Asset tracing and corporate intelligence techniques in cryptocurrency investigations

In the first half of 2018, $1.1 billion USD in cryptocurrency was stolen or trafficked online, with the majority of attacks targeting either regular businesses or cryptocurrency exchanges.[1] By 2019, that figure had jumped to $4.4 billion.[2] Despite these staggering losses, a harsh reality for private cryptocurrency investigations is that modern-day tracing operations are difficult to effectively conduct. The development of new altcoins that use private ledgers also complicate tracing efforts of forensic accountants, legal teams or law enforcement agencies attempting to link together cyber money laundering chains. [3]

This article outlines commonly-used investigative techniques for insolvency professionals or asset tracing agents working on cryptocurrency recovery initiatives. It also summarizes recent Canadian and American jurisprudence involving recoveries by private actors, and concludes with an outline of the basic steps that professionals should take when initiating cryptocurrency reclamation suits.

Case Law

While there is limited relevant case law in Canada,[4] recent jurisprudence in the United States indicates the growth of a general procedure for cryptocurrency recovery in asset tracing cases, especially involving subpoenas seeking information about the alleged hackers or thieves in question. This development of American common law is likely to influence procedural techniques in Canada, especially in the real-time world of bankruptcy and insolvency litigation. Three of the most relevant of these cases are summarized below.

White v. Sharabati[5]

In a landmark 2018 decision, misappropriated cryptocurrency funds were awarded to a plaintiff, Elizabeth White. In total, White alleged that she was defrauded 484,000 XRP after an anonymous individual purportedly stole the assets from her in exchange for 46.5 BTC, which she allegedly never received. A complaint was initially filed by White’s legal team in the Superior Court of Delaware for information held by Bittrex and Poloniex, two cryptocurrency exchanges where White’s stolen assets had been warehoused. White’s lawyers were successful in petitioning the court for Bittrex’s release of client information, and as a result of Bittrex’s co-operation, Fadi Sharabati’s identity was released and the cryptocurrency was awarded to White.

However, in a later shocking twist of events, Sharabati filed a successful motion in the Superior Court of the State of Delaware to dismiss the suit on the basis of lack of personal jurisdiction. Sharabati’s success centered around the court’s comment that a nonresident using the website of a Delaware corporation should not be subject to Delaware jurisdiction.[6] The secondary motion, intended to cause the return of the cryptocurrency to Sharabati, was stayed for forty-five days “to allow [the] Plaintiff time to file a subsequent action in a proper jurisdiction and take the steps necessary to protect the garnished cryptocurrency for litigation.”[7] This decision should be used as a cautionary example for Canadian litigators to carefully determine a legal forum’s connection to an digital asset tracing dispute, prior to initiating a lawsuit.

ZG Top Technology Co. Ltd. v. John Doe[8]

In another cryptocurrency asset tracing case, the United States District Court (W.D. Washington, at Seattle) granted a motion in part by ZG Top Technology Co. Ltd. (“ZG Top”), a global blockchain asset trading platform, that filed a complaint against a John Doe for an allegedly criminal hack. ZG Top alleged that 330,000 USDT and 100 ETH was lost and transferred to Bittrex as a result of John Doe’s actions. ZG Top also argued that expedited discovery from Bittrex was required to freeze the misappropriated cryptocurrency.

Jones J ruled that “good cause support[ed] ZG Top’s request for leave to take expedited discovery”[9] and also found that a request for identifying information from Bittrex would be reasonably likely to lead to the production of information on the matter. However, the court fascinatingly held against the tracking, freezing and recovery of the alleged stolen cryptocurrency, as ZG Top failed to cite authority for “recovery this early in this lawsuit”.[10] This  signifies a divergence in the development of early case law involving cryptocurrency recoveries: while information may be sufficient for the purposes of expedited discovery from cryptocurrency exchanges when a fraudster is identified, a higher bar will likely be set by courts for the actual freezing of the assets in question.

Rasmussen v. Smith[11]

In Rasmussen, a court-appointed receiver sued defendants for the recovery of funds stemming from a cryptocurrency payment made by an entity, AriseBank, for the purchase of a non-existent bank. In summary, AriseBank was a start-up venture that provided cryptocurrency and banking services to corporations, raising funds primarily by selling its own cryptocurrency called PIVX coins. AriseBank’s CEO, Jared Rice, signed a term sheet to purchase a bank from one of the Defendants. However, the ‘bank’ in question did not actually exist. Rice then transferred 95,000 PIVX coins as a 10% due diligence deposit on the fraudulent purchase.

The court-appointed receiver sought the return of the coin transfer to the estate, and then pursued summary judgment on the outstanding claims of unjust enrichment, conversion, and fraudulent transfer. The motion against Kurt F. Matthews, one of the Defendants, was successful, as Lynn J determined that AriseBank had not received a “reasonably equivalent value”[12] for the coin transfer, was financially vulnerable at the time of the transfer, and was successful at establishing constructive fraud against Kurt F. Matthews. Matthews was further noted by the court as being not a good faith transferee.[13] While Matthews’ suggested knowledge of perpetrating a fraud was key to the recovery of cryptocurrency assets, it will be interesting to see how Canadian and international courts eventually treat cases where assets are transferred to third parties, innocent or otherwise, via darknet markets specializing in the brokerage of stolen funds.

Procedural Steps

Conclusions can be drawn from the above jurisprudence, which set out a clear framework of practical steps. These steps involve the following:

1. Investigate the movement of the funds;
2. If misappropriation is discovered, retrieve appropriate know-your-client information; and
3. Initiate a legal action for the recovery of assets in the appropriate jurisdiction.

Step One: Investigation

While free tools exist online that can help trace funds, successful investigations involving digital ‘money’ often require the involvement of trained professionals who are skilled in asset recovery initiatives, depending on the volume and type of laundered asset. When there are significant funds being dispersed in a rapid time frame, it is recommended that an independent firm be hired, and/or that insolvency professionals complete asset tracing training programs. Clients should always keep in mind that courts will eventually require legal proof of the fraudulent transfer of these assets.

Corporate intelligence gathering can also be used as a highly successful tool for clients aiming to trace or link wallet addresses to individuals or entities. Examples of techniques involve investigative due diligence through social media analyses or public records sourcing from financial and/or legal databases. On a case-by-case basis, consultants, cybersecurity firms and legal professionals also may have experience monitoring both the general and the dark web for assets.

Step Two: Know-Your-Client Information

As seen in the above jurisprudence, the practical next step after tracing has occurred is to petition the relevant court for the release of know-your-client information from cryptocurrency exchanges or platforms. A cost-benefit analysis should be conducted on the potential success of the legal application in question before beginning an information gathering exercise, as many exchanges retain privacy information on a jurisdictional basis. As an example, certain altcoin exchanges let users use their platforms anonymously, and do not require verification of identities through traditional know-your-client obligations. It is yet to be seen how international jurisdictions will implement Canadian court orders in cross-jurisdictional actions directed against these exchanges.

Step Three: Court Actions

Once the holder of the misappropriated funds is identified, clients should consider implementing a lawsuit to freeze and/or recover the assets in question. An example of a legal process to prevent assets being dissipated is a Mareva injunction.

As an equitable remedy, Mareva injunctions are extraordinary. They require a high legal bar for proof, and are routinely sought ex parte within Canadian courts. Mareva injunctions require applicants to establish:[14] (i) a strong prima facie case; (ii) that there is a real and genuine risk that the respondent will put assets beyond creditors to avoid judgment; (iii) that the moving party will suffer irreparable harm; and (iv) that the balance of convenience favours the moving party.[15]

Mareva injunctions that tie up a person’s digital assets are extraordinary and blunt instruments that should only be resorted to in the clearest of cases.[16]

Conclusion

While investigative efforts taken by forensic teams working to trace digital assets can be difficult, there are effective forensic solutions and recovery efforts if the above-listed steps are followed. The obiter skepticism expressed by both American and Canadian courts regarding the speculative nature of cryptocurrencies should also be kept in mind when seeking forms of preservation orders or Mareva injunctions. As the dissipation of digital assets is new legal territory, it will be exciting to watch growing legal trends as courts establish tests for both the investigation and recovery of online cryptocurrencies in the insolvency, fraud, and white-collar crime contexts.

The authors would like to thank Mohammad Leghari for his assistance editing this article. If you have any questions on the above article, please contact a member of our Restructuring team.

 

[1] Kate Rooney, “$1.1 billion in cryptocurrency has been stolen this year, and it was apparently easy to do”, (June 7, 2018), online: CNBC <https://www.cnbc.com/2018/06/07/1-point-1b-in-cryptocurrency-was-stolen-this-year-and-it-was-easy-to-do.html>.

[2] Gertrude Chavez-Dreyfuss, “Cryptocurrency crime surges, losses hit $4.4 billion by end-September”, (November 27, 2019), online: Reuters <https://www.reuters.com/article/us-crypto-currencies-crime/cryptocurrency-crime-surges-losses-hit-44-billion-by-end-september-ciphertrace-report-idUSKBN1Y11WH>.

[3] Examples include Dash, Monero, and Zcash, which are cryptocurrencies purposely designed to obfuscate the source or destination of funds. The exercise of tracing certain of these altcoins is discussed further in: Haaron Yousaf, George Kappos, and Sarah Meiklejohn, “Tracing Transactions Across Cryptocurrency Ledgers” (Paper delivered at the 28^th USENIX Security Symposium, August 2019) at page 10, online at <https://www.usenix.org/system/files/sec19-yousaf_0.pdf>.

[4] There is some Canadian precedent for tracing and/or recovery orders in the context of lost or stolen cryptocurrency assets. As an example, in 2018 the British Columbia Supreme Court in Copytrack Pte Ltd v. Wall, 2018 BCSC 1709, granted an order to trace and recover cryptocurrency tokens, even though the tokens had been transferred out of the defendant’s wallet into five different accounts.

[5] Elizabeth White v Fadi Sharabati, 2019 WL 2897913 (Del Sup Ct).

[6] Ibid at page 2.

[7] Ibid.

[8] ZG Top Technology Co. Ltd. v. John Doe, 2019 WL 917418 (Wash Dist Ct).

[9] Ibid at page 2.

[10] Ibid at page 2.

[11] Mark Rasmussen v. Richard Smith, 2020 WL 109863 (Tex Dist Ct) [Rasmussen].

[12] Ibid at page 2.

[13] Ibid at page 3.

[14] Jajj v. 100337 Canada Ltd., 2014 ONSC 557 at para 131.

[15] An example of a groundbreaking Canadian case is Shair.Com Global Digital Services Ltd. v. Arnold, 2018 BCSC 1512, where the British Columbia Supreme Court granted a preservation order over digital currencies. This case is an example of a situation where a digital currency consultant was retained to investigate the movement of digital assets. However, while the preservation order was granted, the sought Mareva injunction was denied, given the speculative growth of the investment.

[16] Ibid at paras 25 – 26.