High Court grants proprietary injunction against Bitcoin exchange holding proceeds of ransomware attack

The High Court has held that cryptoassets (in this case Bitcoin) can be treated as property under English law. As such, the owner of a cryptoasset can, in appropriate circumstances, avail itself of the various proprietary remedies that a court is able to grant.

The practical significance here was that an insurer that had paid a Bitcoin ransom on behalf of its insured was entitled to take action to recover the sum from Bitfinex (the cryptocurrency exchange holding the funds), compel Bitfinex to provide information identifying the individuals who had received the Bitcoin and for the funds to be held on a constructive trust: AA v Persons Unknown who demanded Bitcoin on 10^th and 11^th October 2019 and others [2019] EWHC 3556 (Comm).

This is not the first case in which the English court has taken the view that cryptoassets are (or are likely to be) property under English law, a conclusion which also has wider significance for cryptoasset owners and investors more generally. However, the decision is noteworthy for the considerable weight the court appeared to give the recent UK Jurisdictional Task Force (“UKJT”) Legal Statement on Cryptoassets and Smart Contracts (on which we previously commented here).

Also of interest in the case was the court’s willingness to hear the matter in private due in part to the court’s view that, in the circumstances, publicity would defeat the purpose of the hearing (because it would increase the risk that the Bitcoin would be moved on before any relief could be enforced).

Andrew Moir, Rachel Lidgate, Charlie Morgan and Martin Hevey consider the decision below.

Background

An un-named insurance company (the “Insurer”) applied for a proprietary injunction over a ransom amount paid in cryptoassets (Bitcoin) following the hacking of their insured’s computer systems (the "Affected Customer").  The hacker(s) demanded that the Affected Customer transfer $1,200,000 in Bitcoin to a specified account in order to regain access to their IT systems (which the hacker(s) had infected with malware and encrypted).  The Affected Customer was insured against certain cyber related incidents and the Insurer agreed to and did make payment of $950,000 worth of Bitcoin in ransom monies into the specified account, following which a decryption tool was provided to the Affected Company.

Subsequently, the Insurer took steps to identify the hackers and, in particular, to trace and recover the Bitcoins paid as ransom. Some of those Bitcoins had already been converted to fiat currency, but 96 of the total 109.25 Bitcoins paid had been transferred to a Bitcoin address that was linked to an account at the Bitfinex cryptoasset exchange.

The Insurer sought to recover the Bitcoin by issuing various proprietary claims. Given the high likelihood that the Bitcoin would be dissipated before a final judgment in the matter, the Insurer sought interim relief against the defendants (the controllers of the Bitfinex exchange and the unknown owners of the relevant account) seeking, amongst other things, proprietary injunctions to restrict the defendants’ ability to use/transfer the Bitcoin. In considering whether the Insurer was entitled to such injunctive relief, the court had to consider whether a cryptoasset can constitute property under English law.

Decision

The High Court (Bryan J) granted the relief sought, finding that cryptocurrencies are a form of property capable of being the subject of a proprietary injunction. In order to ensure that the injunction could be properly policed (and also to facilitate a subsequent court action against the individuals in receipt of the Bitcoin), the court also ordered the controllers of the Bitfinex exchange to provide information in relation to the identify and addresses of the hacker(s).

Bryan J referred to the decision in Colonial Bank v Whinney [1885] 30 ChD 261, which is often referred to as stating the traditional view as to what constitutes property under English law: that is, property can be only one of two kinds, “choses in possession” and “choses in action”. On that analysis, Bitcoin and other cryptocurrencies could not be classified as a form of property as they are not tangible (and therefore cannot be possessed) and cannot be choses in action as they do not embody any right capable of being enforced by action. However, Bryan J went on to consider the UKJT Legal Statement, saying that while it is not a statement of the law it is a “detailed”, “careful” and “compelling” consideration of the issue in question and one that the court should adopt.

Significantly, Bryan J considered that it was wrong to proceed on the basis that the English law of property recognises no form of property other than choses in possession and choses in action. In coming to this conclusion, he placed significant reliance on paragraphs 71-84 of the UKJT Legal Statement, which suggest that the Colonial Bank case should not be read to limit the scope of things that can be property in law. That passage concludes that, just because a cryptoasset might not be a thing in action on the narrow definition of that term, does not in itself mean that a cryptoasset cannot be treated as property.

Bryan J noted that cryptoassets satisfy the criteria set out in Lord Wilberforce’s classic definition of property in National Provisional Bank v Ainsworth [1965] 1AC 1175, given that they are: (i) definable (ii) identifiable by third parties, (iii) capable in their nature of assumption by third parties, and (iv) have some degree of permanence. Bryan J also referred to two previous English authorities where crypto currencies had been treated as property, though they did not consider the issue in depth: Liam David Robertson v Persons Unknown (unreported, 15 July 2019) and Vorotyntseva v Money-4 Limited [2018] EWHC 2598 (Ch).

The conclusion that cryptocurrencies can constitute property also seems to accord with common sense: given the Bitcoin in question had a real-world value of $950,000, were cryptocurrencies not to constitute property, there would have been profound consequences in many areas such as probate, financial services regulation and taxation.

Whilst noting the general rule that hearings be held in public, Bryan J was satisfied that CPR 39.2(3)(a) applied and that the hearing could therefore be held in private.  Specifically, publicity would defeat the object of the hearing, given that it may result in the dissipation of the Bitcoins or the risk of further cyber or revenge attacks. Bryan J also considered that CPR 39.2(3)(c) applied, given that he had been provided with confidential information that it was necessary for him to hear as part of the hearing and publicity would damage that confidentiality.

Following Warby J’s judgment in LJY v Persons Unknown [2018] EMLR 19, Bryan J also noted the importance in the context of blackmail and extortion that those who have suffered wrongs should not be put off approaching the court and that blackmail itself represents a misuse of free speech which means the interests of justice and freedom of expression are naturally tempered by the conduct in question.