Just a few days ago, Crowd Machine was working to build a crypto replacement for Amazon Web Services. Today, it is facing questions about its survival.

On Saturday, according to a post by the Crowd Machine team, a hacker compromised the company’s cryptocurrency wallet and stole a large number of the application’s native Crowd Machine Compute Tokens (CMCT). Digging further, according to Etherscan, the thief appears to have made off with over 1 billion CMCT, most of which were then transferred to exchanges.

The price of the tokens fell steeply following the incident, dropping by 87 percent on Saturday to a low of around $0.0019, according to CoinMarketCap data.

“We are working to resolve this issue as fast as we can,” the Crowd Machine team wrote Sunday, adding:

“Because this matter is currently under criminal investigation, we are unable to make any further comments at this time.”

Admins posted a similar message to the project’s Telegram channel.

Who is Crowd Machine?

Crowd Machine attracted attention after two developers from Blockstream, one of the most prominent cryptocurrency startups, left to join the project in February this year.

One of those, Ben Gorlick, became CTO, though according to his LinkedIn page he left Crowd Machine in May. The second, Johnny Dilley became chief of system architecture for the new company, although now his LinkedIn page does not list Crowd Machine and the company’s sitedoes not include him as a team member.

Saeed Al Darmaki, a former advisor to the project who quit this month because – he alleged – Crowd Machine did not pay him the token compensation he was promised, told CoinDesk that “poor management” by CEO Craig Sproule had prompted employees to leave. He declined to identify the employees to whom he was referring.

Crowd Machine’s goal is to build a globally distributed cloud, a sort of Amazon Web Services that would not be subject to the control of a single company or suffer from a single point of failure. According to the company’s website, this “Crowd Computer” is scheduled to be released in the fourth quarter.

Crowd Machine conducted a pre-sale of CMCT tokens in April, but has not continued with its planned series of 390 daily public sales.

Few details have been provided about the situation. And in the absence of further updates, speculation has swirled, including unsubstantiated allegations that the thefts were an inside job.

What we know

The stolen coins have been dumped onto two exchanges so far: Idex and Bittrex.

On Saturday, Idex announced on Twitter that it was de-listing CMCT following reports of “suspicious activity.” At the time of writing, Bittrex had also suspended CMCT trading.

Sproule told CoinDesk in an email on Tuesday that the team had requested these trading freezes (Idex previously said they’d been in contact with Crowd Machine).

Sproule added that a law enforcement investigation was underway and an “arrest has been made.” Though he did not say who had been arrested and declined to specify what law enforcement agencies were involved in the investigation, saying the agencies in question had asked him not to reveal their identity.

As some pointed out on Crowd Machine’s Telegram, Bittrex requires users to upload identification, which may have allowed the authorities to make an arrest so quickly.

In an update on Medium, Sproule recommended that no one trade the tokens until the authorities had finished their investigation, though he wrote that “purchases of stolen tokens by those not involved with the theft will be honored.”

Speaking to CoinDesk, he offered reassurance to the community:

“Assets are currently being recovered.”