Epic crypto-currency hack ruins Sydney man's retirement plans

The account had $104,000 in bitcoin in it before the hacker took it all. Photo / 123RF

A Sydney couple will have to retire seven years later than planned after they lost more than $100,000 in a shocking scam.

Manu Kundra and his wife Shallu, 49, were devastated when they logged onto their cryptocurrency exchange in May last year to check how it was going.

Instead of seeing around $104,000 sitting there, which they knew was the value of his crypto portfolio, only $16.87 remained.

Manu Kundra and his wife Shallu. Photo / Supplied

Transaction history records show that on May 30, more than 50 outgoing payments had occurred ranging from $1.13 to as much as $24,000.

The problem was, he hadn't made any of the transactions.

It turned out scammers had cleaned out his cryptocurrency portfolio and now, six months later, the couple have lost any hope of getting their money back after investigations hit a dead end.

"Initially I was going to have to work 'til 58, now I'm going to keep working 'til 65," Manu Kundra told news.com.au.

To make it worse, if the money had remained in the account, by now it would have grown to a whopping $150,000.

Manu and his wife will have to push back their retirement after losing the money. Photo / Supplied

The dad-of-two started an account with Independent Reserve, an Australian cryptocurrency exchange, in 2017 when blockchains started soaring in value.

He invested around $45,000 of his savings into the platform between February and April 2018.

He owned 0.25 bitcoin, 35 ethereum tokens and 40 litecoins.

Then the market crashed and Kundra stopped trading, but he let his investment sit in the account for several years.

In 2020, he saw his portfolio start to pick up again as cryptocurrency entered into another bull run.

He more than doubled his initial $45,000 investment and it was worth $104,000 by May last year.

Kundra scrambled to save his cash when he realised he had been hacked.

The hacker had got into Kundra's account, changed the passwords and set up two-factor authentication to lock him out.

He notified Independent Reserve, who tracked down the money and found it had been sent to Binance, another cryptocurrency exchange.

Independent Reserve's CEO personally contacted the compliance team at Binance Australia and asked them to freeze the funds.

But by then it was too late.

Police investigations found the money was initially transferred to an account with an IP address in Turkey.

The money was then sent to another account in Nigeria where it has since disappeared for good.

NSW Police confirmed to news.com.au they are unable to pursue their investigation any further because the cyber criminals are outside their jurisdiction.

At the cryptocurrency peak in November last year, Kundra's investment would have worth a whopping $150,000.

"That was part of my strategy to get money for my retirement," Kundra said.

"To earn $150,000 is about $15,000 a month, in just 10 years it's impossible."

He will now have to keep working for another 17 years instead of just 10 years, which was his original intention.

And what's worse, he has now missed out on the opportunity to buy cryptocurrency cheaply.

"With this crypto market booming, you see your money going down every day [by not having any crypto]," he said.

"It took me four months to come out of that sort of anxiety."

Unfortunately Independent Reserve was unable to compensate Kundra as the breach had come from his end.

The Sydney family man initially had no idea how the hacker had hijacked his account and was worried his devices had been infected with malware, including spyware that was tracking his keyboard strokes.

He employed an IT professional and they didn't find any signs of malicious activity.

Unfortunately, he later discovered the email address linked to his cryptocurrency account had been compromised in a widescale data breach that involved one million other people.

His email and phone number had been sold before being dumped publicly in June 2020.

Under the Independent Reserve's terms and conditions, it is the customer's responsibility to protect their credentials.

"You are solely responsible for maintaining and protecting the confidentiality and security of your account (including, but not limited to, your log-in credentials, two factor authentication device, linked email account, any bank account used in connection with your account, phone number and any information you have provided in connection with your account)," the contract states.

"We are not responsible or liable for any unauthorised access to, or use of, your account (even where you may not be aware of such unauthorised access) except to the extent we have failed to take reasonable steps to secure the platform."

An Independent Reserve spokesperson told news.com.au: "At no point has there been any compromise or breach of Independent Reserve's systems or data.

"Independent Reserve followed all correct processes and procedures and acted in the client's best interests at all times.

"IR actively promotes best practice regarding keeping customer accounts safe and secure via regular warnings on its platform as well as publicly available information."

$750m of crypto stolen globally

A report from crypto data company Chainalysis released last week found that cryptocurrency-based crime soared in 2021.

More than $750m worth of cryptocurrency was stolen from people like Kundra last year.

North Korea-affiliated fraudsters were the worst, responsible for $400m of cryptocurrency hacks in those 12 months.

Most of these scammers used legitimate centralised cryptocurrency exchanges to send the stolen funds to, then transferred it to another untraceable account.