Introduction: A Licensed Exchange That Is Still Alive but Barely Trading
In our previous 58 editions, we examined a wide range of exchanges, from HashKey to YUBIT. For Edition #59, we turn our attention to one of the quietest players in the industry: Zaif.
In terms of regulatory credentials, Zaif is practically a “living fossil” in Japan‘s crypto market. Founded in 2014 by Tech Bureau, Zaif obtained registration as a cryptocurrency exchange operator from the Director-General of the Kinki Local Finance Bureau under Registration No. 00001 on September 29, 2017. The prestigious-looking “No. 00001” designation means it was among the earliest exchanges licensed under Japan’s regulatory framework.
In 2018, after approximately ¥6.7 billion was stolen in a hacking incident, listed company Fisco injected ¥5 billion and took over the business, ultimately ensuring full compensation for affected users. The operating company was renamed CAICA Exchange Co., Ltd. in November 2021, but officially reverted to its former name, Zaif Co., Ltd., on November 1, 2023. In July 2025, NCXX Group Co., Ltd., a company listed on the Tokyo Stock Exchange Standard Market (renamed JN Group in March 2026), made Zaif a wholly owned subsidiary through an acquisition valued at ¥1.162 billion.
Its official website remains operational, its app continues to receive updates, and it supports approximately 24–26 crypto assets.
However, CoinGecko reports 24-hour trading volume of approximately $169,000, with a Trust Score of just 5/10. CoinMarketCap reports approximately $118,000 in 24-hour spot trading volume. In December 2025, Zaif announced that it would delist MV, ROND, and DEP in February 2026 due to “extremely low liquidity.” In November 2026, its email service provider, Arara, suffered a security breach that exposed approximately 380,536 customer email addresses.
Zaif is unlikely to deliberately disappear with customers' funds. It operates under Japanese law and is backed by a publicly listed company. However, it is increasingly being pushed to the margins of the market. The real risk users face is not necessarily that the owner will vanish overnight, but that the platform will continue shrinking and become increasingly difficult to use.
1. Regulatory Compliance: A Japanese License with Considerable Weight
Zaif's regulatory status in Japan is verifiable through official records. After checking the FSA registry on November 7, 2026, Vasptracker confirmed that Zaif Co., Ltd. holds Registration No. 00001 issued by the Director-General of the Kinki Local Finance Bureau, with a registration date of September 29, 2017, and support for 24 crypto assets.
The number “00001” carries particular historical significance. It means Zaif was among the earliest exchanges to complete registration after Japan revised its Payment Services Act in April 2017 and introduced mandatory registration requirements for cryptocurrency exchanges. Zaif was one of the first 16 exchanges to receive formal FSA authorization following the 2017 regulatory reforms.
Zaif is subject to Japan's Payment Services Act. The FSA and its regional finance bureaus have the authority to conduct on-site inspections and issue business improvement orders. Zaif is also a member of the Japan Virtual and Crypto Assets Exchange Association (JVCEA), which requires members to follow industry rules covering customer asset segregation, anti-money laundering, and risk disclosures.
Its parent company is listed on the Tokyo Stock Exchange. Its financial results are therefore subject to consolidated reporting requirements, while material subsidiary-related issues may need to be reflected in quarterly reports or corporate disclosures.
Users in Japan also have formal complaint and dispute-resolution channels, including the relevant Local Finance Bureau, JVCEA, and consumer dispute mediation organizations.
However, this is a domestic Japanese license, not a universal regulatory passport. It primarily protects users within Japan. Zaif focuses on the domestic JPY market and does not specifically target retail customers in mainland China, the United States, or the European Union. Non-Japanese residents should not assume they are protected by Japanese law simply because they use the platform.
Crypto assets themselves are still not covered by government deposit insurance. As in the United States, customer-held crypto assets in Japan are not protected by the Deposit Insurance Corporation of Japan. Zaif's official risk disclosure states:
“If our company becomes bankrupt, there is a possibility that we may be unable to return deposited funds and crypto assets.”
One more important clarification: Registration No. 00001 means Zaif was first in the Kinki Local Finance Bureau's registration sequence. It does not mean Zaif is Japan's largest exchange. Major Japanese platforms such as bitFlyer, Coincheck, SBI VC Trade, and GMO Coin are registered under the Kanto Local Finance Bureau.
Risk Rating: Medium
2. Account Security and Withdrawals: The ¥6.7 Billion Hack in 2018 and the 380,000 Email Exposure in 2026
September 2018: ¥6.7 Billion Stolen, Including Approximately ¥4.5 Billion in Customer Assets
The most serious security incident in Zaif's history occurred on September 14, 2018.
Hackers gained unauthorized access to the platform's hot wallets and stole approximately ¥6.7 billion in BTC, BCH, and MONA. This was the initial reported figure, subsequently revised to approximately ¥7 billion, equivalent to around $59.7 million at the time.
Tech Bureau detected server abnormalities on September 17 and confirmed the cyberattack on September 18, subsequently reporting the incident to the FSA. Approximately ¥4.5 billion of the stolen assets belonged to customers.
The FSA responded swiftly. Having already issued two business improvement orders in March and June 2018, the regulator issued a third order following the September incident, partly because Tech Bureau had delayed disclosing information about the attack.
Tech Bureau's own financial reserves amounted to approximately ¥2.2 billion, insufficient to cover the losses.
In October 2018, Tech Bureau signed a formal business transfer agreement with publicly listed Fisco. Fisco provided ¥5 billion (approximately $44.5 million) in financial support and acquired a majority stake in the business.
The full business transfer was completed on November 22, 2018, with Fisco assuming responsibility for compensating affected customers. Zaif fully resumed trading services under Fisco's ownership on April 23, 2019, and users received compensation in installments by mid-April 2019.
From suffering a major hack that it could not independently absorb to ultimately compensating all affected users, Zaif handled this crisis better than many exchanges that simply disappear after being hacked.
However, the fact that it required a ¥5 billion capital injection from Fisco to complete customer compensation also demonstrates that Zaif's financial resources at the time were insufficient to independently withstand a major security incident.
November 2026: Email Service Provider Breached, Exposing 380,536 Email Addresses
In November 2026, the servers of Zaif's email service provider, Arara Co., Ltd., were subjected to unauthorized external access.
In its second incident update, published on November 4, Zaif confirmed that approximately 380,536 customer email addresses (after deduplication) had been exposed externally.
According to Zaif's announcement, the leaked information was limited to email addresses. Names, residential addresses, telephone numbers, transaction records, and passwords were not stored in the affected service and therefore were not exposed.
The leaked email addresses did not include passwords or other authentication credentials. An email address alone is insufficient to log in to a user's account.
Zaif has suspended all outgoing email services and warned users to remain alert for phishing emails impersonating Zaif or Arara. Users were advised not to click suspicious links or disclose authentication information.
This was not a breach of Zaif's own systems, but a security incident involving a third-party service provider.
Nevertheless, for an exchange that has already experienced a major hacking incident in 2018, another supply-chain security failure is a warning sign that deserves serious attention.
3. Proof of Reserves Transparency: No Public Merkle Tree PoR, but Asset Segregation Under Japan's Regulatory Framework
An Alternative Form of Transparency Under Japanese Regulation
Zaif does not operate a publicly available Merkle tree Proof of Reserves (PoR) program.
Instead, its transparency framework relies on customer asset segregation under Japan's FSA regulatory regime, cold-wallet storage requirements, and periodic financial reporting.
Under Japan's Payment Services Act and FSA requirements, crypto exchanges must manage customer assets separately from their own corporate assets and keep a prescribed proportion of customer assets (generally at least 95%) in cold wallets.
Zaif's publicly available information refers to several security and asset management mechanisms, including:
Segregated hot and cold wallet storage.
Multi-signature authorization for large asset transfers.
Separation of customer assets from operational funds.
Regular external audits.
Third-Party Indicators of “$0” in Risk Reserves and Asset Strength
Several third-party data platforms, including cicet.com and coin980.com, list Zaif's “risk reserves” and “asset strength” as $0.
These indicators should be interpreted cautiously. They may reflect assets that can be publicly attributed to identifiable on-chain wallet addresses, rather than Zaif's entire reserve holdings. Some of its assets may be held in wallet addresses not covered by these platforms' tracking labels or in the form of Japanese yen deposits at banks.
Nevertheless, a “$0” designation suggests that Zaif has not provided third-party data platforms with sufficient visibility into its identifiable on-chain assets.
For a licensed exchange, asset segregation under a regulatory framework is essential. However, regulatory compliance and publicly verifiable transparency are two different things.
An exchange may satisfy its regulatory custody obligations without offering the same level of independently verifiable reserve transparency that a public Merkle tree PoR system can provide.
4. Financial Strength and Liquidity: An Exchange with Trading Volume So Thin It Is Almost Invisible
Zaif reports daily trading volume of approximately $118,000 on CoinMarketCap, putting its trading activity at roughly one ten-thousandth of that of leading exchanges.
It has just 21 trading pairs, most of which are JPY-denominated. This suggests that Zaif primarily serves Japanese retail investors trading spot markets, with little meaningful participation from institutional traders or arbitrage firms.
Parent Company Financial Performance: Operating at a Loss
At the consolidated level, its parent company is losing money.
For the fiscal year ending November 2025, JN Group (6634) reported an ordinary loss of ¥250 million, representing an 8.7% year-on-year deterioration.
The group's core businesses are electrical equipment and embedded finance. Zaif is merely one of its consolidated subsidiaries, meaning its crypto business contributes relatively little to the group's overall operations.
Zaif itself has paid-in capital of just ¥52 million (approximately RMB 25 million), indicating a relatively limited capital buffer.
Four Ownership Changes in Five Years: A Double-Edged Sword
Over the past five years, Zaif has changed hands four times, with its operating entity evolving from Tech Bureau Corp. to Zaif Co., Ltd.
Frequent ownership changes are a double-edged sword.
On the positive side, each ownership transition brought new capital and opportunities to rebuild risk management systems. Since the 2018 incident, Zaif has not suffered another major disaster on a comparable scale.
However, an exchange that repeatedly needs to sell its business or transfer its operating entity to survive raises questions about its underlying business capabilities.
Within JN Group, Zaif is essentially a peripheral business that could be considered non-core. If the parent company decides to scale back its operations, Zaif could be among the easiest subsidiaries to sell again or even shut down.
5. Internal Operations and Management: From Tech Bureau to JN Group — Strategic Discontinuity After Multiple Ownership Changes
A History of Changes in Operating Entities
Zaif has undergone several major changes in ownership and operational management:
2014–2018: Tech Bureau. Founded and operated Zaif under founder Takao Asayama.
2018–2021: Fisco. Injected ¥5 billion, took over the business, assumed responsibility for customer compensation, and restored full trading operations.
2021–2025: CAICA Exchange. Operated Zaif as a subsidiary of CAICA DIGITAL, a company listed on the Tokyo Stock Exchange Standard Market.
July 2025–present: JN Group. Acquired all 61,169 Zaif shares for ¥1.162 billion, making the exchange a wholly owned subsidiary.
JN Group's core businesses include formulating and managing group-wide business strategies, as well as planning, developing, and selling agricultural ICT solutions. Its cryptocurrency exchange business is just one component of a diversified business portfolio.
In its acquisition announcement, JN Group stated that directly holding Zaif's shares would enable it to “establish a higher-level governance structure and a more agile decision-making process.”
The Cost of Repeated Ownership Changes
Multiple ownership transitions mean that Zaif's strategic direction, technology investment, and product priorities have been repeatedly reset in less than a decade.
It has evolved from an early-stage exchange founded by technology entrepreneurs, into a distressed asset acquired by a listed company to rescue it from a crisis, and finally into a subsidiary held by another listed company as part of its diversified business portfolio.
Zaif's identity has effectively changed from an “innovator” into a “managed asset.”
One particularly blunt summary from a Japanese local user review captures this transformation:
“In the past, it was an advanced exchange that challenged itself with new things. But after the hacking incident and the change of management, it became a company with no technological capabilities. Nothing new is being introduced anymore. It has simply become an exchange with high fees and poor usability.”
6. Genuine Community Feedback: A 3.1/5 Local Rating and Scams Impersonating Zaif
Japanese User Reviews: Average Overall, but Declining Recommendation Ratings
A paid survey published by crypto-torisetu.com in March 2026 gave Zaif an overall rating of 3.1/5.
Positive user feedback repeatedly highlights relatively low trading fees (including zero or negative maker fees), access to distinctive tokens such as Fisco Coin and CAICA Coin, and its automated trading feature, “Otegara Trade” (おてがるトレード).
Negative feedback mainly concerns:
Complicated login procedures.
An outdated user interface.
High withdrawal fees: ¥385 for withdrawals below ¥30,000 and ¥770 for withdrawals of ¥30,000 or more.
A limited selection of major cryptocurrencies.
One particularly noteworthy review stated: “I no longer recommend it at all.”
A user in their 40s who had used the platform for more than seven years wrote:
“In the past, it was an advanced exchange. After the hacking incident and the change of management, it became a company with no technological capabilities.”
Zaif Impersonation Scams: User Complaints Point to Fake Platforms
A user complaint published on the Spanish-language version of JustAnswer described having €9,605 frozen in a Zaif account. The platform allegedly demanded an additional €5,900 deposit before allowing a withdrawal.
However, one crucial detail changes the interpretation of this case: the user downloaded the purported “Zaif App” through a link provided by “a company working with Instagram” on Telegram, rather than through an official app store.
Zaif issued phishing warnings on both July 31, 2025, and July 7, 2025, explicitly identifying fake websites impersonating its official platform.
The exchange has clearly stated that its only official domain is zaif.jp, and its official login page is:
https://zaif.jp/login
Zaif also warned users about a sophisticated phishing technique known as real-time phishing.
The process works as follows:
A user enters their login ID and password on a fake login page.
Criminals immediately submit the same credentials to the genuine Zaif login page in real time.
This triggers a 2FA verification code to be sent to the user's mobile phone.
The user enters the verification code on the fake website.
Criminals immediately use that code to complete the login process on the genuine Zaif platform.
The Spanish-speaking user's experience is highly consistent with a scam involving a fake app downloaded through an unofficial channel.
This does not mean Zaif itself was responsible for the fraud. However, its brand is being extensively impersonated, and ordinary users may struggle to distinguish genuine Zaif services from fraudulent copies.
When victims lose money, it is often Zaif's name that takes the blame, regardless of whether the real exchange was involved.
7. Comprehensive Exchange Runaway Risk Assessment
| Category | Risk Level | Assessment |
| Regulatory Compliance | Medium | FSA Registration No. 00001 is genuine and valid, confirmed through multiple checks of the FSA registry. However, Zaif primarily serves Japan's domestic JPY market, and non-Japanese users are not necessarily protected under Japanese law. |
| Account Security / Withdrawals | Medium–High | Approximately ¥6.7 billion was stolen in the 2018 hack, although Fisco subsequently compensated affected users in full. In November 2026, a breach at its third-party email service provider exposed approximately 380,000 email addresses. |
| Proof of Reserves Transparency | Medium | Customer asset segregation and cold-wallet requirements apply under Japan's FSA regulatory framework. However, Zaif does not provide a public Merkle tree PoR system. |
| Financial Strength | High | CoinGecko reports approximately $238,000 in trading volume. Zaif has proactively delisted tokens due to insufficient liquidity, highlighting its position as a small exchange with extremely limited trading activity. |
| Management and Operations | Medium–High | Ownership has changed multiple times, from Tech Bureau to Fisco, CAICA Exchange, and then JN Group. Crypto trading is no longer a core business of its parent company. |
| Product Experience | High | Extremely low liquidity and shallow order-book depth; outdated interface and relatively high withdrawal fees. “No longer recommended” has become a recurring theme in local user reviews. |
| Community Feedback | Medium–High | Local Japanese user ratings stand at 3.1/5, indicating an average experience but a declining trend. Scams impersonating Zaif are widespread, making brand impersonation a genuine risk. |
Overall Risk Rating: Medium–High
(The probability of a conventional exit scam may not be particularly high, but the core risks are functional exchange death and liquidity exhaustion.)
Zaif is not a likely candidate for the kind of sudden disappearance with customer funds associated with exchanges such as UZX or Azbit.
It holds a genuine FSA registration, operates under Japan's customer asset segregation requirements, has a documented history of fully compensating users following its 2018 hack, and is backed by a parent company listed on the Tokyo Stock Exchange Standard Market.
It is unlikely to simply disappear tomorrow.
However, not running away does not mean operating normally.
Zaif's risks are concentrated in three areas:
1. Liquidity Has Effectively Dried Up
Trading volume is now only in the low hundreds of thousands of dollars, placing Zaif near the bottom of Japan's licensed exchange market.
Its decision to delist tokens due to insufficient liquidity is direct evidence of its growing marginalization as a trading venue.
For an exchange where almost nobody trades, usability is approaching zero for customers who simply want to buy and sell assets under normal market conditions.
2. Strategic Drift Following Multiple Ownership Changes
From a technology-driven startup, to an exchange rescued by an investor following a crisis, and finally to a non-core asset within a diversified corporate group, Zaif's strategic priorities have been repeatedly reset with each ownership change.
Its current position as a non-core subsidiary means it is unlikely to receive priority in resource allocation, product development, or technological upgrades.
Zaif's situation can be summarized as follows: It is still alive, but it is no longer a meaningful trading venue.
It has a license, but very poor liquidity. It has a history, but that history is largely defined by a cycle of being hacked, rescued, and transferred to new owners. It has a parent company, but that company's core business is not cryptocurrency.
For users, the most important question is no longer simply “Will Zaif run away with my money？” but rather:
“Why should I continue keeping my assets on an exchange where almost nobody trades？”
8. Recommendations for New and Existing Users
Recommendations for New Users
1. If you need a Japanese exchange where you can trade normally, Zaif may not be the right choice.
With 24-hour trading volume in the hundreds of thousands of dollars, extremely shallow order-book depth, and token delistings driven by liquidity shortages, your orders may encounter significant slippage or fail to execute at your expected prices.
Other licensed Japanese exchanges, such as bitFlyer, Coincheck, and GMO Coin, offer substantially better liquidity and product experiences than Zaif.
2. If you are considering Zaif because of its unique token listings, proceed with caution.
Zaif does offer certain tokens associated with the Japanese market, including Fisco Coin (フィスココイン) and CAICA Coin (カイカコイン).
However, unique listings do not necessarily mean good liquidity.
Before trading any of these assets, check the order-book depth and recent transaction history to determine whether there is sufficient market activity.
3. If you only intend to hold assets rather than trade frequently, the regulatory framework provides a basic level of institutional protection.
Zaif's FSA registration and customer asset segregation requirements offer some regulatory safeguards.
Even so, you must be prepared to accept extremely low liquidity, relatively high withdrawal fees, and an outdated user interface.
Recommendations for Existing Users
1. Evaluate whether your trading needs match the platform's liquidity.
If you have been using Zaif for years and trade infrequently, it remains an exchange registered with the FSA.
However, if you require more active markets, deeper order books, and lower withdrawal costs, migrating to another Japanese licensed exchange with better liquidity may be a more reasonable choice.
2. Monitor JN Group's strategic direction following the acquisition.
If JN Group demonstrates continued investment in its crypto business through future financial reports or announcements, such as new token listings, system upgrades, and liquidity improvements, that would be a positive signal.
Conversely, if Zaif becomes increasingly marginalized within JN Group's business portfolio, its liquidity problems could deteriorate further.
3. Keep complete records of all transactions and communications.
If you encounter withdrawal difficulties or account-related problems, maintaining complete transaction histories, screenshots, and customer service communications will provide essential evidence for subsequent complaints or regulatory appeals to the FSA.
Final Verdict
Who is Zaif suitable for？
Long-term holders who simply want access to an exchange with FSA registration and the ability to hold certain distinctive Japanese-market tokens, without expecting active trading.
It may also suit users with minimal liquidity requirements who can accept the reality that trading activity is almost nonexistent.
Who should avoid Zaif？
Active traders who need to buy and sell assets under normal market conditions.
Users who require deep order books and reliable execution.
Traders who need fast withdrawals and low transaction costs, given the platform's severe liquidity constraints.
Users who expect an exchange to demonstrate strong, ongoing operational activity and product development.
Zaif's current position is best described as “licensed but marginalized.”
Its FSA Registration No. 00001 is genuine, and its history of fully compensating users after the 2018 hack is better than that of many exchanges that eventually disappeared with customer funds.
However, the long-term value of an exchange depends on more than simply whether it holds a license. It also depends on whether people are actually using it, whether users can trade normally, and whether its management is genuinely committed to its future development.
Across all three dimensions, Zaif's situation points in the same direction:
Trading volume of just a few hundred thousand dollars, token delistings caused by liquidity exhaustion, strategic drift following repeated ownership changes, and a parent company whose core business is agricultural ICT.
Zaif may not be among the exchanges with the highest conventional exit-scam risk, but it could be one of the licensed exchanges facing the greatest risk of functional death.
Coming Next: WikiBit Exchange Runaway Risk Ranking #60 — BYDFi. Stay tuned!
Risk Disclaimer: This article represents the author's independent analysis and does not constitute investment advice. Cryptocurrency investments involve significant risks. Please exercise caution before investing.
Information updated as of November 12, 2026. Please cross-check and independently verify the latest information through multiple sources.
WikiBit is a regulatory and risk intelligence platform built specifically for cryptocurrency investors. It provides real-time access to global exchange regulatory licenses, credit ratings, risk alerts, industry news, and genuine user reviews, helping investors identify potential risks, stay away from problematic platforms, and make more informed trading decisions.
Before investing in crypto, check WikiBit first!
Download the WikiBit App now and add an extra layer of protection to your crypto assets:
https://wikibit.onelink.me/wgfF/1b1dn69b
