Information orders granted against cryptocurrency exchanges to help trace stolen cryptocurrency

In a further decision demonstrating the English court's ability to apply the law flexibly to novel issues arising in relation to crypto assets, the High Court has granted information orders against various foreign cryptocurrency exchanges requiring the provision of information and documentation to help identify those who hold accounts into which stolen cryptocurrency was allegedly transferred, and what had since become of the cryptocurrency: LMN v Bitflyer Holdings Inc [2022] EWHC 2954 (Comm).

This is another in a string of decisions in which the English court has been prepared to treat cryptocurrency as a form of property, and to make orders aimed at assisting the recovery of stolen cryptocurrency.

The decision is also of interest as one of the first cases in which the court has granted permission to serve proceedings out of the jurisdiction under the new gateway for information orders, which was introduced in October this year in order to facilitate the making of Norwich Pharmacal and Bankers Trust applications against defendants overseas. It applies where there is an application for disclosure in order to obtain information regarding the true identity of a potential defendant and/or what has become of the claimant's property, with a view to issuing proceedings that are intended to be commenced in England and Wales.

Herbert Smith Freehills acts for one of the cryptocurrency exchange defendants to the application.

Background

The claimant is a company incorporated in England and Wales which operates a cryptocurrency exchange. Some two years ago, it was the victim of a cyber attack in which hackers transferred from its "hot wallets" millions of dollars-worth of cryptocurrency. The claimant sought help from UK regulatory and law enforcement agencies, but this did not result in the recovery of the funds, and so it instructed solicitors to pursue a civil action.

The claimant instructed an expert who traced the cryptocurrency to a number of "exchange addresses", ie addresses owned and operated by cryptocurrency exchanges. The claimant's evidence was that it was impossible to trace the cryptocurrency any further without information from the exchanges about the individuals behind the relevant transactions.

The claimant therefore brought proceedings seeking information orders against six cryptocurrency exchanges identified by the expert, under the court's Norwich Pharmacal or Bankers Trust jurisdictions. In essence, for any customer account to which the relevant cryptocurrency had been allocated, the orders would require the exchanges to provide the name the account was held in and any information or documents likely to identify the account holder, as well as information relating to what had since become of the cryptocurrency.

The claimant was unable to identify which legal entity within the group of companies that operated each exchange was responsible for the particular transactions (as many exchanges use different companies to contract in different jurisdictions), and so it issued the application against the "topco" for each exchange.

The claimant also applied for permission to serve the proceedings out of the jurisdiction on the various defendants and to serve by alternative means.

Decision

At a "without notice" hearing on 28 October 2022, the High Court (Butcher J) granted the applications for permission to serve out and to serve by alternative means, but declined to proceed with the application for substantive relief without notice being given to the defendants, in particular because: (a) the alleged fraud was not very recent; (b) the application was not made against the putative fraudsters; and (c) none of the defendants was alleged to have been in any way fraudulent.

At a further hearing, on notice, on 11 November 2022, Butcher J granted the orders for the provision of information and documentation but, as the proceedings had been served out of the jurisdiction and the deadline for the defendants to challenge the court's jurisdiction under CPR 11 had not yet passed, the dates for compliance were adjusted so as to fall after that deadline.

He later gave a written judgment providing his reasons for the various orders.

Service out of the jurisdiction 

The court applied the usual three-fold test for permission to serve out, as summarised in Altimo Holdings and Investment Ltd v Kyrgyz Mobil Tel Ltd [2011] UKPC 7, namely:

(1) Was there a serious issue to be tried on the merits? Butcher J was satisfied that there was, and indeed that the claimant had a good arguable case under the Bankers Trust jurisdiction. The judge noted five principles which have emerged from the authorities in relation to that jurisdiction:

• There must be good grounds for concluding that the money or assets about which information is sought belonged to the claimant. On this point, the judge concluded there was a good arguable case that whoever held the cryptocurrency or its traceable substitutes did so as a constructive trustee for the claimant. As part of the analysis, he said there was a good arguable case that cryptocurrencies are a form of property (supported by the legal analysis in the Legal Statement of the UK Jurisdiction Task Force, referred to and adopted by Bryan J in AA v Persons Unknown [2019] EWHC 3556 (Comm)). While his attention had been drawn to arguments that the transfer of Bitcoin on the blockchain may create a new asset in the hands of the acquirer, he considered there to be a good arguable case that the transfers could nevertheless be the subject of tracing, on the basis that there was a relevant substitution.
• There must be a real prospect that the information sought will lead to the location or preservation of the misappropriated assets. Here the judge was satisfied on this point, given the nature of the apparent fraud and of the information sought as to the identity of account holders and the destination of transfers.
• The order should not be wider than is necessary in the circumstances. The judge took this on board in formulating the terms of the order ultimately made (see below).
• The claimant's interests in obtaining the order must be balanced against the possible detriment to the respondent in complying with the order, including any potential infringement of rights of privacy or confidentiality. As to this, the judge said there was a clear benefit to the claimant in obtaining the information sought, and he was satisfied that the potential detriment to the defendants could be eliminated or at least very effectively mitigated by the undertakings given (see below), and the provision in the order that the defendants were not required to do anything that would contravene local law.
• The applicant must provide undertakings to pay the respondent's expenses in complying with the order, to compensate the respondent for any loss suffered as a result of the order, and only to use the documents or information obtained for the purpose of tracing the assets or their proceeds. Such undertakings were offered in the present case.

With regard to the Norwich Pharmacal jurisdiction, as there was no doubt that the defendants were "mixed up" in the fraud (in the sense of having facilitated the wrongdoing and being likely to be able to provide information necessary to enable the wrongdoer to be sued - which, the judge noted, does not require any fraud or wrongdoing on the part of those made subject to the order), the judge considered there to be a good arguable case that relief should be granted under this jurisdiction also.

(2) Was there a good arguable case that the claim fell within one of the "gateways" in CPR PD 6B para.3.1? Butcher J considered that there clearly was, namely the gateway at para 3.1(25) which was introduced in October this year and applies where a claim or application is made for disclosure in order to obtain information regarding: "(i) the true identity of a defendant or a potential defendant; and/or (ii) what has become of the property of a claimant or applicant"; and the claim or application is made for the purpose of proceedings which, subject to the content of the information received, are intended to be commenced in England.

(3) Was England and Wales the appropriate forum for the claim to be tried? Butcher J said England appeared to be the proper place for the action to be brought, as: the claimant was an English company; there were good grounds for considering the situs of the cryptocurrency to be in England; relevant documents were in England; and the law of England and Wales at least arguably governed the proprietary claim.

Service by alternative means

Butcher J noted that there must be "good reason" for permission to be granted for service by alternative means. Further, where defendants are located in countries that are party to the Hague Service Convention 1965 and have entered a reservation under Article 10 (objecting to direct service), there must be exceptional or special circumstances, ie a sufficiently good reason for such service notwithstanding the significance to be accorded to the reservation.

In this case Butcher J was satisfied that there was a good reason (and to the extent necessary, exceptional circumstances) due to the nature of the claim and the need for steps to be taken as soon as possible to seek to identify the relevant defendants and to preserve property. Although it could not be described as a case of "hot pursuit", given the length of time that had passed since the fraud, that was not the claimant's fault and did not mean that it was no longer important for there to be expedition. He therefore made orders for service by alternative means by email at a number of specified email addresses and in one case additionally by posting a link to the documents on the online contact form on the relevant defendant's website.

Substantive relief

As noted above, at the hearing on 11 November, Butcher J granted the orders sought for the provision of information and documentation. He considered that the claimant had a good claim to such relief, for the reasons referred to above in the context of the application for permission to serve out.

The judge noted a point made in correspondence by one of the defendant's solicitors, that there was an argument to the effect that the making of Bankers Trust orders against foreign defendants constitutes an infringement of the sovereignty of a foreign jurisdiction and should only be made in exceptional circumstances, referring to Mackinnon v Donaldson, Lufkin & Jenrette Corp [1986] Ch 482.

However, the judge considered that this approach was not applicable in the present case, as it was not known where the relevant documents were located, and they could be within the jurisdiction. Furthermore, he commented, "it may well be that the location of the documents (which may be electronic) is of little significance. The court is faced with the novel challenges of fraud in relation to cryptocurrency transactions, and an approach adopted in relation to banks in 1985 does not seem to me to be apposite." In any event, as recognised in Mackinnon, such orders might be made in exceptional circumstances, and exceptional circumstances have been found where crime and fraud were involved.

In relation to certain defendants, however, an issue was raised that the "topco" named in the application was not (or, in cases where the defendant did not respond to the application, might not be) the entity which held the information sought. To address this issue, the court added as further defendants the "Persons Unknown" who owned and/or operated the relevant exchanges.