What happened
Bitpoint Japan detected unauthorized cryptocurrency withdrawals on 11 July 2019 and disclosed the incident the next day. Its 16 July assessment put the domestic loss at ¥3.028 billion across BTC, BCH, ETH, LTC and XRP. About ¥250 million reported at overseas exchanges using its technology was a separate exposure, not part of that domestic total.
Technical root cause
Unauthorized withdrawals affected exchange-held cryptocurrency. The reviewed initial investigation report does not establish the intrusion method; a specific server exploit or key-theft mechanism cannot be stated as confirmed.
How it happened
- An XRP transfer error appeared at 21:11 JST on 11 July. Bitpoint confirmed unauthorized outflows at 22:39.
- On 12 July, it suspended transfers at 06:30 and stopped all services at 10:30 before announcing the incident.
- The investigation covered server access, wallet implementation and transaction tracing. The initial report did not establish the attacker's entry route.
- By 14 July, Bitpoint said it had procured replacement cryptocurrency matching the quantities lost by customers. Replacement assets should not be confused with funds recovered from the attacker.
Protocol details
Classification
Exchange custody
Protocol Type
Centralized exchange
Protocol links
Website
@BITPointJP
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
