Coincheck

Is Coincheck safe?

Today, yes, by the standards of the industry. Coincheck runs under Japan's strict exchange law, which forces nearly all customer coins into cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, and its parent publishes audited accounts as a Nasdaq-listed company. The catch is history: in January 2018 Coincheck lost ¥46.6 billion of customer NEM, one of the largest thefts any exchange has suffered.

We score Coincheck 77/100, level with Gemini and a little behind Coinbase. It sits close to its Japanese rival bitFlyer, which has never lost customer funds to a hack but publishes less.

The 2018 NEM hack

On 26 January 2018 an attacker who had planted malware on an employee's computer drained 526.3 million NEM tokens from a Coincheck hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary. They were customer coins, and Coincheck had kept them online. Japan's Financial Services Agency ordered an improvement plan days later and, after an on-site inspection, a second order on 8 March 2018, citing "serious issues pertaining to its business management structure and internal control system".

Coincheck repaid the roughly 260,000 affected customers in yen rather than in NEM. Some sued over the way the payout was calculated; its latest annual report says all of those cases have been resolved. Some of the stolen tokens were later seized by Japanese prosecutors and returned, giving Coincheck ¥239 million of other income in the year to March 2026.

Under our rubric a hack with full reimbursement sits between 60 and 79. We place Coincheck at 68: the loss was huge and avoidable, but customers were paid, and eight years have passed without another loss of customer funds. Its 2026 report mentions two minor 2025 incidents, a phishing attack on its X account and a virus on a computer at its staking subsidiary, neither with material consequences.

What changed after Monex bought it

Monex Group, a Tokyo-listed broker, bought Coincheck in April 2018. Coincheck received its FSA registration on 11 January 2019 and is now one of 27 registered exchanges in Japan. The rules it works under are among the tightest anywhere:

• At least 95% of customer crypto, by yen value, must be in cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary.
• Whatever sits in hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary must be matched by the exchange's own coins held in cold storage, so a hot-wallet hack can be covered.
• Customer coins and cash must be segregated from the company's own. Coincheck holds customer yen in trust at JSF Trust and Banking.

Coincheck says its policy is to keep no more than 5% of customer coins in hot wallets. At 31 March 2026 it held ¥728 billion of customer assets for 2.5 million verified users.

Audited accounts in the US

Coincheck Group N.V., a Dutch holding company, has been listed on Nasdaq since 11 December 2024 after merging with a SPAC. It files an annual 20-F with the SEC. KPMG audited the accounts and flagged the existence of coins in cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary as a critical audit matter, then tested it by comparing records with public blockchains and watching coins move with Coincheck's private keys. That is stronger evidence than most proof-of-reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary reports.

One caveat: a 2023 restatement of how it booked trading revenue left a material weakness in its financial controls, which management says was fixed by September 2025.

Where the protection is thinner

Coincheck Lending lets customers lend their coins to Coincheck for a fee. Lent coins leave the segregated pool and become a loan to the company, so the cold-storage and segregation rules no longer protect them. The same goes for any coins you stake. Coins are not covered by deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary.

How to use Coincheck safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app and register withdrawal addresses in advance.
2. Treat messages that appear to come from Coincheck's social media accounts with care; its X account was taken over by phishers in 2025.
3. Think twice before using Coincheck Lending for large sums, because lent coins are a loan to the company rather than segregated customer property.

How we scored it

Reserves (90) is Coincheck's strongest factor, thanks to KPMG-audited public accounts. Security history (68) is the weakest because of the 2018 theft. Custody (85) reflects Japan's 95% cold-storage rule, and licensing (75) one strict regulator in one country.