TOKYO -- So-called "white hat" hackers are adding their expertise to the ongoing search for 58 billion yen ($538 million) worth of NEM cryptocurrency stolen in the recent hack of Tokyo-headquartered virtual currency exchange Coincheck. Their contributions are inspiring more computer experts to join them.
Although it is not known who was involved in the theft, white hat hackers have played a key role in keeping track of the stolen currency. One prominent one goes by the handle JK17 on Twitter.
JK17 identified the accounts to which the money was moved shortly after the theft occurred in the early hours of Jan. 26 and then began marking these accounts as part of a tracking effort. The mission was later handed over to the NEM Foundation, the international group that manages and promotes the currency.
Encouraged by activities of the white hats, many engineers are joining the tracking effort.
Shota Hamabe, a 34-year-old programmer for an information technology company, is among the ethical hackers who use hacking techniques to thwart cyberattacks and for other good purposes.
Earlier this month, Hamabe held an information session at Hackers Bar, a restaurant in Tokyo's Roppongi district where staff members and customers who are well-informed about IT get together. Since immediately after the theft occurred last month, Hamabe has tracked the movements of the stolen NEM and updated the restaurant's customers on the situation.
"The incident has created a negative image of virtual currencies, but I believe they can make a huge difference in the way we transmit data and handle business," Hamabe said.
Meanwhile, websites have emerged that explain how to create programs to automatically track the movements of the stolen NEM. In addition, simple explanations of how the money has been distributed, with illustrations, have been published on Twitter.
According to one information security expert, no one knows how many white hat hackers are monitoring the virtual currency's movements and disseminating the information, but they are at least in the dozens.
However, the individuals who were involved in the theft have so far sent NEM to more than 400 accounts, including some owned by holders who were unrelated to the incident, apparently in a bid to complicate the tracking effort.
Nearly 9 billion yen worth of NEM is believed to have been exchanged for Bitcoin and other virtual currencies through the "dark web," or websites that offer a high level of anonymity.
NEM has a unique feature designed to make its transactions transparent. A sender of NEM can attach markers, called mosaics, to the receiver's account. This feature, which bitcoin does not have, is now being used to track the money stolen from Coincheck.
White-hat hackers send small amounts of NEM to mark accounts to which stolen funds have been shifted. This makes it possible to track whenever NEM is transferred from the marked accounts to a third account.
The problem is that tracking down NEM using markers can only tell you in which accounts the NEM from the marked accounts currently sits. It cannot tell you who owns the third accounts.
The Tokyo Metropolitan Police Department is analyzing access logs in Coincheck's system to track the thieves who stole the funds. But the process may take a long time.
