A payroll executive exploited security gaps to steal $5.7 million from Bybit, funding a lavish lifestyle before her downfall. How did she get away with it for months?
A Singapore court has sentenced former payroll executive Ho Kai Xin to nine years and 11 months in prison after she was found guilty of defrauding crypto exchange Bybit of $5.7 million.
Ho, who manipulated payroll records while working at WeChain, a firm that handled Bybit’s employee salaries, siphoned funds into her own crypto wallets and spent lavishly on luxury goods, real estate, and high-end cars.
Her case stands as one of the largest crypto payroll frauds to date.
But how did she manage to pull it off and what does this case reveal about security loopholes in the industry?
How Ho Kai Xin Pulled Off the $5.7 Million Fraud
From May 2022 to October 2022, Ho exploited her role as a payroll manager at WeChain, which managed Bybit’s employee salaries.
Instead of transferring legitimate salary payments to Bybit’s 900 employees, Ho altered Microsoft Excel payroll files, redirecting millions in payments to four cryptocurrency wallets she personally controlled.
She reportedly funneled a total of $4.2 million into these wallets, later converting the stolen funds into fiat currencies.
With the money, she went on a luxury spending spree, which included:
- A $750,000 deposit for a $3.7 million penthouse
- Designer items from Louis Vuitton, including bags, rings, shoes, and shirts
- A Mercedes-Benz car
But Ho wasn’t just skimming from the top, she systematically drained Bybit’s funds, using payroll fraud as a sophisticated method of crypto theft.
Bybit’s Recovery Efforts and the Legal Fallout
While Ho laundered over $4.3 million, authorities managed to recover more than $1.1 million worth of Tether (USDT) from her crypto wallets, along with $140,000 from her bank account.
Police also seized over $330,000 worth of assets, including the Mercedes-Benz.
However, Bybit is still out millions, as Ho has made no offers to repay the remaining amount.
In February 2023, WeChain reported Ho’s misconduct to local authorities, leading to her arrest two months later.
Ho’s Defense: Blaming a Nonexistent Cousin
When confronted by investigators, Ho initially attempted to mislead authorities, claiming that a cousin named “Jason Teo” was responsible for the fraudulent transactions.
However, investigators later discovered that Teo did not exist, adding false information to a public servant to her long list of charges.
In total, she faced 44 charges, including:
- Five counts of cheating
- Eight counts of dealing with the benefits of criminal conduct
- Providing false information to authorities
Her nine-year, 11-month prison sentence will begin after she completes a separate six-week contempt of court sentence, which she received for spending stolen funds despite a court order prohibiting her from doing so.
Defense vs. Prosecution – Was the Sentence Too Harsh?
Ho’s lawyer, James Gomez, pleaded for a reduced sentence of eight years and eight months, arguing that she:
- Had two young children who would be impacted by her imprisonment
- Showed remorse and reflection on the consequences of her actions
- Experienced a “lapse in judgment” rather than premeditated intent
However, prosecutors pushed for a harsher penalty, stating that Ho’s actions were not a one-time mistake but rather a calculated scheme spanning months.
“When her actions went undetected, the accused became emboldened, going on a cheating spree to drain her client company, Bybit, of its monies,” prosecutors told the court.
What This Means for Crypto Security and Fraud Prevention
Ho’s case is a glaring reminder of the security vulnerabilities in payroll systems—particularly when handling crypto transactions.
Key takeaways for exchanges and crypto firms:
- Internal controls matter: Had Bybit or WeChain implemented real-time payroll auditing or multi-signature verification, the fraud could have been detected earlier.
- Crypto tracking needs improvement: While authorities recovered some of the stolen funds, tracking and reclaiming illicit crypto transactions remains a major challenge.
- Stronger regulatory oversight may be coming: Cases like this increase pressure on regulators to tighten compliance measures for crypto exchanges handling payroll and treasury management.
What Happens Next?
Ho’s sentencing sends a strong warning to employees handling crypto funds, but will it be enough to deter future fraud?
With crypto exchanges increasingly integrating payroll and financial services, security measures need to evolve beyond traditional fraud detection methods.
For crypto firms, this case is a wake-up call: without stronger oversight and fraud detection, payroll scams could become the next major security risk in the industry.
