Japanese cryptocurrency exchange BTCBOX restored login access and cryptocurrency deposit services on Monday morning, ending a six-month total service suspension that had locked customers out of their accounts since January 29. The reopening came with a mandatory authentication overhaul: every returning user must now register a passkey — a phishing-resistant cryptographic credential tied to their device biometric or PIN — before they can access their account. Passwords, once registered, are permanently disabled.

BTCBOX's operator, BTC Box Co., Ltd., announced the phased resumption schedule on July 31, stating that external security consultants had completed safety reviews on a subset of its systems sufficient to allow a partial restart. Login and cryptocurrency deposit services went live at 10:00 JST (9:00 PM ET on Sunday, August 2), as planned by the company.

What Users Can — and Cannot — Do Right Now

The restart is deliberately incremental, and returning users need to understand exactly where the lines are drawn before moving funds.

As of August 3, BTCBOX users can log in (with mandatory passkey registration) and deposit cryptocurrency onto the platform. What they cannot yet do: withdraw that cryptocurrency, trade on the exchange, or use the "Kantan Baibai" (easy buy/sell) feature. Those capabilities remain offline pending further safety verification, with the company targeting a staged rollout beginning in September. BTCBOX said it will announce specific resumption dates for each remaining service as individual safety reviews are completed.

This constraint matters practically: any cryptocurrency deposited onto BTCBOX now will be inaccessible — not tradable, not withdrawable — until the relevant service is separately cleared and restarted. Users who anticipate needing access to those funds before September should not deposit them onto the platform.

Japanese yen withdrawals are scheduled to resume on August 10 at 10:00 JST (9:00 PM ET on Sunday, August 9). Two-factor authentication (2FA) must be configured before yen withdrawals can proceed.

Why Passkeys Are a Security Event, Not Just a New Login Screen

BTCBOX's decision to mandate passkeys is not simply a new registration step. It is a structural change in how the exchange handles account security — one that eliminates the most common attack pathway against crypto exchange users entirely.

Under the previous system, a BTCBOX user's account was protected by a password: a shared secret stored on both the user's device and BTCBOX's servers. Passwords can be stolen from databases, intercepted over networks, or phished — that is, tricked out of users by fraudulent lookalike sites. SMS-based two-factor authentication, widely deployed as a second layer, is still susceptible to real-time relay attacks where a phishing site transparently relays a victim's 2FA code to the real exchange milliseconds after capture.

Passkeys work differently at the protocol level. When a user registers a passkey on BTCBOX, their device generates an asymmetric cryptographic key pair using the FIDO Alliance passkey standard. The private key is stored in a hardware-backed secure enclave on the user's device — the Apple Secure Enclave, Android Keystore, or a platform TPM chip — and never leaves that device. The public key is stored on BTCBOX's servers. At login, the server sends a cryptographic challenge; the user's device signs it with the private key after verifying the user's biometric or PIN. The signed response is returned. No password is transmitted. No shared secret exists to steal.

Critically, passkeys are origin-bound: a passkey created for btcbox.co.jp cryptographically cannot be used on a fraudulent site like "btcbox-secure-login.com," even if the attacker has replicated BTCBOX's visual interface perfectly. The RP ID (origin domain) is embedded in the cryptographic credential at registration, and the WebAuthn protocol rejects any authentication attempt from a different origin. This means the entire category of credential-phishing attacks — the highest-volume attack vector against retail crypto exchange users — is structurally eliminated by FIDO2, not merely made harder.

Japan's financial regulators formally recognized in 2025 that password-only authentication and SMS one-time passwords were "not sufficient" for high-risk financial actions, and the country's fintech sector has since accelerated passkey adoption across Japan. BTCBOX's six-month shutdown gave the company time to rebuild its authentication architecture before returning users to the platform.

On the first login after the service restoration, users who did not previously have 2FA configured can still authenticate with their existing password once. A passkey registration prompt will appear immediately afterward; once a passkey is registered, password-based login is permanently disabled for that account. Users who already had 2FA enabled follow a slightly different procedure. The full step-by-step guide for each case is available on BTCBOX's passkey setup page.

BTCBOX also warned users to access the platform only via previously bookmarked or saved URLs, and confirmed that the company will never contact customers asking for passwords or authentication codes via email, phone, or social media — a standard precaution to guard against phishing attempts likely to target users returning after a six-month dormancy.

How Customer Assets Were Protected During the Shutdown

BTCBOX's most significant statement to returning users is one it has made consistently throughout the suspension: no customer assets were illicitly drained.

The mechanism that made this possible is cold wallet architecture. An exchange that stores user cryptocurrency in "cold" wallets keeps the private keys — the cryptographic credentials that authorize blockchain transactions — in offline, internet-disconnected storage. The cryptocurrency itself does not sit in the wallet; it exists on the blockchain. What the cold wallet holds is the signing authority for those assets. An attacker who compromised BTCBOX's web servers, databases, or backend infrastructure during the six-month suspension would have found no private keys to steal, because cold wallet keys remain offline and never in internet-connected systems to begin with.

This architectural distinction is why BTCBOX's outcome differed from that of DMM Bitcoin, which lost approximately ¥48.2 billion (approximately $307 million at current exchange rates) in May 2024 when North Korean hackers compromised Ginco, the wallet software provider DMM had contracted for transaction signing. DMM's signing architecture gave a third party online access to the transaction-authorization layer; BTCBOX's cold-wallet approach eliminates that attack surface entirely. BTCBOX confirmed that all cryptocurrency held on behalf of customers has remained in cold storage throughout the suspension, and customer Japanese yen deposits have been held entirely in trust at Nihon Securities Finance Trust Bank (日証金信託銀行), insulating them from any operational disruption.

The practical limitation of cold wallet storage — as BTCBOX's phased restart illustrates — is that each withdrawal requires an offline signing event with human authorization. This operational overhead is precisely why cryptocurrency withdrawals are the last service to return: unlike login (which is a software authentication flow) or yen withdrawals (which route through the trust bank), crypto withdrawals require a manual cold-wallet signing process that cannot simply be switched on.

What Triggered the Shutdown

The suspension began as a consequence of an incident confirmed on January 15, 2026. During the course of sharing materials with an external business partner as part of a proposed collaboration, documents were handled in a way that left them temporarily accessible to third parties. The materials contained personal information — names, phone numbers, and email addresses — belonging to a small number of customers. BTCBOX immediately contacted the partner firm to request deletion of the data and began investigating the full scope of the incident.

The company announced a maintenance window on January 28, 2026, initially planning a 12-hour pause from midnight on January 29. Additional verification requirements discovered during that process forced an indefinite extension. BTC Box suspended all services as of January 29.

On February 5, 2026, Japan's Kanto Finance Bureau issued a formal reporting-demand order under Article 63-15, Paragraph 1 of the Payment Services Act — a legally binding directive requiring the company to provide detailed accounts of the incident and its response measures. The company publicly confirmed receipt of that order and stated it was cooperating fully.

Japan's Crypto Exchanges Under Renewed Pressure

BTCBOX's shutdown and recovery play out against a broader regulatory tightening of Japan's cryptocurrency exchange sector. The country's Financial Services Agency has pressed forward with sweeping reforms following a series of high-profile security incidents, most notably the $307 million DMM Bitcoin theft in 2024. Proposed legislation — submitted to parliament in 2026 — would require registered exchanges to maintain dedicated liability reserves covering exchange-scale losses ranging from ¥2 billion to ¥40 billion (approximately $13 million to $255 million, depending on exchange size and trading volume), creating a compensation mechanism that currently does not exist for cold-wallet-operating exchanges. The Japan reserve mandate framework would close the gap between cold wallet storage requirements and direct user compensation obligations.

Is BTCBOX Safe to Use Now?

That question has two distinct dimensions. From an asset-protection standpoint, the cold wallet architecture confirmed throughout the suspension gives BTCBOX's technical custody practices a strong track record: six months of total operational shutdown produced no losses. From a regulatory standpoint, BTCBOX carries a history of compliance attention — in June 2018, it was one of six exchanges that received a business improvement order from Japan's FSA, requiring improvement in nine operational areas including money-laundering countermeasures, risk management, and user protection measures. The 2026 shutdown came not from a cyberattack but from a procedural data-handling failure with a business partner.

The exchange has been registered with Japan's FSA since 2014, making it one of the country's longest-operating licensed platforms. It is also a member of the Japan Virtual and Crypto Assets Exchange Association (JVCEA), the FSA-recognized self-regulatory body for the sector.

The passkey mandate represents the most substantive security improvement to the platform's user-facing authentication architecture in its history. Whether users choose to return should weigh both the technical asset protection record and the regulatory compliance history.

Where BTCBOX Fits in Japan's Evolving Crypto Landscape

Japan's parliament passed legislation on July 15, 2026 formally reclassifying cryptocurrencies as financial assets under the Financial Instruments and Exchange Act — a fundamental shift that moves Bitcoin, Ethereum, and over 100 other tokens from payment-services law into the same regulatory category as stocks and bonds. The reclassification introduces insider-trading rules and disclosure mandates for token issuers, and strengthened supervisory tools for the FSA. Only assets traded on FSA-licensed domestic exchanges will qualify for the 20% flat capital gains tax rate expected to take effect in 2028.

BTCBOX's FSA license and JVCEA membership position it to continue operating under this framework — assuming it completes its phased restart and sustains its compliance posture. The upcoming liability reserve requirement will impose new capital obligations on the exchange, adding financial strain but also creating an explicit user protection mechanism that did not exist during the 2026 shutdown.

Exchange rates as of August 3, 2026; currency conversions in this article are approximate.

---

Frequently Asked Questions

Can I withdraw my crypto from BTCBOX right now?

No. As of August 3, cryptocurrency withdrawals, exchange trading, and the Kantan Baibai easy buy/sell service remain offline. Cryptocurrency deposits are accepted, but the deposited assets cannot be sold or withdrawn until those services restart — currently expected sometime in September 2026. Users who need access to their funds before then should wait before depositing. Yen withdrawals are scheduled to resume on August 10, 2026.

What is a passkey, and how is it different from a password for my BTCBOX account?

A passkey is a cryptographic credential stored in your device's secure hardware — your phone's biometric chip, your laptop's fingerprint reader, or a dedicated security key. Unlike a password, a passkey is never transmitted over the internet and is not stored on BTCBOX's servers in a form that could be stolen in a data breach. More importantly for crypto exchange users, passkeys are origin-bound: they only work on the exact website they were created for. A fraudulent phishing site that looks identical to BTCBOX's login page cannot capture or reuse your passkey, because the cryptographic verification will fail against the wrong domain. This eliminates the most common account takeover attack used against crypto exchange users.

How does BTCBOX's cold wallet storage protect user cryptocurrency?

Cold wallets keep the private keys that authorize cryptocurrency transactions in offline, air-gapped storage — computers that have never been connected to the internet. When BTCBOX's online systems were suspended for six months, there was nothing in the internet-connected environment that could authorize movement of user cryptocurrency, because the signing keys resided offline. This is structurally different from exchanges like DMM Bitcoin, where an internet-connected third-party vendor had authorization over transaction signing. BTCBOX confirmed that all customer cryptocurrency remained in cold storage throughout the suspension with no unauthorized transfers.

What does Japan's new crypto law mean for BTCBOX users and their taxes?

Japan's July 2026 legislation reclassifies major cryptocurrencies as financial assets under the country's Financial Instruments and Exchange Act, which applies securities-style rules — including insider trading prohibitions — to the sector. A separate tax reform, taking effect as early as 2028, will apply a flat 20% capital gains rate to trading on FSA-licensed exchanges, down from progressive rates that could reach 55%. Because BTCBOX holds an FSA license, trades executed there are expected to qualify for the favorable tax rate once it takes effect — but only for assets that fall within the designated "specified crypto assets" category. Consult a Japanese tax professional for guidance specific to your situation.