The bank has determined that the extent of the theft was enabled by a flaw within the front-end, which allowed the attacker to logg into the flexcoin system. The attacker then exploited a flaw in the code which allowed transfers between flexcoin users. By sending thousands of simultaneous requests, the attacker was able to "move" coins from one user account to another until the sending account was overdrawn, before balances were updated. This was then repeated through multiple accounts, snowballing the amount, until the attacker withdrew the coins.
Bitcoins that Flexcoin kept offline remain secure, according to the bank. Users who put their coins into cold storage will be contacted by Flexcoin and asked to verify their identity. Once identified, cold storage coins will be transferred out free of charge.
The closure of the Flexcoin bank comes just a week after the collapse of Mt. Gox, a major bitcoin exchange.
The failures will likely raise more doubts about bitcoin's ability to establish itself as an alternative currency.
According to Reuters, Japan will this week set out rules on how to handle bitcoins.
Bitcoin, a digital currency that is traded on a peer-to-peer network independent of central control, saw its value soaring in the past year, and the total worth of bitcoins minted is now about $7 billion.