David Lindsay

 

A Maltese hedge fund company is believed to have raked in US$24.5 million over the last five years through its participation in an international cyber-fraud securities trading ring in which hackers gave the company confidential earnings information for numerous publicly-traded companies, before the information was released to the public, from press releases it had stolen from at least two newswire services.

American investigators are alleging that Maltese company, Exante Ltd, then allegedly used that stolen information to trade securities and reap over US$100 million in unlawful profits. 

Out of that US$100 million, Exante Ltd, whose offices are located at the Portomaso Tower, is alleged to have made US$24.5 million in "ill-gotten gains" - accounting for close to a quarter of the entire worth of the scam, which American investigators are calling the biggest case of its kind ever prosecuted.

The hackers allegedly worked in concert with a network of traders, one of which was Exante, who paid the hackers for the stolen information - either through a flat fee or a percentage of the illicit profits gained from the illegal trading on the information.

A lawsuit filed by the US Security and Exchange Commission on Monday named the Maltese company as one of 15 that prematurely received company earnings reports from the international hacking ring between 2010 and 2015.  A further 17 individuals, mostly hackers, were also named as defendants.

Although based and incorporated in Malta, Exante's five directors are all Russian and Latvian nationals, while its €13.6 million shareholding is owned by Russian and Latvian individuals, as well as by companies based in the Cayman Islands and the British Virgin Islands.

According to a complaint filed by the SEC in the New Jersey District Court on Monday, Exante - which American investigators said "purports to be a Malta-based hedge fund" - holds proprietary trading accounts at Interactive Brokers and at Lek Securities, which were used in connection with the securities trading scam.  In all, American investigators say Exante itself raked in US$24.5 in "in ill-gotten gains" through trades over the platforms.

In its complaint, the SEC explains that several of Exante's directors are also owners of another co-defendant company, Global Hedge Capital Fund Ltd., and that the two entities share employees.

The SEC details how, "Exante and Global Hedge frequently made illicit trades in the same securities, on the same days and around the same time, and often through the same IP addresses."

Global Hedge Capital Fund Ltd, meanwhile, according to the SEC, "purports to be a Cayman Islands-based hedge fund with its principal place of business in Moscow, Russian Federation.

"Several of its owners are directors of Exante and the two entities share employees. Global Hedge has a proprietary trading account at Interactive Brokers. In connection with the fraudulent scheme, Global Hedge executed unlawful trades in that account resulting in over $3.8 million in ill-gotten gains, often in the same securities, on the same days and close to the same times, and often through the same IP addresses as Exante."

US authorities said that beginning in 2010 and continuing as recently as May, they gained access to more than 100,000 press releases that were about to be issued by Marketwired; PR Newswire in New York; and Business Wire of San Francisco. The press releases contained earnings figures and other corporate information.

The defendants then used roughly 800 of those news releases to make trades before the information came out, exploiting a time gap ranging from hours to three days, prosecutors said in their court filings.

 

How the scam worked:

1.                   The hackers stole the press releases and passed them to the traders in the window of time between when the press releases were uploaded to the newswire service's system and when the press releases were publicly issued. As a result, the trader defendants had an unfair trading advantage over other market participants because they knew the content of the press releases before that information was publicly announced.

2.                   The defendant traders capitalized on this advantage by initiating trades before the press releases were issued to the public. The defendant traders bought or sold securities depending on their anticipation of how the market would respond to the information in the stolen press releases.

3.                   The traders used deceptive means to conceal their access the stolen releases and make payments to the hackers. The traders also concealed their trading activities through use of multiple accounts and entities.

4.                   Then, after the press release was publicly issued, and the price of the securities changed as the market learned the previously undisclosed information, the defendant traders reaped enormous profits.

5.                   Collectively, the traders used this stolen information to realise over $100 million in illicit gains.

On information and belief, at least some of the defendants have continued to pursue this scheme at one or more newswire services. As recently as May 2015, some of the defendants traded in front of press releases issued from a third newswire service that had been hacked.