Some of the funds stolen from Coincheck Inc. in the $500 million heist have been traced to a cryptocurrency exchange in Canada, according researcher BIG Blockchain Intelligence Group Inc.
Some of the stolen NEM coins are being transferred to a Vancouver-based exchange, where they are being converted to other cryptocurrencies for a possible return trip to Japan, according to Shone Anstey, president and co-founder of BIG.
Anstey declined to name the exchange, give the amount traced or its destination in Japan but said the findings will be turned over to law enforcement.
“We felt it was a significant amount that warranted looking into,” Anstey said. “They are trying to move it before the door is closed, but there is a lot to move.”
One of the stranger aspects of the heist is that the stolen virtual funds can be traced online, because transactions for bitcoin and other cryptocurrencies are all public, although the identities of those sending and receiving it can be kept anonymous. BIG used a combination of public ledger information available to anyone and proprietary know-how to trace the coins. Coincheck has identified and published 11 addresses where all 523 million of the stolen coins ended up.
More than 24 million coins from the heist have ended up in Zaif, a Japanese NEM exchange, according to a Friday report in Akahata, the newspaper published by the Japan Communist Party.
The developers of NEM have made a tracking tool that would allow exchanges to automatically reject the stolen funds. The 11 addresses have been labeled with a tag that reads “coincheck_stolen_funds_do_not_accept_trades : owner_of_this_account_is_hacker.”
It’s unclear whether Coincheck has identified the cyberthieves. Coincheck didn’t immediately respond to a request seeking comment on the movement of the stolen NEM coins.
At least four of the addresses associated with the heist have shown activity in the past two days, transferring out more than 31 million NEM coins. Several of the transactions carried a cryptic message in awkward Japanese that read: “This purchase is to determine the bitcoin address of the criminal, insist that the purpose is not for self profit.”