Cryptopia hack
The New Zealand exchange Cryptopia was hacked in January 2019, losing about NZ$30M (~$20M) in crypto, and was placed into liquidation in May 2019. A landmark NZ court ruling held that the assets were held on trust for account holders.
Also known as: Cryptopia
Summary
Cryptopia was a Christchurch, New Zealand-based cryptocurrency exchange. In January 2019 its servers were hacked and an estimated NZ$30 million (roughly $20 million at the time, representing 9–14% of its holdings) in cryptocurrency was transferred out using the exchange's private keys; the transfers were irreversible. The exchange suspended operations, briefly reopened, and was placed into liquidation in May 2019. [1][2]
Aftermath
In a case with little legal precedent, a New Zealand court ruled in April 2020 that the crypto was held on trust for the roughly 800,000–900,000 account holders rather than for general creditors. Liquidators at Grant Thornton spent years reconciling balances and tracing funds across jurisdictions; distributions to account holders followed. [1][2][3]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
- Cryptopia liquidators release third statutory report — Grant Thornton NZ
- Ruscoe & Moore v Cryptopia Limited (in liquidation) — judgment — High Court of New Zealand
- Users of hacked crypto firm get millions back — RNZ
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
