Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto

The theft was first discovered in September and was not yet connected to the crypto exchange going into liquidation the previous year.

A former employee of the now-defunct cryptocurrency exchange Cryptopia has pleaded guilty to the theft of roughly $172,000 in cryptocurrency he obtained by making a copy of users’ private keys.

According to a Monday report from New Zealand news outlet Stuff, the unnamed Cryptopia employee pleaded guilty in Christchurch District Court to the theft of more than $1,000 and theft “by a person in a special relationship” — referring to cases when a person takes funds held in trust from someone else. The court convicted the employee, and he will be sentenced on Oct. 20.

The worker had reportedly raised concerns with Cryptopia’s management regarding the security of users’ private keys and made his own copy of the information on a USB flash drive. Though the report did not state when he was able to copy the private keys or first access the funds, Cryptopia held an estimated $100 million worth of crypto at the time of its liquidation in May 2019.

David Ruscoe, a financial advisory services partner at Grant Thornton — the accounting firm assigned to Cryptopia’s liquidation — discovered the theft on Sept. 3, when he noticed that 13 Bitcoin (BTC), worth roughly $165,000 at the time, had been withdrawn from multiple wallets on the crypto exchange. The unknown actor had also put 2 BTC of the pilfered funds through a crypto mixer.

Identifying himself to Grant Thornton in an email the following week after being tipped off by an associate, the former Cryptopia employee reportedly admitted he had stolen the BTC as well as another $7,000 in crypto. He said he had already returned some of the coins — 6 BTC — and offered to send the rest with the assurance that he would not be criminally prosecuted. However, he later admitted his actions to the police and was subsequently charged.

“The defendant admitted that he was frustrated with Cryptopia but also motivated by the belief that he could get away with the theft as he thought nobody would ever check the old deposit wallets,” the summary of the facts stated, according to Stuff.

The New Zealand-based exchange was the victim of a major hack in 2019, reportedly resulting in the loss of roughly $16 million to $18 million in crypto. Cryptopia subsequently suspended its services and went into liquidation. However, a court determined in May 2020 that users of the exchange were entitled to have their holdings returned, and the claims process has already begun.