Hackers steal $14.2M from Alberta-based bank, sparking court battle with B.C. crypto firm

A brazen cyber-heist of $14.2 million has sparked a bizarre court battle between one of Canada's largest banks and one of the country's biggest cryptocurrency services business.

Nearly three months after hackers wired millions out of Canadian Western Bank's accounts payable system, a B.C. Supreme Court judge unfroze accounts this week belonging to Aquanow — the Vancouver-based digital platform the thieves used to convert the money into Bitcoin.

The ruling comes after unusual and highly secretive proceedings which Canadian Western's lawyer argued at one point would be best kept from public view to ensure "these types of frauds are not accessible so as not to inspire others to try and commit similar acts."

Meanwhile, the Ottawa man whose name is on a National Bank account the fraudsters used to move the cash says he can't understand why the first he's hearing about it is from the CBC.

"It's kind of weird that you are the first person to contact me," said the 24-year-old, who the CBC has agreed not to name for fear his employment or safety could be compromised.

The man said he was "shocked."

"No bank or anything," he said. "And you're mostly doing this for your story, so imagine if you didn't tell me, I would have just went along with my life without knowing."

A 'third-party threat actor'

According to court documents, the money was transferred on Jan. 23 from an account Canadian Western's finance department uses for its accounts payable into the National Bank account bearing the 24-year-old man's name.

"The mechanism of the scheme appears to be an account takeover fraud in which the third-party threat actor gained access to account holder credentials for the platform," Canadian Western's lawyer wrote in an application.

"The scheme, as perpetrated by the third-party threat actor, led to the transfer of at least $14,200,000 CAD funds from the CWB funds."

Court documents say the $14.2 million was converted into Bitcoin and has since vanished into an external wallet. (Benoit Tessier/Reuters)

According to the documents, the thieves also attempted a third, unsuccessful transfer of an additional $7.8 million — but it didn't go through.

The bank identified the unauthorized transactions two days after they happened. But by then, it was too late. The money had already been transferred to an Alberta credit union account in the name of CLTS Technologies — the trade name for Aquanow.

The court documents revealed that the fraudsters then used their Aquanow account to trade stolen funds for cybercurrencies Bitcoin and Ethereum, quickly moving the Bitcoin from a wallet on the digital platform to an external wallet — and into the ether.

But the court fight was just beginning — as Canadian Western Bank sought to recover its money by targeting accounts Aquanow held at BMO for large wire transfers and foreign exchange.

'Deserving of reproof or rebuke'

The bank got a so-called "ex parte" order — a legal term for a proceeding where the interests of only one party are represented — freezing accounts containing millions of dollars.

Aquanow claimed the order "caused massive disruptions to Aquanow's business and harm to its reputation."

The interior of a B.C. Supreme Court courtroom. The sealed order was issued without notice to Aquanow in secretive proceedings. (Ben Nelms/CBC)

Compounding matters, the order itself was sealed, and BMO was ordered not to disclose the reasons, which meant Aquanow had to go to court just to learn why its business had been thrown into chaos and who was responsible.

In filings to set aside the sealing order, a lawyer for Aquanow called the circumstances "extraordinary," describing the freezing order as "a secret order — relief which is simply unavailable in a civil proceeding."

In a ruling setting aside the order this week, B.C. Supreme Court Justice Linda Loo faulted Canadian Western Bank for leaving the court with the impression Aquanow might have been part of the fraud.

She said the bank's lawyer should have told the court "Aquanow was a money services business which legitimately had large sums moving into and out of its accounts on a daily basis."

The judge also said "while the alleged fraudster may have transferred the CWB Funds to an Aquanow account, there was no evidence that Aquanow was complicit in the fraud."

Loo said the freezing order was obtained "improperly." She also said damages were warranted: "The degree and extent of the carelessness are deserving of reproof or rebuke."

'It's a really big amount of money'

In a statement to CBC, Canadian Western Bank said the bank was "disappointed" with Loo's decision, "especially given our belief that we took reasonable and necessary steps in an effort to preserve and recover funds stolen by sophisticated fraudsters."

According to the court documents, Aquanow informed the Financial Transactions and Reports Analysis Centre of Canada about the suspicious transactions — but the company says it has not been contacted by law enforcement.

The money was transferred from Canadian Western Bank to a National Bank account in the full name of an Ottawa man who said no one contacted him to warn him that something suspicious had occurred. (Michael Wilson/CBC)

Canadian Western Bank did not confirm whether the theft has been reported to police.

The only person named in the court documents — apart from the lawyers — is the 24-year-old whose correctly-spelled first, middle and last names were on the National Bank account used as a first landing spot for the $14.2 million.

He told the CBC he once had an account with the bank, but the balance hasn't changed and the numbers did not appear to match those in the court documents, leading him to worry someone might have opened an account in his name.

"It was pretty confusing because it's a really big amount of money," he said.

"I just need to find out how do I proceed with my own investigation — if it's related to me or not because nobody has reached out to me specifically."

The man works for the Correctional Service of Canada — but not in a role that sees him interacting with prisoners.

He said he has heard of other people with the same first name, and the same last name. But he wonders about the chances of someone having the same middle name as well.

"That's why it's pretty concerning, because that's my full name and I doubt there's other people with my full name," he said.

A spokesperson for National Bank said they would not comment while legal proceedings are underway and Canadian Western Bank said "CWB is not in position to comment on the clients or accounts of another financial institution."