Lessons for crypto exchanges from the first full crypto fraud trial

08 October 2024

Fabrizio D’Aloia’s case against “persons unknown” has been making legal headlines for some time, with interim hearings addressing a number of new points of law. His claim proceeded to full trial earlier this year, and on 12 September 2024 judgment was handed down by the High Court (although not in Mr D’Aloia’s favour). 

What happened?

The case centred around Mr D’Aloia and his efforts to recover a large sum of the cryptocurrency, Tether (USDT), of which he says he was defrauded. Attempts were made to recover those sums from exchanges and allegations around the way in which those exchanges were operated were considered.

Mr D’Aloia was a successful businessman. In 2021 he was looking for investment opportunities to put to work the profits he had made through his enterprise. He opened an online trading account with a company called "td-finan” and began to transfer cryptocurrency to wallets associated with that account. 

Mr D’Aloia later found himself unable to withdraw his investments, and eventually came to realise that he was the victim of a scam and had been transferring his cryptocurrency into a sham trading account. He engaged both solicitors and a specialist to help trace his missing cryptocurrency, a large quantity of USDT worth around $2.5m. The specialist (who later became Mr D’Aloia’s expert witness in the Court case) considered that the USDT had been transferred several times through different exchanges before ultimately being withdrawn as fiat currency by an individual in Thailand. 

Mr D’Aloia sued both the unknown fraudsters and the crypto exchanges through which his USDT seemed to have been transferred. It was through this trial that Mr D’Aloia hoped to establish that Bitkub, a crypto exchange based in Thailand, was required to compensate him on the basis that his misappropriated USDT had been transferred to a wallet held with Bitkub, and that Bitkub held that USDT on constructive trust for Mr D’Aloia because of the fraud. Exchanges will be increasingly targeted in these types of claims because they often represent a more realistic recovery route than the fraudster themselves. 

Are cryptocurrencies property?

In order for Mr D’Aloia to establish that Bitkub held the USDT on his behalf as constructive trustee, he would first need to establish that USDT constituted property capable of attracting property rights. 

The status of crypto assets such as cryptocurrencies and non-fungible tokens and whether they constitute property has been considered in several interim decisions over the past few years. The Law Commission has also published a detailed report on the question. 

Both the Courts and the Law Commission have regularly concluded that cryptocurrencies are property, but until this hearing the question had never been considered at a full trial. 

Whilst this case was limited solely to USDT, and not to other widely-known cryptocurrencies like Bitcoin and Ethereum, the Court found that under English law, USDT constituted property. 

The judge found that USDT is not a “thing in possession” or a “thing in action” (the two regularly accepted forms of property, being either a physical item, or some sort of personal right), and that “crypto assets have a conceptual existence that is independent of the legal system and of their individual users”. The Court found that the property rights attach to the USDT itself, not to the right to control it (for example by using the private key); the property is not only the data (since mere information cannot be property) but the combination of the data and the transactional functionalities that go with it.

Can cryptocurrencies be traced?

To succeed in his claim to be able to recover his missing USDT from Bitkub, Mr D’Aloia also needed to show that he could either follow or trace his specific coins from his initial investment through to the relevant wallet at Bitkub from which it was eventually withdrawn. 

Following versus tracing

When trying to recover misappropriated assets, English law recognises two separate methods: “following" and "tracing". Whilst this is a complex area of law, in short, “following” is the process by which the asset itself is followed as it changes hands (i.e. watching where a stolen car is taken), and “tracing” is the process by which new assets are identified that are the substitute for the original asset (i.e. seeing that the stolen car is sold for cash, which is used to buy a watch).

Hot wallets

It is worth noting at this point that Bitkub operated by sweeping customer’s deposits into what is known as a “hot wallet” – a point also considered by the High Court in a previous case (Prioozzadeh v Persons Unknown [2023] EWHC 1024 (Ch)).

The effect of a hot wallet is that a user of the exchange does not retain any property in the crypto asset deposited with the exchange, albeit that they have a claim against the exchange for its value. A hot wallet works more like a conventional bank account – all of the crypto assets deposited are swept into a central unsegregated pool (the hot wallet), and are not specifically segregated to be held for the sole benefit of the user from whose account they have been swept in. The user’s account is credited with the amount of the deposit, and the user is permitted to draw against any credit balance. This is an approach that generally works well if the exchange is properly operated (unlike, for example, during the downfall of FTX where lack of internal controls resulted in a depleted pool of crypto assets, which in turn meant that account holders were unable to withdraw anything). 

Following USDT

To be able to follow the USDT through different wallets, it would be necessary for the coins to persist from one transaction to another. The judge heard arguments on whether this was the case, or whether the coins were extinguished and replaced each time they were transferred. He concluded (on what he described as "thin" evidence) that USDT coins do persist – that analysis was the more consistent with what Tether itself says about its currency in published documents. It was also consistent with the fact the judge had found that USDT, to put it succinctly, does not change on transfer – it stays largely the same. In principle, this meant that Mr D’Aloia’s USDT could be followed. However, the judge said he was not presented with any evidence on following of Mr D’Aloia’s USDT, so the argument moved to tracing.

Tracing USDT

There are multiple possible methods by which assets might be traced. The defendants in this case objected that the claimant’s expert had not used a recognised method, but the judge did not consider this necessarily to be fatal. Having reviewed the authorities, the judge said that it was open to Mr D’Aloia to trace on a different basis provided the method used “treated all innocent claimants and potential claimants comparably and was properly evidenced”. Despite this, the judge was not satisfied that Mr D’Aloia’s expert witness had applied a consistent and coherent methodology. The expert failed to prove that Mr D’Aloia’s USDT were, or were among, those withdrawn by the fraudsters at the end of the chain of transactions. As a result, tracing was not possible and so the claim against Bitkub failed.

While the judge did not doubt that a fraud had been perpetrated, and indeed that there was some link between the persons who had defrauded Mr D’Aloia and the Bitkub wallet under consideration, the case failed because tracing was unsuccessful on the evidence presented. Mr D’Aloia had not proved that the Bitkub wallet contained any of his misappropriated USDT. This does not mean that future cases are bound to fail – but it does indicate lines of attack for defendants and brings the focus on the quality of the tracing evidence that meets the requisite standard of proof.

What duties are there on crypto exchanges?

It is common for victims of crypto frauds to make exchanges defendants to their claims to recover their assets. This parallels other conventional fraud claims, such as in authorised push payment fraud: typically a victim will not know the true identity of the fraudster(s), which would make recovery practically impossible. In these claims, victims argue that their bank is also at fault in some way. Similarly here, Mr D’Aloia did not know who were the “persons unknown” who had perpetrated the initial fraud, but he considered Bitkub also to be liable. For liability to attach, however, the bank or exchange must be required to do something it has not done, or have done something it was required not to.

The primary argument in this case, that Bitkub was a constructive trustee of Mr D’Aloia’s USDT, failed on the facts. Having been unable to trace his USDT to the Bitkub wallet, Mr D’Aloia was unable to demonstrate that Bitkub should hold the USDT within that wallet as constructive trustee for his benefit. However, the argument for an exchange becoming a constructive trustee in certain circumstances remains relevant and could be established in a case with better quality tracing evidence. Exchanges should be alive to this argument – if they are put on notice that they are holding possibly stolen or fraudulently obtained assets, they may be required to ringfence them. Failure to protect assets that are subject to a constructive trust could give rise to liability for breach of trust.

The judge also made some observations about Bitkub’s policies and procedures that are noteworthy for exchanges. The claimant had claimed that Bitkub failed to comply with know your customer and anti-money laundering (AML) duties and so should not be allowed to rely on certain defences. The judge said that no evidence was presented of the standard Bitkub was required to meet and so could not find a breach of any duty, but he was nonetheless able to find that Bitkub “was on notice of suspicious account activity…and failed or failed properly to investigate it”. That would have prevented Bitkub from relying on defences based on it having acted in good faith (had the claim not failed at an earlier stage). 

Expert evidence was not required for the judge to rule that the account use was suspicious. The user registered to the wallet in question had declared to Bitkub a monthly income below 30,000 Thai Bhat, yet “in a single day had transaction volumes in excess of THB13 million". Bitkub’s AML policies and systems were “repeatedly breached” and Bitkub “permitted” this. As noted, had Mr D’Aloia’s case not failed at an earlier stage, these failures of Bitkub’s system and controls could have been very costly as they rendered it impossible for Bitkub to show it had acted in good faith. It is increasingly important for exchanges to bring their systems and controls up to standard to head off these kinds of attacks, and preserve good faith-based defences.

Conclusions

The case provides useful lessons for all involved in cryptocurrency trading, especially exchanges. 

Both exchanges and users of crypto assets will benefit from the – essentially settled – question of whether crypto assets constitute property under English law and, accordingly, benefit from the suite of rights and remedies available under the law when property rights are violated. 

The claimant was not able to trace his USDT to Bitkub due to problems with his expert evidence. Exchanges, however, should take note of other points from the judgment. As we have written previously, there is a growing body of case law suggesting that exchanges need to consider carefully having suitable rules and guidelines in place and ensuring they are followed. The risk of being found to be a constructive trustee of misappropriated assets remains live, and if that does happen exchanges will need to show they have acted with propriety.