Zaif Hack
USD loss unconfirmed
Not disclosed
Hot-wallet server compromise
What happened
On September 14, 2018, unauthorized access to Zaif's hot-wallet server enabled withdrawals of BTC, MONA and BCH. Tech Bureau's revised estimate was ¥7.03 billion in total, including ¥4.59 billion of customer assets.
Technical root cause
The compromised server administered exchange hot wallets. Tech Bureau withheld the specific intrusion method during the criminal investigation.
How it happened
- An external party accessed the server administering deposit and withdrawal wallets between approximately 17:00 and 19:00 Japan time.
- BTC, MONA and BCH were transferred out without authorization.
- Tech Bureau detected server abnormalities on September 17 and confirmed the breach the following day.
- It reported the incident to authorities and sought financial and technical support. Its September 21 update revised the loss estimate using September 18 closing prices.
Protocol details
Classification
CeFi / Infrastructure
Protocol Type
Exploit/Access control
Protocol links
Website
@zaifdotjp
Evidence
- report Report coindesk.com
- analysis 仮想通貨の入出金停止に関するご報告、及び弊社対応について prtimes.jp
- analysis DeFiLlama defillama.com
- analysis 仮想通貨流出事件に関する状況報告、及び顧客対応状況について prtimes.jp
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
