Bellevue venture capitalist Gregg Bennett’s lawsuit against local cryptocurrency exchange Bittrex, which he alleges allowed hackers to make off with nearly $1 million in Bitcoin, has lost some backup from a state regulator.
Investigators at the state Department of Financial Institutions (DFI) notified the company Monday they had reversed their earlier ruling that Bittrex had violated state banking rules by failing to respond rapidly enough to Bennett’s complaint he’d been hacked. Bennett had used their initial finding, after an August probe, to bolster his case.
Bennett says he’s still suing. Bittrex “let a bad guy into the building and didn’t send anyone to patrol the corridors,” he said in an interview.
In court filings, Bennett said he emailed Bittrex requesting his account be frozen after hackers siphoned away 70 Bitcoin. In Bennett’s telling, Bittrex was so slow to respond that the hackers were able to make off with 30 more Bitcoin before the company took action.
When the DFI investigated the incident in August, it found the company “did not take reasonable steps” to protect Bennett’s account from fraud. “It appears Bittrex violated the Uniform Money Services Act for engaging in an unfair or deceptive act by failing to adhere to its Terms of Service,” according to a letter sent to Bennett summarizing the outcome of the investigation.
The regulator’s findings relied on timestamps appearing to show Bennett emailed Bittrex to request the company freeze his account two hours before the hackers drained the last of his Bitcoin. However, DFI’s initial investigation did not consider that Bittrex’s cryptocurrency transactions are stamped in Coordinated Universal Time, seven hours ahead of Pacific Daylight Time — the time zone in which Bennett’s emails were sent.
After The Seattle Times asked DFI on Jan. 10 about the discrepancy in time zones, investigators retraced their steps, emails between Bittrex and investigators show. Bittrex had raised the time zone issue with the agency as far back as September, the emails show, but the company didn’t give DFI proof it recorded transactions in Universal Time until Friday evening.
The agency concluded Monday afternoon that Bennett had actually asked Bittrex to freeze his account five hours after the hackers had finished plundering it. In a letter to Bittrex, it explicitly overturned its previous finding and cleared Bittrex of the apparent violation.
Bennett’s lawsuit, filed in King County Superior Court in October, relied in part on the state’s now-overturned finding of fault against Bittrex. Bittrex had already asked a judge to dismiss the case.
He said his suit is about more than Bittrex’s slow response to his request to freeze his account. Even before he reached out to the company, Bittrex, he said, should have realized from the pattern of abnormal activity around his account that its security had been compromised.
DFI’s new finding of no-fault, he said, “doesn’t affect anything I do.”