Worked example · 2018-09

Zaif exchange hack — Multi-asset (BTC, BCH, MONA) — 2018-09-14

Loss

approximately 6.7 billion yen (~$60M) in Bitcoin, Bitcoin Cash and MonaCoin from Japanese exchange Zaif (5,966 BTC per Asia Times). Of the total, about 2.2 billion yen belonged to Tech Bureau and 4.5 billion yen to customers (SiliconANGLE-listed reporting). Hot-wallet compromise.

OAK Techniques observed

OAK-T11.001 (Third-Party Signing-Vendor UI / Signing-Flow Compromise — broadly construed; the exchange's hot-wallet signing infrastructure was compromised directly, enabling the multi-asset extraction). OAK-T15.003 (Operator-Endpoint Compromise — reported by an FSA official to Asia Times (secondhand), Tech Bureau told the regulator that "an employee's PC was hacked"; the FSA's earlier orders documented control deficiencies).

Attribution

unattributed (was "confirmed" until 2026-10-11, which contradicted the sentence that follows). Japanese authorities investigated but did not publicly attribute the breach to a specific threat actor or nation-state group.

Corrected 2026-10-11

removed the unsourced "4-day disclosure delay / third order" timeline and the claim that Fisco committed to full user reimbursement and became a Bitpoint/DMM template; the sourced facts are a two-hour theft on 2018-09-14, discovery on 09-17, prior FSA orders in March and June 2018, a post-hack improvement order, and Fisco's majority-stake rescue. The attribution word above is inconsistent with the text (no public attribution) and should be reviewed.

Key teaching point

Zaif is the canonical Japanese-exchange regulatory-failure case: the attacker reached the exchange's hot wallets, the Japan FSA had already issued business-improvement orders to Zaif's operator Tech Bureau in March and June 2018, and the FSA said after the breach that the company had not given adequate details or explained the reporting delay. Fisco later took majority control of Zaif in exchange for financial support (reported).