomberg L.P.