Cryptopia: Hacked, Liquidated, Forgotten

On the morning of 13 January 2019, money began leaving Cryptopia's two main wallets in Christchurch, New Zealand. Two days later the exchange stopped trading and posted a short notice: a security breach had caused "significant losses". New Zealand Police called it a major crime. Nobody has been charged since.

Cryptopia was founded in Christchurch in 2014 by software developers Rob Dawson and Adam Clark. An exchange works like a share broker for crypto: customers deposit money, trade, and leave their balance in an account the company runs. Cryptopia's niche was altcoins, the thousands of small coins that bigger exchanges would not list, the crypto equivalent of penny stocks. By the time it failed it had more than 2.2 million registered users around the world and 37 staff.

The Hack

Blockchain analysts at Elementus estimated that up to $16 million in ether and other tokens built on the Ethereum network was taken, including about $3.5 million of ether itself and around $2.5 million of a token called Dentacoin. New Zealand reports put the loss at NZ$23 million to NZ$30 million. Later court documents described it as roughly 9 to 14 percent of the crypto held on the platform.

The method mattered more than the number. Every crypto wallet is controlled by a private key, a long secret code that works like the combination to a safe. The thieves did not trick a piece of software. They had the keys themselves, and Elementus counted funds taken from more than 76,000 separate customer wallets. They also kept them. Two weeks after the exchange went dark, another 1,675 ether, worth about $175,000, was drained from 17,000 Cryptopia wallets, much of it automatic payouts from mining pools sent by miners who had forgotten where their rewards were going.

Cryptopia was already weak. Trading had boomed in early 2018 and the company signed long, expensive contracts to keep up, then volumes fell away through late 2018. After the hack customers stopped trading. On 14 May 2019 the shareholders put the company into liquidation, the New Zealand version of a bankruptcy wind-down, and appointed David Ruscoe and Malcolm Moore of the accountancy firm Grant Thornton.

Whose Coins?

The liquidators found a mess. According to their reports, nobody had ever done a proper reconciliation between the coins in the exchange's wallets and the balances shown in customer accounts. That raised a question no court in the common-law world had fully argued before: if an exchange goes bust, do the coins in its wallets belong to the company, and so to its creditors, or to the customers?

On 8 April 2020 Justice David Gendall of the High Court in Christchurch gave the answer in Ruscoe v Cryptopia. Cryptocurrency, he held, is a form of property. The coins Cryptopia held were held on trust for its account holders, the way a solicitor holds a client's money in a separate client account that the firm's own creditors cannot touch. Each coin type was its own trust. Lawyers and academics in Britain and Australia quickly called it a benchmark: the first fully contested common-law judgment to rule that crypto is property.

For customers, that meant they would get their actual coins back rather than queue as unsecured creditors for a few cents in the dollar. It also meant they would pay for the privilege. Later court orders let the liquidators charge the costs of running each trust to the holders of that coin, and allowed them to skip coins worth too little to distribute and balances smaller than the cost of processing them.

The Long Payout

Building the machinery took years. The liquidators had to rebuild most of the wallet system, because the source of the hack was never found, and forensically reconstruct deposits and withdrawals. They built a claims portal with identity checks, at a cost of more than NZ$9.2 million by mid-2026. Customers had to register, prove who they were, and agree to their balance.

The first coins went out in December 2024. Over two days more than 10,000 verified holders of bitcoin and dogecoin received cryptocurrency worth over NZ$400 million. Because holders got coins rather than their 2019 dollar value, the rise in the bitcoin price since the collapse did much of the work. By the liquidators' 15th report, dated 12 June 2026, 16,850 account holders had received more than NZ$487 million across six currencies: bitcoin, dogecoin, cardano, tether, tron and litecoin. The court-approved final cut-off for registering was 30 September 2025. Late registrants may get less or nothing.

The hunt for the stolen coins continues. The liquidators have filed recovery and information actions in the United States, Malaysia, Singapore, Hong Kong and the Seychelles, using court orders that force other exchanges to say where the money went. US authorities returned about 18 bitcoin traced to the hack, which the liquidators turned into roughly NZ$3.9 million for the trusts that lost coins.

One theft was solved. A former employee, Michael Glaser, admitted copying private keys and stealing bitcoin and litecoin from old deposit addresses after the hack, while the company was in turmoil. He was sentenced in the Christchurch District Court on 18 March 2022 and ordered to repay the liquidators about NZ$21,255, which he has now paid. That theft was separate from the January 2019 hack, which police are still investigating.

Seven years on, the liquidators say it is still not practicable to estimate when the liquidation will end.