On Tuesday, October 8th, the XTRABYTES™ Co-founder and the Operational Security Manager conducted a phone call with a representative of Grant Thornton, the firm in charge of liquidating Cryptopia. The goal of this call was to find out what the intentions of the liquidation firm are and how that would affect XTRABYTES™ particular situation.
We have since been in regular contact with that same representative as we had agreed upon, to make sure that the content of our update was 100% accurate.
The final draft of this update was sent to Grant Thornton on Monday October 21st, for them to go over and give it their seal of approval regarding the Cryptopia situation. However, it appears as though they found the content of this update to their liking since they issued an update themselves on Friday October 25th, using most of the points we have included in this update.
Our guess is that they believed that they could reach a larger Cryptopia audience if they released an update themselves. And although all the things we found relevant and important to share through our update are included in the official update from Grant Thornton, we have chosen to get our update out as well because we feel it might offer some additional details and information which wasn’t included by Grant Thornton in their update.
The things we learned from the phone call, which are being confirmed by the official update from Grant Thornton, is that; although some of the information was already communicated by the firm through their previous press releases, some things were not obvious at the time for most people when reading them.
The person we spoke to on the phone is in charge of the technical part of handling the liquidation. He explained to us what they have been doing and what remains to be done.
It is important to understand that Grant Thornton is not investigating the actual hack, this is the responsibility of the authorities in New Zealand. This means that the firm is only able to deal with the assets that were not affected. What will happen with the coins that were stolen during the hack will have to wait for the conclusion of the police investigation. Whilst Grant Thornton are not investigating the root cause of the hack, they are undertaking a tracing exercise of the affected coins with a view to seeking a freezing and, ultimately, a return of those coins for the benefit of coin holders where possible.
When the firm was tasked with the job in May of this year, they identified 3 phases:
Phase 1: Identifying where all the assets are located and which assets were affected by the hack.
Since this includes collecting data that was stored in several locations, each having their own jurisdictions and regulations, means that several court procedures had to be concluded to collect all this data.
Phase 2: Setting up safe environments for all the different assets to ensure that no malicious code was left behind which could potentially trigger unwanted activity when setting up the wallets for all the different assets.
This phase also required the move of hardware from the offices of Cryptopia to a location controlled by the liquidation firm.
Phase 3: Identifying all the users so that the assets that are in their possession can be returned to their rightful owners, in full compliance with the law.
This phase also requires a court ruling on how the assets have to be classified so the correct procedures for returning the assets can be determined.
The representative of the firm that we spoke with assured us that the assets that belonged to the customers of Cryptopia will in no way be used to pay for the cost of liquidation. Grant Thornton has every intention to return all the funds, which they have control over, to the rightful owners. However, a court decision is required to determine the legal state of the cryptocurrencies held by Cryptopia in order to know the correct conditions for this return.
Grant Thornton does not have a say in this matter and is entirely dependent on the New Zealand courts for this decision. They are, however, taking every step to ensure that the eventual return of the funds will happen in accordance with the law. Since there are no precedents, it is impossible to make assumptions about a court decision in the matter. The people at Grant Thornton have ensured us that regardless of the court ruling they will make every effort to maximize the return of assets held by Cryptopia to their rightful owners.
It is important to understand that, in order to return the coins to their owners, the correct procedures will need to be followed, to make sure that everything happens in accordance with the law. This includes the requirement to identify the owners before any coins can be returned.
We have asked specifically whether it will be possible for people that didn’t verify their accounts on Cryptopia to comply with these requirements and the answer was yes. Meaning that people who hadn’t verified their account will have the opportunity to do so when the time comes. How this will be done is not known at this point.
So which phases have been concluded at this point?
According to the person we spoke with on the phone, phase 1 has been completed. This means that all assets (that are still in possession of Cryptopia) have been located and all data related to these assets has been collected.
Phase 2 is ongoing; this includes rebuilding the secured environment to access the located assets and collected data. This is a highly complicated process which involves 900 different assets and over 900.000 customers.
The order in which the different environments for the different assets is being set up is decided on a number of factors and do not only include coin value or market cap, but also the number of coins and people involved for each asset, among others.
Phase 3 could start before the conclusion of phase 2, however, this will also require a lot of planning given the large number of different nationalities and subsequent regulations pertaining to identification.
We explained to the firm’s representative that our concerns and the concerns of most other people in the crypto world, comes from the fact that there is very little communication about what has been going on and what the plans are. They acknowledged our concerns and asked us what we would suggest to help alleviate these concerns.
Being a blockchain development company we pointed out the benefits of decentralization and suggested the firm to reach out to the different development teams to help them set up safe wallets to access the funds that hadn’t been affected by the hack, since every development team knows their own technology best of all.
The person we spoke with was open to this suggestion and could see the benefit of including the different development teams to help them conclude the second phase of their plan.
Where does this leave us now?
An important thing to take away from this conversation is that Grant Thornton will make every effort to maximize the return of funds that were held by Cryptopia to the rightful owners and that even the people that hadn’t verified their accounts will get a chance to do so. However, before any return can take place, a court decision regarding the legal state of the cryptocurrencies held by Cryptopia is required.
We also know that the firm is taking every precaution to make sure that whatever lead to the hack in the first place doesn’t (unintentionally) happen again while they are trying to resolve this situation.
The firm is willing to cooperate with the different development teams to find solutions that will perhaps speed up the process of liquidating Cryptopia.
We concluded the phone call by suggesting that we write this announcement and send it to them first to make sure we are not spreading inaccuracies, which is something that they very much appreciated.
We also agreed to reach out to each other in the near future to see how we can possibly assist them in setting up a bespoke wallet that would make it possible for them to return our blocked coins to their rightful owners.
We want to thank the people at Grant Thornton for taking the time to speak to us and for their openness in their communication during our phone call. Let’s not forget there are little to no precedents, especially in New Zealand, where Cryptopia was located, on how to handle a situation like this.
This means that a lot of the steps that can be taken and need to be taken have to be figured out, debated and decided upon.
The phone calls gave us the confidence that Grant Thornton has every intention to do right by everyone, but it might take some time to accomplish this.
So, in the meantime, we have offered our cooperation and the technical skills of our development team because we prefer to be part of the solution, rather than sitting back and complaining.
Thanks for your continuous support.
The XTRABYTES™ team
The official update from Grant Thornton issued on October 25th can be found here.
Originally published in our blog on October 25, 2019.