Hong Kong police have arrested three men believed to be tied to a broader syndicate who allegedly cheated bitcoin ATMs out of nearly HK$230,000 (US$30,000), the first case of its kind in the city.
The force took action over the past two days after reports were filed by two cryptocurrency exchanges. The exchanges suspected the culprits had taken advantage of “loopholes” in the ATMs, withdrawing cash without official authorisations.
I cannot reveal what the loopholes are. But any bitcoin transaction needs verification. Maybe the ring bypassed the verifying process before taking the money
Superintendent Wilson Tam, cyber security and technology crime bureau
Police refused to elaborate further on precisely how the suspects had cheated the machines.
Get the latest insights and analysis from our Global Impact newsletter on the big stories originating in China.
“I cannot reveal what the loopholes are. But any bitcoin transaction needs verification. Maybe the ring bypassed the verifying process before taking the money,” superintendent Wilson Tam Wai-shun of the cyber security and technology crime bureau said on Saturday.
“We have offered security advice to the two companies and believe they will upgrade their systems. It is the first time we came across fraud linked to bitcoin ATMs.”
A bitcoin ATM allows the purchase of bitcoin by cash or credit card, while some also allow the cryptocurrency to be sold for cash.
Tam said the group, thought to be the “core members behind the syndicate”, withdrew a total of HK$226,000 in cash from six separate bitcoin ATMs in 11 transactions. The largest amount from a single machine was HK$54,000.
Officers mounted arrest operations on Thursday and Friday in Mong Kok, netting three core members, aged 26 to 55, for conspiracy to defraud. All three claimed to be unemployed.
Police also seized six smartphones and some cash linked to the case. Tam did not rule out more arrests.
Bitcoin is not considered legal tender by the Hong Kong Monetary Authority but rather a virtual commodity.
In September 2017, the Securities and Futures Commission (SFC) published a statement ruling that if digital tokens distributed in initial coin offerings were “shares”, “debentures”, or interests in a “collective investment scheme”, they would fall under the definition of “securities”.
“In such cases, dealing in or advising on the digital tokens, or managing or marketing a fund investing in such digital tokens, might constitute a regulated activity and would require registration or a licence from the SFC,” the statement read.