Recovery of solved bitcoin sent to exchanges – Bitcoin Magazine
This is an opinion editorial by Matthew Green and Brian Mondoh, contributors for Bitcoin Magazine.
With all cryptocurrencies available, including anonymity-designed bytecoin, monero and zcash, ransom attackers continue to demand bitcoin, and some reports show that darknet markets are fueled by bitcoin transactions (see pages 54 and 109 of the Chainalysis 2022 Crypto Crime Report). Apparently, bitcoin remains one of the most valuable assets for criminals using blockchain technology given its relative stability, price and relevance.
Similarly, in many cases, where other cryptocurrencies have been stolen, obscured or paid as part of a scam, funds are transferred to bitcoin and then withdrawn as fiat. In August 2021, Liquid Exchange announced that 67 different ERC-20 tokens, along with large amounts of ether and bitcoin, had been moved by a party working on behalf of the Democratic People’s Republic of Korea. The attacker exchanged a variety of tokens, including ERC-20 tokens, for ether and then bitcoin before withdrawing money. As a result, approximately $91.35 million was laundered. Similar transfers were made in the May 2021 Spartan Protocol hack where the attacker was able to steal approximately $30 million from the project.
While large-scale attacks worth hundreds of millions of dollars are investigated by government agencies designed to combat criminal activity, similar values of bitcoin are extracted from people and businesses every day. Systems are now in place to allow individuals, including corporate entities, to trace their assets (and their proceeds) and use the legal system to make them whole.
This approach has been practiced routinely in the English legal system and is on the rise in other common law jurisdictions, which rely on precedents to match victims back with their money. Below is a summary of the legal and practical journey of how this has come about.
When Bitcoin Became Property
In England, prior to December 2019, the question of whether cryptocurrencies were property under the law remained unsettled. Common law dictates that property is either something that can be owned or enforced by an action (like a debt), and the law had difficulty categorizing bitcoin in this way. A “legal statement on cryptoassets and smart contracts” prepared by the UK Jurisdiction Taskforce (UKJT) just a month before noted “cryptoassets have all the indicia of property,” the first sign of bitcoin’s recognition as property.
The issue was finally dealt with in court in December 2019 (see: AA v Persons Unknown & Ors, Re Bitcoin). A Canadian hospital fell victim to a malware attack, ransom was demanded in bitcoin and London insurance company paid. Payment of the ransom led to the recovery of the hospital’s data and access to the systems. However, the insurance company attempted to trace and recover that ransom given the flow of transactions could be seen on the blockchain. The insurance company then instructed a blockchain analytics firm to help track the ransom proceeds, which ended up on Bitfinex, an exchange listed in the British Virgin Islands.
Knowing this, the insurer applied to the High Court in England for interim relief to freeze the funds, to freeze the worldwide assets of the individuals who controlled the deposit address with Bitfinex and for disclosure orders. It is worth nothing that the identity of the person checking the address in question was not known, so more information was required before the insurer could proceed.
To achieve these reliefs, the court had to decide whether bitcoin was property, and the judge noted in the ruling that “I am satisfied for the purpose of granting an interim injunction in the form of an interim proprietary injunction that cryptocurrencies are a form of property that can be subject to a proprietary injunction.”
As a result, bitcoin and cryptocurrencies in general can be treated as “property” like any other asset, and (theoretically) frozen, transferred and handled like other property such as a car, house or fiat money.
Why is this important?
The The “AA v Persons Unknown” case saw the first proprietary injunction over bitcoin. This means that the bitcoin paid – or its traceable earnings, in this case those found at Bitfinex – were frozen and subject to the decision of the English High Courts. The insurance company now had its bitcoin ring-fenced. The insurance company’s application therefore resulted in the freezing of these funds, the identity, including know-your-customer documents held by Bitfinex of the person controlling the deposit address, and a worldwide freezing order on their assets.
Now there was a precedent for tracking, freezing and recovering bitcoin, available to private individuals who could use the courts to exercise their rights as a victim of fraud. Importantly, the goal is to trace and chase the funds, not necessarily the party who committed the fraud in the first place, although the holder of the deposit address and the initial criminals are usually linked, proven by blockchain analysis, open source intelligence or law enforcement. It is always worth informing the authorities of any crime that has been committed anyway.
There are now a number of cases in England, the US and Singapore where bitcoin and other cryptocurrencies have been frozen to aid recovery, including the enforcement of third-party debt orders, which force an exchange to transfer funds from an address to the victim.
Challenges to consider
Despite an increasing number of recoveries, it is worth turning to certain obstacles.
Firstly, there are commercial considerations, such as how much was lost and whether it is worth instructing investigators and lawyers. Experts are not always cheap, and if the sum lost is nominal, it may not be worth pursuing. Second, what jurisdiction is relevant? To take England as an example, if either the victim is domiciled there, the fraudster has been connected or if the fraud occurred in England, then usually English courts will have jurisdiction to consider these cases. Without one of these, the victim may have to pursue their case in another, more relevant territory.
Next is to review the trace report, which shows the flow of funds, from the time they left the victim or relevant account, to where they are now. Consider where the funds have gone, if they reached an exchange at this time (live tracking is usually available) and if so which exchange. From experience, and using England again as an example, exchanges want to be seen as doing the right thing by complying with English court orders, and the risk of breaching them and subsequent negative press is a strong factor. In that connection, in order to obtain the key information from the stock exchanges, it is necessary to make applications to these stock exchanges, and it is important to consider what should be pursued.
Once the assets have been frozen, the next steps depend on who controls the address of the funds. They might want a quick deal, can’t answer at all or might want to sue, although usually people associated with criminal activities don’t want their business perpetuated in court papers.
In the event that the court agrees that the assets belong to the victims and orders them to be transferred, the victims must consider enforcement, i.e. how to get the money back. Third-party debt orders force exchanges to transfer assets, but where this is not available, other tactics come into play and vary depending on the circumstances. There may be individuals who have been identified as additional address holders, alleged officers of the fraud company or otherwise, and insolvency proceedings may be brought against them, particularly where conspiracy and joint and several liability are available. However, settlement, on the basis that they have responded, is always preferable for all parties involved.
Restorations in various fields
While stories of decentralized exchange hacks worth hundreds of millions of dollars make headlines, it must be remembered that individuals falling victim to romance scams, insurance companies paying ransoms, fraud victims in general, and insolvency proceedings involving digital funds, there are ways to investigate and recover bitcoin. and other blockchain-based assets.
Importantly, where victims can band together to create a group suitable for a class action, litigation may be available and the costs of the process shared. It can also result in mass recovery, helping those who have only lost a little.
Separately, insurance companies, which continue to pay ransoms in bitcoin on behalf of their customers, may be able to recover those ransoms and break the payment cycle, fueling the continuation of the ransomware industry. Insurance companies can be the solution by fulfilling the contract with the client and depriving the criminals of the ransom.
There are endless applications for recovery, including bitcoin where appropriate, and as common law precedents continue to mount, best practice measures will continue to evolve. The UK continues to recognize the value of fast and effective remedies for asset recovery and on 22 April 2021 the UKJT published the “Digital Dispute Resolution Rules”, which seek to facilitate speedy and cost-effective resolution of digital asset and blockchain commercial disputes. In summary, the UK takes disputes involving blockchain seriously and the inherent flexibility of common law jurisdictions continues to focus on helping victims and recovering ill-gotten gains.
This is a guest post by Matthew Green and Brian Mondoh. Opinions expressed are entirely their own and do not necessarily reflect the opinions of BTC Inc. or Bitcoin Magazine.
