All is not (necessarily) lost: Crypto crime recovery
With over 2 million people in the UK now holding and using cryptocurrency, and the Chancellor announcing that a government backed non-fungible token ("NFT") is to be issued by the Royal Mint this summer, the market for crypto-assets is expected to continue to grow in the coming months and years; so much so that legislation is planned to implement a new regulatory regime for the crypto market.
This article was originally published in Fraud Intelligence
Within this crypto landscape, there can be no doubt that the increased use of cryptocurrency continues to give rise to a heightened risk of fraud. The expanding scope and volume of crypto-crime now taking place against individuals, investors and businesses, continues to grow. Accordingly, pursuing perpetrators of crypto-crime, by victims and the authorities, has now become widespread. Global law enforcement headlines regularly refer to the millions of pounds and dollars worth of cryptocurrency and crypto assets being seized and forfeited.
Legal tools for recovering crypto-assets
Cryptocurrency crime victims can turn to legal processes in both the civil and criminal courts to recover lost assets. Both pathways require legal, investigative and technical expertise, and can be highly effective as recent cases have shown.
Civil asset recovery
The first stage is to trace the stolen property and it is imperative that this is done quickly due to the ability to rapidly transact and move cryptocurrencies. While the public nature of blockchain means that the transactions and transfers themselves are traceable, the anonymous nature of cryptocurrency transactions, can make it difficult to identify the perpetrators of fraud and the identities of those persons holding the cryptocurrency in order to bring a claim. However, Norwich Pharmacal orders and Bankers Trust orders can compel information to be disclosed by third parties (e.g. crypto-currency exchanges), who are likely to hold information which can identify perpetrators and holders of assets which have been stolen.
The Bankers Trust order test for relief was summarised in Ion Science v Persons Unknown unreported, Commercial Court, 21 December 2020 and includes establishing “that there is a real prospect that the information sought will lead to the location or preservation of those assets”. Ion believed that they had been the victims of an Initial Coin Offering (“ICO”) fraud during which some 64.35 bitcoin (£577,002) was transferred, through the Binance and Kraken exchanges, to individuals said to be linked to a Swiss company called ‘NeoCapital’. The court accepted, that without a Bankers Trust order being made, the true identity of the individuals alleged to be involved in the fraud may never be known, and an effective remedy impossible to obtain.
In Fetch.ai Ltd v Persons Unknown [2021] EWHC 2254 (Comm), Persons Unknown were said to have hacked accounts maintained by Fetch.ai on the Binance Exchange and then traded the cryptocurrencies to third party accounts (presumably linked to those perpetrating the fraud) at an undervalue resulting in a loss to Fetch.ai in excess of US$2.6 million. The court, following Ion Science, made both a Bankers Trust order and a Norwich Pharmacal order.
Ion and Fetch.ai provide a strong legal foundation for tracing and recovering the assets of those who suffer a loss of their cryptocurrency.
As well as tracing the stolen assets it is important, due to the easily transmissible nature of cryptocurrency, to obtain worldwide freezing orders and in appropriate cases to obtain asset prevention orders and injunctions to protect the asset. Fundamental to the civil pathway to recovery has been the question as to whether crypto-assets are 'property', as they are arguably neither choses in possession, because they are virtual and cannot be physically possessed; nor are they choses in action, because they do not embody any right capable of being enforced by action. However, in AA v Persons Unknown [2020] 4 WLR 35 the court was required to address this issue. A Canadian insurance company suffered a ransomware attack in which hackers demanded $1,200,000 be paid to them in Bitcoin. The victim paid the ransom, and the British reinsurer of the company brought a claim against multiple defendants, including persons unknown who had committed the attack and those who held or controlled the Bitcoin, as well as two companies linked to the Bitfinex exchange through which the Bitcoin was transferred.
The claimant sought a Bankers Trust order and/or a Norwich Pharmacal order requiring the companies operating the Bitfinex exchange to provide specified information about a crypto currency account owned or controlled by persons unknown, and freezing and proprietary injunctions in respect of Bitcoin held at the specified accounts of the exchanges.
The High Court Judge (Mr Justice Bryan) decided that ‘… a crypto asset might not be a thing in action on a narrow definition of that term, but that does not mean that it cannot be treated as property. Essentially, and for the reasons identified in [the UK Jurisdiction Task Force Legal statement on crypto assets and smart contracts], I consider that crypto assets such as Bitcoin are property. They meet the four criteria set out in Lord Wilberforce’s classic definition of property in National Provincial Bank v Ainsworth [1965] AC 1175 as being definable, identifiable by third parties, capable in their nature of assumption by third parties, and having some degree of permanence … I am satisfied for the purpose of granting an interim injunction in the form of an interim proprietary injunction that crypto currencies are a form of property capable of being the subject of a proprietary injunction’. [Emphasis added]
The principle in AA was extended in Lavinia Deborah Osbourne v (1) Persons Unknown (2) Ozone Networks Inc t/a Opensea where the High Court held that NFTs were also property which could be subject to a freezing order (the judgment is yet to be published).
Following the investigation and preservation of the assets, a case must then be built by the legal and investigative teams to enable the arrest and prosecution of the suspect.
Recovery following criminal proceedings
An alternative to the civil proceedings route may be the recovery of crypto-assets following a criminal prosecution. Where criminal proceedings are commenced or in contemplation, it is possible for the prosecutor to apply for crypto-assets to be seized and held by the prosecutor, which, if conducted by a government prosecutor is usually in a government controlled wallet pending the conclusion of criminal proceedings.
The criminal law has and will facilitate such prosecutions using the Theft Act 1968, the Proceeds of Crime Act 2002, and the Fraud Act 2006, all of which define property as including things in action ‘and other intangible property’, incorporating part of the UKJT’s reasoning which was adopted by Bryan J in AA. For obvious policy reasons, there is a reluctance to allow crypto-assets to fall out with the ambit of the criminal law, a sentiment recently reiterated in the Court of Appeal in R v Hunter [2022] 1 Cr App R 13 at [98]. In light of the foregoing, it is clear that cryptocurrency frauds and thefts will fall within the existing remit of criminal legislation and prosecuting agencies and private prosecutors can pursue those who commit such crimes, as they would any other.
Given the highly specialized nature of cryptocurrency and crypto-assets, those affected may wish to instigate a private prosecution using their own bespoke prosecution team who understand the intricacies and nuances of the sector; providing a more cost effective and possibly quicker route to recovery, than civil proceedings. In this way, private prosecutions can deter bad actors from interfering with legitimate activity or possessions.
Crucially, the criminal courts have broad powers to restrain assets and prevent their dissipation.
While it has not yet been tested in the courts, if there is UK jurisdiction and a criminal investigation is being pursued with a view to a private prosecution, crypto-assets held by a UK regulated exchange may also be restrained for the purpose of preservation for later confiscation on the application of a prosecutor by way of an order made under section 41 of the Proceeds of Crime Act 2002 (which the courts have confirmed includes private prosecutors (R v Zinga [2014] EWCA Crim 52).
And, once a conviction is secured, the criminal courts have considerable tools to order compensation or restitution of crypto-assets in favour of victims; including imposing a custodial sentence if the defendant fails to pay a confiscation order.
Private prosecutors may also instigate confiscation proceedings under the Proceeds of Crime Act 2002, to remove from defendants any benefit obtained from their criminal conduct.
Practical steps in the recovery of assets
It is inevitable that victims will weigh up the pros and cons of instigating an investigation and litigation (whether civil or criminal), against the amount lost. Of course, the financial cost of recovery against the chance of recovery is an important factor; but the swiftness with which crypto assets can be dissipated should not be underestimated. The speed of response to a financial scam is important, whichever recovery pathway is chosen.
Most recovery options require the investigation and analysis of complex blockchains to track and trace the stolen assets. Fraudsters use sophisticated methods to obfuscate and move stolen funds which require careful and expert analysis; the unravelling of which is essential to both proving and enforcing a claim.
A full investigation into what has taken place is required. This will involve traditional evidence gathering of witness statements from persons involved and documentary evidence, all of which puts the blockchain analysis into context.
Whilst the blockchain is anonymous, opportunities for investigation and recovery arise where the digital assets can be changed into normal fiat currency (i.e. GBP, Dollar, Euros) such as crypto exchanges (e.g. Coinbase, Binance, Kraken), Peer to Peer exchanges, and gambling websites. These third parties often hold key personal information, gathered as part of their money laundering obligations or Know Your Client (KYC) procedures, which can help with identification of those responsible for the fraud.
Once suspect details are identified, then crypto-assets can be traced into properties, companies, cars, boats, and other enforceable assets.
Conclusion
Whilst initially litigants faced conceptual legal hurdles with regard to recovering their stolen crypto-assets, the law has quickly caught up with the rapidly changing landscape and victims of crypto-crimes can be reassured that they have a range of options for recovery.
This article was authored by Michael Goodwin QC and Tom Davies of RLC with Adam Craggs and Alice Kemp at RPC