January 2019 – Cryptopia Hack

On the 14th January 2019, the Cryptopia Exchange suffered a security breach which resulted in significant losses. Once identified, the exchange was put into maintenance while we assessed damages.

Cryptopia was founded in 2014 by Rob Dawson and Adam Clark. They quit their jobs in 2017 in order to work on the exchange full time.

In May 2017 Cryptopia launched the New Zealand Dollar Token (NZDT), a cryptocurrency whose value is supposed to be pegged to the New Zealand Dollar.

From May to December 2017 Cryptopia grew from 30,000 to 1,000,000 users. In January 2018, they temporarily suspended new account registrations and trading in their Dogecoin and Litecoin markets, claiming they could not handle the influx of trades.

In January 2018, Cryptopia announced that ASB Bank would be closing their accounts associated with NZDT in February. As a result, Cryptopia stopped accepting deposits into NZDT and told customers to withdraw the associated funds by the closing date. Cryptopia planned to relaunch NZDT in early 2019 after making a deal with a new, smaller bank.

On 15 January 2019 Cryptopia announced that they had “suffered a security breach which resulted in significant losses”. A report from Elementus, a New York based blockchain company, estimated the value of stolen funds to be around $23 million NZD ($16 million USD). It also stated that the theft began on 14 January and continued until the 17th.

Timeline of events

  • Sunday 13-Jan, 8:28am: Funds begin moving out of Cryptopia’s two core hot wallets, one holding ether and the other holding tokens.
  • Sunday 13-Jan, 11:58pm: With the core wallets empty, residual quantities of funds begin leaving Cryptopia’s 76k+ secondary wallets, a process that would continue for several days.
  • Monday 14-Jan, 6:00am: Cryptopia suspends trading, announcing they are undergoing unscheduled maintenance.
  • Tuesday 15-Jan, 3:00am: Cryptopia discloses the security breach and New Zealand law enforcement steps in.
  • Thursday 17-Jan, 5:58am: The last of Cryptopia’s funds are drained.

Stolen Funds

The breakdown of losses by cryptoasset is shown below.

Asset Value (USD)
ETH $3,570,124
Dentacoin $2,446,212
Oyster Pearl $1,948,223
Lisk ML $1,718,610
Centrality $1,148,144
Mothership $880,141
Ormeus $452,841
DAPS $384,425
Zap $147,158
Pillar $254,521
Other tokens $3,051,709
Total $16,002,108

Market value of crypto assets stolen from Cryptopia, valued at 19-Jan-2019 market prices.

Here’s the full list of transactions associated with the Cryptopia Hack.

Retrieved from Elementus

Cryptopia’s Announcements

Important Announcement January 15th 2019
First liquidators’ report on Cryptopia released today

July 2018 – Bancor Hack

October 2016 – Bitcurex Hack