What Happened to Cryptsy? The Exchange That Hid a 13,000 BTC Theft

1. 1

   May 2013: the exchange that would list anything

   Cryptsy went live in May 2013, founded by Paul Vernon from a suburban office park in Delray Beach, Florida — a serial web entrepreneur who had started mining bitcoin in 2011 and moved on to Litecoin and Feathercoin as prices climbed. Its strategy was the opposite of every established exchange's: instead of vetting projects, Cryptsy listed nearly every new altcoin the BitcoinTalk forum produced, and became the default liquidity pool for an entire generation of micro-coins. The archived homepage from June 2014 advertises trades in "over 130 different types of cryptocurrencies," USD markets alongside BTC markets, and a loyalty program called CryptsyPoints. Contemporaneous reporting put the platform near 250,000 users, with the Wall Street Journal noting 33,000 trades a day as early as November 2013. In a bull market starved for altcoin exposure, being the only shop in town was a license to print money.

   

2. 2

   July 29, 2014: the sweep nobody was told about

   On July 29, 2014, at 13:17:36 UTC, a single transaction swept Cryptsy's bitcoin cold wallet — WalletExplorer's record still shows eleven outputs of 1,000+ BTC draining a wallet that had held over 11,300 BTC down to dust. According to the federal indictment unsealed in 2022, Vernon told his employees that day that a hacker had stolen more than $5 million in bitcoin and other cryptocurrencies. Customers, however, were told nothing: the indictment says he kept operating the exchange and soliciting new customers without disclosing the loss, and the public would not learn of the theft until after Vernon himself had left the country. His later blog post put the numbers at roughly 13,000 BTC and 300,000 LTC. The theft was never hidden particularly well on-chain — it was hidden institutionally, for eighteen months.

   

3. 3

   August 2014: "We don't have anything to hide"

   Rumors that Cryptsy withdrawals were failing reached the South Florida Bitcoin meetup, so its two co-hosts, Chris DeRose and Joshua Unseth, drove to the Delray Beach office park unannounced in August 2014 with a cell-phone camera. The footage they uploaded shows the exchange's founder introducing himself — "I'm Paul Vernon, Big Vern, of Cryptsy" — then describing the withdrawal rumors as "unsub— unsubstantiated," blaming Reddit exaggeration, and insisting "we don't have anything to hide." The visit, described in Broward Palm Beach's later investigation, found a nervous man with his head lowered and eyes down, but the two left appeased and posted the video. For the community, the episode became a rare moment of transparency; in hindsight it was the last recorded assurance before eighteen months of silence.

   

1. 4

   October 2015: "We have never been investigated for anything, period"

   By mid-2015 the withdrawal complaints had hardened into a pattern, layoffs began at the exchange, and in October the blog Coinfire published a report alleging that federal agencies — the SEC, the IRS, FinCEN and the Department of Homeland Security — had opened investigations into Cryptsy. Cointelegraph carried the story on October 6, 2015, quoting Cryptsy's response in full: "We have never been investigated for anything, period. We have never gotten any letters from any of the agencies." Vernon accused the outlet's writer of having "personal reasons" to hurt the exchange and threatened legal action over the "libelous article." It was the second time that autumn Cryptsy had publicly fought Coinfire, having already denied misrepresenting its licensing status in an October 5 blog post. The denial is archived on the exchange's own blog — signed, as always, Paul Vernon "BigVern."

   

2. 5

   January 12, 2016: balances visible, withdrawals stuck

   The clearest picture of the collapse comes from a user who recorded his own screen. On January 12, 2016 — one week before the blog confession — the YouTuber IMineBlocks logged into Cryptsy and showed an account with an estimated portfolio value of 4.45 BTC, flat and crypto balances intact, and a pending-transactions queue full of withdrawals that were going nowhere. His support tickets from January 7 and January 9 had been answered days later with the same copy-pasted notice about "problems with our withdrawal system." Bitcoin and Litecoin withdrawals were effectively dead; the only coins still moving were minor altcoins, and users had learned to chain small withdrawals of Feathercoin or Vertcoin to smuggle value out. Every hour the queue sat frozen, the exchange's remaining credibility drained with it.

   

3. 6

   The exit premium: coins worth double, and why

   The same recording documents one of the strangest market distortions of the era: inside Cryptsy, altcoins that could still be withdrawn traded at roughly twice their external market price. The user flips between CoinMarketCap — where Vertcoin quoted around $0.019 — and Cryptsy's own markets, where sell orders sat near double that figure. The premium was pure escape demand: anyone who could buy a withdrawable altcoin with frozen BTC and move it off the exchange was effectively paying a 50 percent ransom to themselves. IMineBlocks walked viewers through his own route, buying Feathercoin, Vertcoin, NXT and Mintcoin in small lots and withdrawing them one by one, and warned that anyone selling coins into Cryptsy at those prices would likely never see the Bitcoin again. It was arbitrage as an evacuation plan.

   

4. 7

   January 13, 2016: phishing, and a banner signed BigVern

   On January 13, 2016, Cryptsy users received emails headed "Cryptsy is closed," supposedly from the exchange, inviting them to a "refund" site called cryptsy-refund.com. The exchange answered with an orange banner across its dashboard — "Important System Notification" — explaining that attackers had compromised its Twilio account by SMS through a weak password and had separately abused the same Mailgun mailing service Cryptsy used, and urging users to change passwords, enable two-factor authentication and check their pending withdrawals. The banner carried a signature the community had been waiting weeks to see: "BigVern," promising another post "in the next couple of days" to explain "what has been happening" at Cryptsy for the past couple of months. Behind the scenes the same week, Vernon's wife's divorce filings — which predicted he might "return to China with his girlfriend" — were leaking to crypto media.

   

5. 8

   January 13-14, 2016: the class action lands

   While users were still reading the phishing warning, two Florida law firms — Wites & Kapetan and Silver Law Group — filed a class action in the U.S. District Court for the Southern District of Florida on January 13, 2016, against Cryptsy and Paul Vernon personally. The named plaintiff, Jinyao Liu, had deposited 84 million Dogecoin on December 27, 2015, valued by Cryptsy at about 33.6 BTC (roughly $14,100), and watched every withdrawal request from December 28 to January 8 go unanswered. The complaint alleged negligence, unjust enrichment, conversion and violations of Florida's Deceptive and Unfair Trade Practices Act. Attorney David Silver's public message was simple: as a FinCEN-registered money services business, Cryptsy owed its customers communication, and "customers don't know why they are being denied access to their money." The next day, CoinDesk put the lawsuit on its front page — and Cryptsy's response to Coinfire was still "we have never been investigated for anything."

   

1. 9

   "Cryptsy has had problems for some time now"

   On January 15, 2016, the promised post appeared on blog.cryptsy.com under a single word: "Announcement." It opened by ruling out the explanations users had heard all month — "These problems were NOT because of any recent phishing attacks, or even a ddos attack, nor does it have anything to do with me personally" — and then delivered the real one: "About a year and a half ago, we were alerted in the early AM of a reduction in our safe/cold wallet balances of Bitcoin and Litecoin." The post confirmed that trading and withdrawals were suspended indefinitely, laid out seven options for the exchange's future ranging from bankruptcy to finding an investor, and closed with an advisory-board invitation to community leaders. Users watching the post load that morning — screen recordings of the day survive — had no way to know it would be the exchange's definitive statement.

   

2. 10

   The cover story: a backdoor in Lucky7Coin

   The blog placed the theft on a specific, checkable claim: the developer of Lucky7Coin, a minor proof-of-work altcoin, had planted an IRC backdoor in the wallet's code that turned it into a "command and control unit." The post even reproduced the message Cryptsy said it received on May 22, 2014 from the coin's new maintainer — a developer calling himself Jack, pointing to his GitHub repository and urging the exchange, "You're the only exchange for this coin... Please upgrade as soon as you can." Whether that upgrade delivered the trojan is the story's unresolved technical question; what the following months proved is that no one outside Cryptsy verified any of it in real time. The exchange's wallet software had been, by its own account, a compromised node in constant contact with an attacker's IRC channel for months before the sweep.

   

3. 11

   The numbers: 13,000 BTC gone, 10,000 BTC owed

   Then came the arithmetic, posted as plainly as a balance sheet: "These are the approximate figures taken: Bitcoin: 13,000 BTC. Litecoin: 300,000 LTC." The blog admitted the exchange had chosen concealment as a business strategy — profits would refill the wallets "over time, thus attempting to avert complete closure" — until an article from Coinfire, which it called full of "many false accusations," "basically caused a bank-run." The most damning line was the residual: "Our current customer liabilities for BTC is around 10,000 BTC." In other words, after eighteen months of profit-skimming, the exchange still owed customers ten thousand bitcoins it did not have, while claiming deposits kept flowing in throughout. It was insolvency confessed in the same post as the theft it caused.

   

4. 12

   A 1,000 BTC bounty — and frozen coins

   The post closed with an odd mix of forensics and plea bargain. Vernon linked the WalletExplorer wallet holding the stolen coins, noted that "2014-07-29 13:17:36 is when the event occurred" and that the bitcoins "have not moved once since this happened," and offered "a bounty of 1,000 BTC for information which leads to the recovery of the stolen coins" — plus a no-questions-asked return address for the thief. He explained the eighteen months of silence by saying "we just didn't know what happened, didn't want to cause panic," name-dropping the Secret Service agent Shaun Bridges — then under his own criminal cloud — as the contact he could no longer trust. Days later, answering CoinDesk, Vernon compressed the whole cover-up into one sentence: "Any other reason would have caused a panic." He also claimed, in that same interview, to be "travelling in China right now."

   

1. 13

   April 2016: the receiver moves in — and finds looting

   With Vernon unresponsive and the exchange dark, Judge Kenneth Marra appointed receiver James Sallah over Cryptsy's parent, Project Investors, in April 2016 — an early, extraordinary step in a private class action. Sallah found customer funds commingled into large shared wallets, making account verification, in his words, "much more difficult, time-consuming and ripe for fraudulent claims," though he secured over $700,000 in assorted altcoins after a demand letter froze funds moved to Bittrex. His August 2016 report went further: over two years and seven months, it alleged, Vernon had converted more than 1,100 bitcoin into over $3.3 million for himself — roughly $2.2 million of it sold through Coinbase — and someone acting for him had deleted critical server data that April, leaving the estate unable to "properly repay the victims." Vernon, through his attorney, denied stealing from his own exchange; by then he had already been located in absentia, last documented at the U.S. Embassy in Beijing signing divorce paperwork, with a Chinese exchange called BiteBi9 — registered by a "Bao Luo" ("Paul") using a Project Investors email — striking the victims' attorney as "basically a mockup of Cryptsy, just operating in China."

   

2. 14

   July 27, 2017: $8.2 million by default

   Vernon never answered the class action, so on July 27, 2017 U.S. District Judge Kenneth Marra entered an $8.2 million default judgment against him — a moral victory for customers with almost no practical collection path, since their debtor was missing. The judgment crystallized what the litigation had proven on paper: that Cryptsy and its CEO had denied customers access to their funds while concealing the loss behind technical excuses. Even the missing coins stayed trackable — attorney David Silver told CoinDesk in 2022 that he continued to monitor 11,325 missing bitcoins, which he described as untouched in private wallets and watched in real time, waiting for any move to freeze them. The default also set the legal stage for everything that followed: with liability established, the only questions left were where the money went and who helped move it.

   

3. 15

   January 2020: Coinbase pays victims nearly $1 million

   The judgment named Vernon, but the paper trail led through other doors — one of them Coinbase's. In January 2020, the exchange settled the class action's aiding-and-abetting claims, agreeing to pay nearly $1 million — reports put the settlement fund at about $922,050 — to Cryptsy victims who alleged Coinbase had cashed out Vernon's stolen coins without adequate monitoring. The receiver's report had traced roughly $2.2 million of Vernon's conversions to Coinbase accounts, making the platform the single largest exit point for the allegedly laundered funds. For most Cryptsy customers it was the only recovery they would ever see: not from the exchange that owed them, but from a company that had merely done business with its founder. The settlement closed the civil era of the case; the criminal one was still three years away.

   

4. 16

   January 26, 2022: 17 counts, one fugitive

   The last word came from the Justice Department. On January 26, 2022, a 17-count indictment unsealed in federal court in Miami charged Paul E. Vernon — "founder, operator, and Chief Executive Officer of Project Investors Inc., doing business as Cryptsy" — with tax evasion, wire fraud, money laundering, computer fraud and destruction of records. The document alleged he diverted over $1 million of customer cryptocurrency between May 2013 and May 2015 into his own wallets and bank account, moved to China around November 2015, and then, in April 2016 after the receivership began, remotely hacked Cryptsy's own servers to steal the customer funds database and destroy it. Investigators from the IRS and FBI built the case in his absence; Vernon, believed to remain in China, is still at large. The indictment did not charge anyone with the July 2014 theft itself — but by alleging two years of quiet wallet-draining, it gave the community's oldest suspicion its official form.

   

Continue the Story