Police have locked down the office of a Christchurch cryptocurrency trader after it lost what appears to be millions of dollars worth of currency in a security breach.
Cryptopia's Colombo St headquarters was under police lock down on Wednesday morning after a "significant amount" of cryptocurrency is thought to have been transferred at the trader without authorisation.
Some staff gathered in the upstairs car park as others were questioned by police.
An officer was visible in the second-storey window of the Colombo St office. Another stood in the foyer behind locked sliding doors.
Investigators were flying down from Wellington on Wednesday morning, police said.
A police statement said officers were advised late on Monday of "an issue involving potential unauthorised transaction activity".
Police were taking the matter "very seriously", the statement said.
"We are currently talking to the company to gain a further understanding of what has occurred.
pic.twitter.com/0ZwqFfwwHi
— Cryptopia Exchange (@Cryptopia_NZ) January 15, 2019
"A dedicated investigation team is being established in Christchurch including specialist police staff with expertise in this area."
And now the capital markets regulator the Financial Markets Authority has been called in.
An FMA spokesman said Cryptopia reported the breach to the FMA on Wednesday morning.
"We will be engaging with the firm and the police."
The FMA has received complaints about Cryptopia in the past and these were either forwarded onto a dispute resolution service or the FMA explained to Cryptopia customers the process for making a complaint to the dispute resolution service, the spokesman said.
The FMA did not regulate Cryptopia or the cryptocurrencies that it trades, but those providing a financial service related to cryptocurrencies needed to register on the Financial Services Providers Register – which enabled customers to access an independent dispute resolution service, he said.
Easy Crypto co-founder Janine Grainger said the Cryptopia incident did not do the cryptocurrency market any favours.
"Every time there's a hack like this it does instil a bit of uncertainty in the public's mind," Grainger said.
"Part of the problem is it's a very young industry so hacks like this are fairly common place."
She said there had been reports by blockchain transaction monitoring accounts on social media that the Cryptopia transfer involved two transactions worth a US$3.6 million (NZ$5.3m) combined.
One was for US$1.2m worth of a cryptocurrency called Centrality. That equates to 48 million tokens.
The second was for US$2.4m in Ethereum, or about 19 thousand tokens.
She said it was unlikely the tokens would ever be found, because there were so many exchanges they could be traded through, making tracing them a difficult task.
"I would imagine whoever has taken these funds is very good at hiding their tracks."
The best cryptocurrency experts in the world would have trouble finding out what happened to the funds, let alone the New Zealand police, she said.
She hoped police would learn from the experience and dedicate more resources to cryptocurrency crime prevention.
She warned cryptocurrency investors to be careful where they store their funds.
Rather than storing cryptocurrency in exchanges they should be kept in "cold storage", a secure storage system that's not connected to the internet such as a USB drive.
A number of Kiwis have been posting about losses on social media.
Adam Lyness, who worked as Cryptopia business development manager until November, said he did not have any information other than what was in the public domain.
He said people went into cryptocurrency trading knowing the risks involved.
"It's a new industry so I think most people going in would be aware and go in with their eyes open to the risks."
The industry had a history of security breaches, Lyness said.
"That's the nature of the industry."
He said when he left Cryptopia it had about 100 staff.
However, Companies Office records show Lyness still owns a third of a company called Intranel Consulting, which owns a quarter of Cryptopia.
Late on Sunday Cryptopia tweeted it was experiencing "unscheduled maintenance".
Then on Monday, it posted a statement to Twitter saying it had suffered a "security breach" that day which resulted in "significant losses".
#Cryptopia has announced that they have faced #security #breach, with rumours circulating that a large amount of #ERC20 assets have been lost. Which seem to be true when we look to their hot wallet;
https://t.co/JiwfNz0Xhw pic.twitter.com/lni0yl0jxk
— Samuel JJ Gosling (@xGozzy) January 15, 2019
The cryptocurrency exchange had been put into maintenance while staff assessed the damages, it said.
"Staff then notified and involved the appropriate Government agencies, including NZ Police and High Tech Crimes Unit who are jointly and actively investigating the matter as a major crime and they are assisting us with advice.
"Until this has been carried out, the Cryptopia Exchange will remain in maintenance mode, with trading suspended."
Cryptopia was founded by Rob (Hex) Dawson and Adam Clark as a hobby three years ago.
It now has more than 1.4 million users.
It offers trading in a number of different cryptocurrencies, including Bitcoin, Litecoin and Doge.
Dawson's father, Pete Dawson, is now the sole director and a 5 per cent shareholder of Crypotpia. Pete Dawson, who is the Canterbury Returned Services Association (RSA) president said police had told him to say nothing.
The company has 90 shareholders, most of them with a less than 1 per cent shareholding. The main shareholders are Clark with 30 per cent, Dawson with 27 per cent and Intranel Consulting with 26 per cent.
Its registered office is in the Christchurch suburb Sydenham.
