Cryptopia investors worried by lack of information after major hack

One of the few things that is certain is that $3.5 million-worth of cryptocurrency has gone. Photo / 123RF

Investors caught up in the multi-million dollar Cryptopia digital currency hack are increasingly worried about the lack of information coming out of the company and the police, says a New Zealand expert.

Cryptocurrency and tax specialist Campbell Pentney, from law firm Bell Gully, says in past overseas crypto exchange hacks, information often emerged fairly quickly about the size of the theft, what percentage of the exchange's overall funds were involved, and which cryptocurrencies were stolen.

However, 10 days after a range of currencies were stolen from the Christchurch digital assets exchange, it's still not clear how big the problem is. The police issued an updated statement this week, but without any specifics. The company is referring all enquiries to police.

This lack of information has led to speculation on cryptocurrency news sites that it could be a large hack, or at least one involving a considerable percentage of Cryptopia's funds. This could be bad news for investors, particularly if it causes the company to collapse.

"It's still in limbo," Pentney says. "The Police say they are following leads, but investors are getting pretty upset with the lack of information."

One issue impacting some investors is not being able to get the transaction records they need for their tax returns as Cryptopia's systems are locked.

"These cryptocurrency trades are not on the blockchain; it's Cryptopia's internal systems that are doing the transactions. People can't get their records, so they can't sort their tax."

In addition, some people are worried about whether passport records that might have been given to Cryptopia might now be available to the hackers.

One of the few things that is certain is that $3.5 million-worth of cryptocurrency has gone. A transfer involving that sum is visible, although no one yet knows who owns the digital wallet that lot of stolen Cryptopia funds turned up in.

However, commentators suspect considerably more funds in at least two digital wallets also came from Cryptopia. Some say total stolen tokens could work out at more than $20 million, and possibly up to $40m.

"We are hoping at some point to get more news," Pentney says. "We expect the next breaking development will be a statement of the amount involved."

So far there's no visible sign that any Bitcoin has been stolen from Cryptopia, although there are rumours on social media that the world's most popular cryptocurrency might be involved. However, commentators suggest US$3.5m ($5.1m) of Ether has gone. Ether, which is associated with the popular Ethereum blockchain, is the second most popular cryptocurrency internationally.

It's also unclear how many New Zealand investors have been affected. Cryptopia said in October last year that it had more than two million users worldwide, double the figure at the end of 2017. Staff numbers at the company had increased to 90 - 80 in New Zealand and 10 at a support centre in the UK.

Pentney said Cryptopia would have had a relatively higher percentage of New Zealand-based customers in 2017, when it ran the NZ dollar token, the first cryptocurrency coin tethered to the NZ dollar. The NZDT gave New Zealanders the opportunity to use money in their NZ bank accounts to buy and sell digital currencies like Bitcoin.

However, the NZDT was pulled in late 2017 after Cryptopia's bank got cold feet. This means that there was no particular advantage for New Zealand investors trading on Cryptopia, and a bigger percentage of investors are likely to have been from overseas.

While Cryptopia is small in global terms, it deals in some of the smaller cryptocurrencies, Pentney says. So freezing trade at Cryptopia could have a disproportionate impact on some of these tokens.

Pentney says history is mixed in terms of whether investors have got their money back after other big international cryptocurrency hacks. Because cryptocurrency values are so volatile, the longer the process goes on, the more difficult it is to work out what investors are owed.

If the value of a stolen cryptocurrency asset went down significantly after a hack, people would be looking for the original investment back. But if it went up a lot, they could argue they should get back the amount their asset would be worth at a higher valuation.

"The best resolution is the thief is caught, he or she hands over private keys and then police have access to the assets," Pentney says. "But it's not looking particularly great in terms of getting them back, particularly if the thief is offshore."

Meanwhile, some of the stolen Cryptopia tokens sent by the hacker from the visible wallet to the giant international cryptocurrency exchange Binance have been frozen by that exchange.

And Mothership, another exchange whose cryptocurrency was involved in the Cryptopia hack, is looking at offering newly-released digital tokens to investors, and cancelling the old ones, as a way of giving people their funds back.