Background
Founded in Hong Kong in 2016 as "Monaco" by Bobby Bao, Gary Or, Kris Marszalek, and Rafael Melo, Crypto.com was renamed in 2018 following a purchase of a domain owned by cryptography researcher and professor Matt Blaze valued at between US$5-10 million. Operated by Singapore-based Foris DAX Asia, the company had 10 million users in February 2021 and reported more than 50 million active users as of May 2022. Despite a US$15 million Ether hack in January 2022 that caused a temporary pause in withdrawals, no customer funds were lost.
Incident
Thevamanogari Manivel and her partner Jatinder Singh were committed to stand trial on theft and other charges related to cashing an erroneous $10.47 million payout from Crypto.com in May 2021. This mistake had occurred when a worker in Bulgaria entered the wrong numbers into an Excel spreadsheet while processing the refund. The refund request was then sent to a payment provider in Australia, which then transferred the funds into Manivel’s Commonwealth Bank account.
Although the Crypto.com account was registered in Singh's name, the transfer of funds has actually been sent to Manivel's account as he had used her bank card to purchase cryptocurrency, according to the court hearing. Singh had allegedly believed he had won the money when he was sent a notification through the Crypto.com app about the competition; this was also what he told Manivel.
Impact
Michi Chan Fores, a Crypto.com compliance officer, strongly denied any competition and declared that Crypto.com had not sent push notifications to inform users about potential winnings. The money had been used to purchase four houses, with $4 million transferred to a Malaysian bank account, as well as gifts, vehicles, art, and furniture. Most of the money has since been repaid. Approximately $3 million is still outstanding. A civil action is currently in progress to freeze the properties and reclaim the money from relatives. As of the end of 2022 the court proceedings are still underway.
Spreadsheet Error
The error that happened, according to the sources, is fairly basic. The value of the payout was to be entered manually instead of calculated automatically. The clerk whose job it was to populate the value made a data entry error where they entered extra zeroes at the end. A common way of combating similar problems is to use validation rules for manual inputs.
Timeline of Events
May, 2021
A clerk at an offshore facility makes a data entry error on an Excel spreadsheet. The spreadsheet lacks validation and the error is not caught.
May, 2021
The unnoticed error results in a refund payment of $10,47 Million instead of $100 to Manivel Thevamanogari and Jatinder Singh.
Summer, Fall, 2021
The couple buys four houses, cars, art and furniture and dispenses gifts. $4M are transferred to a bank in Malaysia.
Dec, 2021
An audit at Crypto.com discovers the error. When approached the couple claims they believed the sum was transferred as a competition reward.
Mar, 2022
Manivel is arrested at Melbourne airport in March while allegedly trying to fly home to Malaysia on a one-way ticket with about $11,000 in cash. She is later granted bail on very strict conditions.
Nov, 2022
Court hearings are scheduled ...