Bitpoint Hack Shows That Regulators' Scrutiny Does Not Equal Safety

On July 12, 2019, Tokyo-headquartered cryptocurrency exchange Bitpoint promptly suspended its services after noticing an error in the outgoing funds transfer system.

The security breach seems to continue the streak of hacks targeting Japan-based exchanges.

Later, on July 14, local English-language publication The Mainichi reported that Bitpoint has discovered over 250 million yen in cryptocurrency on overseas exchanges that were using a trading system provided by Bitpoint Japan.

The exchange's spokesperson reportedly told The Mainichi that the recent discovery brings the total sum of lost founds down from 3.5 billion yen to 3.02 billion yen.

Since the amendment of Japan's Payment Services Act in April 2017, all crypto exchanges in the country are required to register with the FSA. Notably, Bitpoint was one of the approximately 16 local exchanges that has been licensed by the regulator as a result of its rigorous inspections of industry players, which include on-site inspections.

According to Nikkei Asian Review, Bitpoint received an operational improvement order from the FSA last year, as the regulators concluded that "Its internal controls were flawed," but it was lifted at the end of last month - just two weeks before the hack occurred.

"I don't think it's a reasonable assumption that being regulated by the FSA closely ensures safety of exchanges. After two major hack incidents that took place in Japan, the FSA tightened the enforcement significantly to prevent any more hacks, but they are by no means security experts. Also, as far as I understand, their main focus seemed to be more on KYC/AML. In some situations, I have heard before that their scrutiny is the reason to put pressure on exchanges financially and lose its focus on security."

"Japan's cryptocurrency exchanges are suffering from their own success as volumes are strong and attract the unwanted attention of cyber attacks. The FSA is actively reviewing the exchange's operations, issuing improvement orders and so forth but there will always be human error, particularly in an industry that has grown so much, so quickly."

"I'm sure there will be additional regulatory scrutiny which could lead to tighter requirements for getting licensed. The FSA has shown itself to be both fairly pro-active and fairly fluent in cryptocurrency, so it might just mean an acceleration of already in-flight measures. Computer security is hard, and just as traditional banks will continue to battle hackers, so will crypto exchanges."

As for now, it seems safe to assume that the level of the FSA's scrutiny does not necessarily correlate with the safety of the exchanges it oversees.