In a story that will sound familiar to anybody who followed the collapse of Canadian crypto exchange Quadriga, two brothers who ran a South African crypto exchange have absconded with Bitcoin worth $3.6 billion stolen from their clients, demonstrating once again the one glaring security weakness: While hackers are believed to have brought down Mt. Gox, disillusioned insiders with the right kind of access can easily run off with a life-changing amount of wealth. And in many cases, clients who trusted the exchange to safeguard their assets will be left holding the bag.

Africrypt Chief Operating Officer Ameer Cajee, the older of the two brothers, reportedly informed clients back in April that the company had been the victim of a hack, but asked them to keep quiet, claiming that involving the authorities could “slow down the recovery” of the missing funds. However, the crime has since been reported to the Hawks, South Africa’s federal police in charge of disrupting organized criminal enterprises. Ameer Cajee started the company with his brother Raees in 2019 and initially it provided “bumper returns” for investors.

The Cajee brothers

But that didn’t last long. According to Bloomberg, investigators have apparently determined that the brothers likely absconded with some 69K digital tokens worth approximately $4 billion at the April peak.

Shortly after being informed of the “hack”, a group of clients brought in a law firm called Hanekom Attorneys, and a separate group started liquidation proceedings against Africrypt.

“We were immediately suspicious as the announcement implored investors not to take legal action,” Hanekom Attorneys said in response to emailed questions. “Africrypt employees lost access to the back-end platforms seven days before the alleged hack.”

The law firm’s investigation quickly revealed that the coins had been moved from the firm’s wallet by somebody who took the care to cover their tracks and make the coins untraceable.

The firm’s investigation found Africrypt’s pooled funds were transferred from its South African accounts and client wallets, and the coins went through tumblers and mixers — or to other large pools of bitcoin — to make them essentially untraceable.

Bloomberg made several attempts to contact the brothers, but their phone numbers appeared to have been shut off. The law firm involved says it has been unable to locate the brothers.

South Africa’s Finance Sector Conduct Authority is looking into the scam at Africrypt. However, it’s currently prohibited from launching a formal investigation because crypto assets are not legally considered financial products, according to the regulator’s head of enforcement, Brandon Topham.

This isn’t the first time a South African crypto exchange has turned out to be a scam. Last year, South African Bitcoin trading platform Mirror Trading International collapsed, and 23K coins went missing, totaling about $1.2 billion in what was called the biggest crypto scam of 2020, according to Bloomberg.

Crypto prices have been struggling lately thanks to a crackdown on mining by the Chinese government. While incidents like this will undoubtedly alarm regulators, for crypto traders, it’s just a reminder of the importance of keeping your coins somewhere safe.