news

Dig­i­tal assets have arrived and are here to stay. On-chain assets such as cryp­tocur­ren­cies and Non-Fun­gi­ble Tokens (‘NFTs’) have quick­ly become a dis­cernible and pop­u­lar invest­ment cat­e­go­ry. Both are sus­cep­ti­ble to hack­ing. As dig­i­tal assets pro­lif­er­ate, we have seen a cor­re­spond­ing growth in their misappropriation.

Accord­ing to research per­formed by blockchain data plat­form Chainal­y­sis, it is esti­mat­ed that 2022 was the worst year yet for the hack­ing of cryp­toas­sets, with approx­i­mate­ly $3.8 bil­lion worth of cryp­tocur­ren­cy stolen world­wide. That is the report­ed fig­ure. The real fig­ure could be sig­nif­i­cant­ly high­er. In this arti­cle, we take a look at how the mar­ket and the law in the UK are devel­op­ing to help the vic­tims of fraud to pro­tect and trace their dig­i­tal assets.

Pre­ven­tion is bet­ter than cure

Recov­er­ing stolen dig­i­tal assets, or obtain­ing com­pen­sa­tion, is fraught with dif­fi­cul­ty. As such, tak­ing steps to pre­vent infil­tra­tion and expro­pri­a­tion is cru­cial­ly impor­tant. In par­tic­u­lar, pri­vate key details should be care­ful­ly pro­tect­ed. Dig­i­tal assets can be stored in ​‘cold’ stor­age wal­lets (which are not con­nect­ed to the inter­net) or, alter­na­tive­ly, in a hard­ware wal­let that has an encrypt­ed pri­vate key. These meth­ods offer a trade-off between max­i­miz­ing secu­ri­ty on the one hand and hin­der­ing the ease with which own­ers can deploy their assets should they wish to do so on the other.

There are ser­vice providers based in the UK ded­i­cat­ed to safe­guard­ing data for the pur­pose of dig­i­tal asset recov­ery. Nemean Ser­vices, for instance, oper­ates its RaaS (recov­ery as a ser­vice) for insti­tu­tion­al investors in cryp­tocur­ren­cy, typ­i­cal­ly act­ing as a trust­ed third par­ty for clients along­side their choice of cryp­to cus­to­di­an, plac­ing pri­vate keys or shards in cold stor­age and pro­vid­ing reg­u­lar audits and data integri­ty checks.

If quick deal­ing is desir­able then it may be prefer­able to keep the asset on an exchange. If pri­vate keys or dig­i­tal assets are to be kept on an exchange, how­ev­er, care­ful due dili­gence should be per­formed in respect of the secu­ri­ty fea­tures of the exchange. Terms and con­di­tions should be checked to estab­lish what rights of redress there may be if breach­es of secu­ri­ty occur.

If the worst hap­pens, recent court deci­sions have shown that in order to take effec­tive steps towards recov­ery, it is cru­cial for vic­tims to act quickly.

Fraud exam­ple

How an indi­vid­ual or insti­tu­tion may be affect­ed by dig­i­tal asset fraud is per­haps best illus­trat­ed by a fic­ti­tious exam­ple. John, who lives in Eng­land, owns an NFT of a piece of art, which he holds in a dig­i­tal wal­let on a peer-to-peer NFT mar­ket­place. A fraud­ster hacks into John’s wal­let and removes his NFT, trans­fer­ring it to his own wal­let. When John next checks his wal­let, he dis­cov­ers his NFT is gone.

What should John do? He should imme­di­ate­ly instruct lawyers and dig­i­tal forensic/​tracing experts. Such experts have the skills and soft­ware that pro­vide the great­est chance of locat­ing the NFT and build­ing the case against the fraudster(s). On the face of it, blockchain tech­nol­o­gy aids this process by pro­vid­ing an immutable, pub­lic record of all trans­ac­tions. The gen­er­al rule with cryp­tocur­ren­cies or oth­er dig­i­tal assets, as with tra­di­tion­al trac­ing, is to ​‘fol­low the mon­ey’, link­ing trans­ac­tions and address­es to indi­vid­ual actors.

Trac­ing ser­vice providers

There are a num­ber of digital/​forensic trac­ing experts in the mar­ket. Mit­mark Intel­li­gence, for instance, spe­cialis­es in cor­po­rate intel­li­gence, cryp­to-asset recov­ery and infor­ma­tion risk assur­ance, focus­ing on legal and cryp­tocur­ren­cy work, with ser­vices rang­ing from fraud inves­ti­ga­tion to due-dili­gence vet­ting and the retrieval of dig­i­tal funds.

Use of a trac­ing report

If the trac­ing exer­cise results in the dis­cov­ery of a pub­lic key address which is host­ed by a third par­ty (typ­i­cal­ly an exchange), John can seek the Court’s assis­tance by apply­ing for a Bankers Trust Order (‘BTO’) or Nor­wich Phar­ma­cal Order (‘NPO’). Such orders (assum­ing com­pli­ance) would com­pel a third par­ty to pro­vide infor­ma­tion in order to fur­ther the process of iden­ti­fy­ing and pros­e­cut­ing a claim. For instance, exchanges typ­i­cal­ly have Know Your Cus­tomer (‘KYC’) infor­ma­tion and oth­er data from their clients to sat­is­fy Anti-Mon­ey Laun­der­ing (‘AML’) regulations.

A BTO or NPO might help ascer­tain who owns the wal­let in which John’s dig­i­tal assets are stored. If their iden­ti­ty can be reli­ably estab­lished, oth­er mea­sures such as a freez­ing injunc­tion may also be avail­able to pre­vent the sus­pect­ed fraud­sters from dis­si­pat­ing assets.

The aim of the BTO, NPO, freez­ing injunc­tions and oth­er pro­ce­dur­al reme­dies is to facil­i­tate the pur­suit of a civ­il claim for recov­ery of the stolen asset and/​or to obtain com­pen­sa­tion for its loss.

Court are assist­ing victims

Recent deci­sions illus­trate the Eng­lish courts’ com­mit­ment to assist­ing vic­tims of cryp­to-asset fraud and will­ing­ness to be prag­mat­ic and inno­v­a­tive. Ser­vice has, for exam­ple, been per­mit­ted (at times exclu­sive­ly) by NFT air­drop, and the courts have engaged sub­stan­tive­ly in pro­vid­ing reme­dies to vic­tims that are tai­lored very specif­i­cal­ly to fac­tu­al circumstances.

Courts have also made the legal find­ings nec­es­sary in order to make such reme­dies pos­si­ble (such as find­ing that dig­i­tal assets con­sti­tute prop­er­ty (AA v Per­sons Unknown [2019] EWHC 3556 (Comm)) and are capa­ble of being the sub­ject of a trust (Rus­coe v Cryp­topia Ltd (In Liq­ui­da­tion) [2020] NZHC 728). It remains to be seen, how­ev­er, how effec­tive these mea­sures ulti­mate­ly are.

The end of the beginning

Let us sup­pose that John has obtained a BTO. This results in the dis­clo­sure of key infor­ma­tion about the iden­ti­ty of those involved in the fraud. What then? We have reached the end of the begin­ning. John then has to assess whether it is in his inter­ests to pur­sue a civ­il claim: against whom? Where are they locat­ed? What are the costs? How long will it take? If he obtains a judg­ment, can he enforce it? Might he involve fun­ders and/​or insur­ers? Such ques­tions can be addressed anoth­er day in anoth­er article.

https://​www​.reuters​.com/​l​e​g​a​l​/​l​e​g​a​l​i​n​d​u​s​t​r​y​/​r​o​l​e​-​t​r​a​c​i​n​g​-​d​i​g​i​t​a​l​-​a​s​s​e​t​-​d​i​s​p​u​t​e​s​-2023 – 03-30/