Who stole the crypto from the crypto jar?
Imagine a heist where you can see the bank vault the robbers have put the gold bars in, but you just can’t get at them.
Or an unbreakable, unopenable, cookie jar on the shelf in front of you.
This appears to be the situation with at least some of the millions of dollars of funds stolen from Christchurch digital assets exchange Cryptopia.
Cryptocurrency and tax specialist Campbell Pentney from law firm Bell Gully, says he and others around the world have been watching activity in a digital wallet believed to contain a proportion ($3.5 million-worth) of the cryptocurrencies stolen from customers of the New Zealand exchange on Monday night.
Unlike physical money that’s been stolen, some cryptocurrency movements are visible because the transaction chains for some of the types of affected currencies are public.
But seeing the funds doesn’t mean being able to get at them, as NZ Police investigating the theft will doubtless be finding out.
Pentney says: “You can’t generally link a wallet to a name. But you can see where some of it is going.”
Some of the stolen funds have turned up at the world’s largest cryptocurrency exchange, Binance.
CEO Changpeng Zhao confirmed on Twitter yesterday those funds had been frozen.
“I don’t understand why the hackers keep sending to Binance,” Zhao, known as CZ, said. “Social media will be pretty fast to report it and we will freeze it. It’s a high-risk maneuver for them.”
Social media also reveals stories of people desperately asking for their money back, and others allegedly trying to help them.
One cryptocurrency-related site shows “Pink Wojak” offering to help people who have lost money in the “Cryptopia hack”.
“Please tell me how much you lost and why you need it back,” Pink Wojak says. “I will only help those that absolutely need it, so please keep begging to a minimum.”
The post elicited dozens of replies from people claiming they had lost, among others, money destined for:
- their father’s liver treatment
- their mother’s cancer treatment
- paying off US$200,000 of student loans
- future vets bills for two dogs and a cat, because “no one else in my family has money to support us”
- escaping “Magnitogorsk, a low-wage Russian city” for a better life.
Placed through these heart-wrenching posts are several warnings about scammers trying to take advantage of people who have lost money in the Cryptopia theft.
Several of the respondents included their keys in their replies.
Global and local implications
Bell Gully’s Campbell Pentney says Cryptopia wasn’t large enough for the hack to have a substantial effect on the broader market for cryptocurrency, but the exchange provided support for a number of niche cryptocurrencies, which could struggle to trade, particularly if Cryptopia held a large portion of those assets.
Other implications of the hack would depend on whether the funds were permanently lost or whether Cryptopia bounced back and was in a position to refund customers, Pentney says.
However, even reimbursement could be tricky, as cryptocurrency prices may have fluctuated since the time of the hack.
“In some ways this is a more complicated situation than previous high-profile exchange hacks, as there are indications dozens of different cryptocurrencies may be involved. This makes the tracking and reimbursement process more difficult.”
New Zealanders who lost money permanently through the theft might be able to apply for tax relief, Pentney says.
Meanwhile, the Cryptopia hack could jeopardise plans the company had to relaunch a New Zealand dollar-backed ‘tether’ currency this year. The Christchurch company said in November it had backing from an unnamed bank to bring back the New Zealand Dollar Token, or NZDT, the country's first cryptocurrency tethered to the NZ dollar.
The NZDT was launched under the radar in May 2017, after several speakers at the annual blockchain conference raised problems they were having without one.
However, it was pulled last year after Cryptopia’s bank, ASB, raised concerns about regulatory issues and difficulties identifying customers and their activities.
Pentney said the hack could raise “reputational or liability concerns” for a potential banking partner.
NZ Police said on Wednesday the Cryptopia theft is “a complex situation” and they couldn’t say how long the investigation will take.
“We are aware of speculation in the online community about what might have occurred. It is too early for us to draw any conclusions and Police will keep an open mind on all possibilities while we gather the information we need.
“A priority for police is to identify and, if possible, recover missing funds for Cryptopia customers. However there are likely to be many challenges to achieving this.
Cryptopia employs about 100 staff in New Zealand and the UK. Management hasn’t commented on the theft.
Adam Lyness, business development director at Cryptopia shareholder Intranel, spoke on behalf of Cryptopia at the Blockworks blockchain conference in Auckland last November.
He says the news isn’t great for shareholders, who have been told that all comment should come through official NZ Police channels.
However he says Intranel isn’t dependent on Cryptopia for its business and has been a “silent shareholder” since November.