A former employee of international currency exchange Cryptopia has been sentenced to nine months’ home detention for stealing almost $250,000 worth of cryptocurrencies and customer data.
Name suppression also lapsed for the former employee, Michael Glaser, during his sentencing in the Christchurch District Court on Friday before Judge Gerard Lynch.
The 45-year-old earlier pleaded guilty to two charges – theft by a person in a special relationship, and theft of more than $1000.
In January 2019, Cryptopia Ltd was hacked and more than $25 million of cryptocurrencies were stolen, amounting to 15 per cent of its clients’ digital currency stock, the biggest theft in New Zealand history.
READ MORE:
* Ex-Cryptopia staffer admits stealing almost $250,000 of cryptocurrency
* Assets worth $62,000 allegedly stolen from liquidated company Cryptopia
* Former employee allegedly stole almost $250k worth of cryptocurrency from Cryptopia
Glaser had no connection to the hack.
In May 2019, the company was placed into liquidation, an ongoing process led by Grant Thornton.
According to the summary of facts Glaser allegedly raised concerns with management around the security of private keys for numerous wallets held by the company.
Glaser’s position involved, amongst other roles, management of the software interface for the virtual wallets within which the various crypto-currencies were stored. His role provided him with control over all of the keys.
At some point during his employment, Glaser made an unauthorised copy of private keys from Cryptopia’s numerous wallets and saved it on a USB storage device, taking it home and uploading the information to his own computer.
After the liquidation, all Cryptopia workers’ contracts were terminated but Glaser kept his copy of Cryptopia’s private keys. Having access to the private keys to Cryptopia’s wallets potentially provided him with access to well in excess of $100m worth of cryptocurrencies.
On September 3, 2020, David Ruscoe at Grant Thornton received an email from a previous Cryptopia client saying he had accidentally deposited some bitcoin into an old Cryptopia deposit wallet and requested the funds be returned.
Grant Thornton subsequently reviewed Cryptopia’s wallets and noticed 13 bitcoin had been unlawfully withdrawn from a variety of wallets in a series of transactions.
Two bitcoin had subsequently been put through a mixing service, designed to launder cryptocurrencies and hide both where they end up and the identity of the person controlling them.
RNZ
RNZ’s podcast The Detail explores the world of cryptocurrency and there’s a tip that might just save your fortune. (Video published in May, 2021)
At the time of the transactions, the bitcoin was worth about $235,000.
On September 10, Glaser emailed David Ruscoe and Tom Aspin of Grant Thornton and admitted stealing the bitcoin, as well as another cryptocurrency worth about $10,000.
He said he had returned some of the stolen currencies and offered to repay the remainder.
The following day he emailed again saying he had returned six of the stolen bitcoin and sought an assurance that if he returned the remaining bitcoin he would not be charged or accused of wrongdoing.
Later that day he returned the six bitcoin.
Later that month he admitted to police he had copied and removed the keys from Cryptopia’s premises, stolen the bitcoin and other cryptocurrency, and put it through a mixing service.
“The defendant admitted that he was frustrated with Cryptopia but also motivated by the belief that he could get away with the theft as he thought nobody would ever check the old deposit wallets,” the summary of facts said.
When informed by an associate that Grant Thornton was reviewing the old deposits, he confessed to the liquidators what he had done. He subsequently returned the stolen currency.
On Friday, Crown prosecutor Sean Mallett said the application for name suppression was “speculative” and had not established any hardship.
In his submission Glaser mentioned death threats. The threats were looked into by the officer in charge of the case. They were made about two years ago by people on Twitter who had made a number of threats towards other people, Mallett said.
Granting name suppression would also cast suspicion on all other employees, who were “working hard to do right by investors”, Mallett said.
Stacy Squires/Stuff
Glaser earlier pleaded guilty to two charges – theft by a person in a special relationship, and theft of more than $1000.
“White-collar crime of this type can be very difficult to discover, it needs to be clear to well-educated, employed, middle-class people that if they are going to embark on fraud offending of this type they run the risk of name and reputation being made public.”
Glaser’s lawyer, Allister Davis, said dropping name suppression would be “akin to throwing Mr Glaser to the wolves”, he said.
He said it would be difficult for investors to “uncouple” the offending from the $25m hack.
There was no suggestion he was involved in the hack and had been thoroughly investigated following his arrest, with officers going through his bank accounts with a “fine-tooth comb”.
Judge Lynch said the liquidators submitted on the “reputational harm” felt by Glaser’s former colleagues and friends.
With ongoing suppression, suspicion fell on the other employees who suffered emotional harm through the abuse they received following the offending.
Staff were “emotionally unstable and fearful for their safety”, he said. They were also “shocked” someone they trusted could do this.
Judge Lynch said Glaser was currently self-employed and worked from home.
His offending came from feeling Cryptopia was being “negligent” and blamed them for his offending.
Judge Lynch said Glaser had caused “incalculable” pain to his family and friends and had shown “little remorse”.
He declined Glaser’s application for final name suppression and sentenced him to nine months’ home detention starting Friday. He was also ordered to pay $21,225 in reparation to cover the liquidator’s costs.