An 18-year-old boy was referred to prosecutors Thursday for allegedly stealing about ¥15 million ($134,300) worth of cryptocurrency last year by hacking a digital currency storage website, police said.
The case is the first in Japan in which criminal charges have been pursued against a hacker over cryptocurrency losses, the police said.
The boy, from the city of Utsunomiya, Tochigi Prefecture, whose name is being withheld because he is a minor, allegedly stole the money after hacking Monappy, a website where users can keep the virtual currency monacoin, between Aug. 14 and Sept. 1 last year.
He used software called Tor that makes it difficult to identify who is accessing the system, but the police identified him by analyzing communication records left on the website’s server.
The police said the boy has admitted to the allegations, quoting him as saying, “I felt like I’d found a trick no one knows and did it as if I were playing a video game.”
He took advantage of a weakness in a feature of the website that enables a user to transfer the currency to another user, knowing that the system would malfunction if transfers were repeated over a short period of time.
He repeatedly submitted currency transfer requests to himself, overwhelming the system and allowing him to register more money in his account.
About 7,700 users were affected and the operator will compensate them.
The boy later put the stolen monacoins in an account set up by a different cryptocurrency operator, received payouts in a different cryptocurrency and bought items such as a smartphone, the police said.
According to the operator of Monappy, the stolen monacoins were kept using a system with an always-on internet connection, and those kept offline were not stolen.
Japan has seen large digital currency heists in recent years amid a boom in people purchasing various currencies.
In 2014, ¥48 billion worth of bitcoin was stolen from the now-defunct cryptocurrency exchange Mt. Gox. Then in January last year, about ¥58 billion worth of the digital currency NEM was taken from customers’ accounts at the Tokyo-based exchange Coincheck Inc.
In June, the Financial Services Agency, which regulates cryptocurrencies, ordered six virtual currency exchange operators to improve internal controls.