For those unaware, Monappy is an online wallet service for storing cryptocurrency and the virtual currency MonaCoin (MONA) is Litecoin hard fork. The boy, a minor from Utsunomiya, Tochigi Prefecture, north of Tokyo, is facing computer fraud and concealment of criminal proceeds charges, reports Japan Times. According to the Tokyo Metropolitan Police Department (MPD), this is the first ever case in Japan where a hacker is facing criminal charges for stealing cryptocurrencies. As reported by Japan Times, the teenager allegedly breached a vulnerability of Monappy and stole 93078.7316 MonaCoins from 7735 Monappy users between August 14 and September 1, 2018 last year. For the hack, he used a smartphone and software called Tor for internet anonymity to access the websites. However, the police were able to track him down after analyzing the cryptocurrency transaction details left on the hacked website’s server. The boy who confessed being behind the Monappy attacks was quoted by the police as saying “I felt like I’d found a trick no one knows and did it as if I were playing a video game.” The hacker exploited one of the features of the website that allows users to transfer the currency to another user. Apparently, the wallet was experiencing numerous glitches caused by the site overload. The teenager was fully aware that the system would breakdown if transfers were repeated over a short period of time. As a result, he took advantage of the flaw and submitted repeated currency transfer requests to himself, overwhelming the system and allowing him to register more money in his account. He then put the stolen MonaCoin in an anonymous, dividend-bearing account at a cryptocurrency exchange overseas. By the time of his arrest, he had collected 100,000 Yen in dividends, which he had used to purchase smartphones and other items, the police said. The stolen MonaCoins were kept using a system with an always-on internet connection, and those kept offline were not stolen, said the operator of Monappy. More than 7,000 users were affected due to the hack but the platform has accepted to repay them. The official website of Monappy currently states that they have suspended their services “due to external attacks.”
