Tracing and Recovering Stolen Cryptocurrencies: Legal Tools Available

Introduction

Cryptocurrency is a form of purely digital currency that operates using a blockchain-based system for secure and transparent data storage and transaction recording [1]. Cryptocurrency theft in Malaysia, as in other parts of the world, involves various methods such as hacking, phishing and investment scams. Hackers exploit security vulnerabilities in exchanges or wallets, while phishing targets unsuspecting individuals through fake websites and emails.

Efforts to recover stolen cryptocurrency are vital yet challenging due to the decentralized and pseudonymous nature of blockchain technology [2]. These challenges are compounded by the rapid growth of Malaysia’s cryptocurrency sector, which has created opportunities for fraudsters.

Practical Steps for Victims of Cryptocurrency Theft

When faced with such theft, it is understandably an overwhelming experience to have lost a chunk of money. Below are suggestions on immediate action for victims;

• Act quickly

Victims of cryptocurrency theft should immediately file a report with the Malaysian Police or the Royal Malaysia Police (RMP) cybercrime units, who specialize in handling digital financial crimes. A recent case in Malaysia, police arrested three men for allegedly stealing cryptocurrency. The suspects had attempted to launder the cryptocurrency, which they had initially promised to generate as part of the victim’s investment. The operation was brought to a halt when Bukit Aman CCID’s crypto unit, utilizing commercial technology, successfully tracked the digital currency transactions, according to Datuk Ramli[3].

• Report to the right authorities

Scams related to cryptocurrency investments should also be reported to the Securities Commission Malaysia (SC)3F[4], the regulatory body responsible for overseeing fraud in the investment sector.

• Timely reporting is key

Reporting the incident promptly increases the likelihood of recovering stolen funds and aids law enforcement in tracking and preventing further crimes, ensuring that others are also protected.

Civil Actions for Tracing and Recovery

Victims of cryptocurrency fraud in Malaysia can file civil suits for fraud, breach of contract, or misrepresentation to seek financial restitution or recovery of assets. These legal actions hold offenders accountable and provide a formal avenue for compensation.

This can be seen in the High Court case of Chen Yook Bee & Ors v Neurogine Capital (L) Ltd & Ors[5], involving a cryptocurrency investment scheme where the plaintiffs claimed they lost RM10,491,411.90 due to fraud and misrepresentation by the defendant, a company registered under the Labuan Companies Act 1990 and licensed by the Labuan Financial Services Authority to conduct digital financial services. It operates an AI-driven money broking and trading platform.

In this case, the defendants sought to dismiss the case, arguing they were simply platform providers with no involvement in the fraud. However, the court found evidence suggesting that defendants were actively involved in promoting the scheme, which linked them directly to the alleged fraudulent activities.

In the High Court case of Yew See Tak v CG Computers Sdn Bhd & Ors[6], where the defendant is in the business of repairing smartphones and computers known as “Switch”, the plaintiff sent his phone for repair, and claimed that the defendant had performed unathorised transactions on the plaintiff’s cryptocurrency accounts. This resulted in the loss of approximately RM3.369 million.

The court dismissed defendant’s application to dismiss the case, finding that the allegations of conspiracy to defraud or injure were not “plainly unsustainable” and required resolution at trial. This decision allowed plaintiff’s case to proceed, giving them the opportunity to prove their claim of alleged cryptocurrency theft against defendant.

In pursuing the recovery of stolen cryptocurrency, victims can explore the civil remedies below:

1. Anton Pillar Order – a legal remedy that allows responsible authorities to conduct court-sanctioned searches to secure and preserve crucial evidence. This order is typically granted when there is a risk that vital evidence may be destroyed or concealed, ensuring that the affected party can gather the necessary proof to support their claims in legal proceedings.

 

2. Mareva Injunctions – to safeguard their claims by freezing the offender’s assets. This powerful legal tool prevents the accused from transferring, spending, or concealing stolen funds, including those held in digital wallets. By securing these assets, the injunction ensures they remain available for recovery or restitution once the legal process concludes.

 

3. Tracing[7] and Constructive Trusts – while cryptocurrency transactions are often pseudonymous and irreversible, a constructive trust provides a mechanism to trace and recover the specific digital assets. Tracing cryptocurrency transactions involves using blockchain analysis alongside data from exchanges and other sources. This allows investigators to track the stolen funds and determine who might be responsible for the theft. This tracing ability is particularly significant given the unique and intangible nature of cryptocurrency.

 

4. Breach of Contract Claims – in the case where a third party is involved (e.g., exchange, wallet provider, or platform) and was negligent or violated their terms of service, the victims may be able to pursue claims for breach of contract or tortious interference. A recent High Court case that demonstrates a third party’s negligence is Luno Malaysia Sdn Bhd v Yew See Tak7F[8] where the plaintiff alleged negligence in the defendant’s handling of the safety of the wallet platform. However, the court ruled that imposing a heavier standard of duty of care on Recognised Market Operators (RMOs) would impede the growth of the business community. Luno Malaysia case had referred to the case of Tenaga Nasional Malaysia v Batu Kemas Industri Sdn Bhd8F[9] that outlines the standard of care as follows:

 

• Harm must be reasonably foreseeable as a result of defendant’s conduct;
• The parties must be in a relationship of proximity; and
• It must be fair, just and reasonable to impose liability.

 

Understanding Cases Abroad

Understanding overseas cases provides valuable insights into how other jurisdictions address the complexities of tracing and reclaiming digital assets stolen through fraud or cybercrime. In the UK High Court case of AA v Persons Unknown & Ors, Re Bitcoin[10], Justice Bryan concluded that Bitcoin qualifies as property, enabling a proprietary injunction for recovery. He held that fraudulently obtained property is recoverable in equity and it was more practical to grant such relief to support the person claiming the stolen Bitcoin[11].This decision marked a significant step in using legal remedies to trace and recover cryptocurrencies obtained through fraud.

In a recent Singaporean case of B2c2 Ltd v Quoine Pte Ltd[12],  that underscores the tension between maintaining fairness in trading systems and adhering to contractual promises in decentralized financial platforms, the court ruled in favour of the Plaintiff, finding that the cryptocurrencies could be held in trust as property. What this means is the court of Singapore recognized cryptocurrencies as a form of property that can be legally held in trust. Therefore, when someone holds cryptocurrency on behalf of another party (e.g., on a trading platform), they have a fiduciary duty to safeguard those assets, treating them as legally owned by the party entitled to them, rather than as part of the platform’s assets.

Another recent case worth highlighting is in the U.S. where Bitfinex hacker, Ilya Lichtenstein pled guilty to stealing nearly 120,000 bitcoins worth USD70 million at the time (valued over USD4.5 billion during the arrest). Lichtenstein, with the help of his wife Morgan, was involved in one of the largest financial confiscations in history. This case raises intriguing questions about how someone could successfully launder such a large sum. According to Lichtenstein, the process involved using fake identities, converting the stolen funds into different cryptocurrencies, purchasing gold coins, and then moving the laundered money back to his home country, Russia[13]. Lichtenstein was sentenced on 14 November 2024 to five years in prison for his involvement in a money laundering conspiracy arising from the hack and theft from Bitfinex, a global cryptocurrency exchange.

Conclusion

In conclusion, while the rise of cryptocurrency theft presents significant legal challenges, emerging legal frameworks and remedies offer a promising path to recovering stolen assets. The growing recognition of cryptocurrencies as property in jurisdictions abroad brings to light the increasing ability of the legal system to adapt to these new challenges, giving hope for victims and setting a precedent for future cases in Malaysia. It is crucial for the crypto community to prioritize education and vigilance to foster awareness on security measures in mitigating risks and protecting assets from fraud, theft and other financial crimes.

If you have any questions, please contact our Financial Services Partner, Mr. Fakhrullah Fadzilah (fakhrul@nzchambers.com), or Pupil-in-Chambers Ms. Wan Tasnima.

Published Date: 11 December 2024

Authors:

1. Fakhrullah Fadzilah
2. Wan Tasnima

 

References:

[1] Chen Yook Bee & Ors v Neurogine Capital (L) Ltd & Ors [2022] MLJU 1860

[2] Transactions occur on a distributed ledger without a central authority, and participants are identified by wallet addresses rather than personal identities

[3] https://www.trmlabs.com/post/malaysian-police-make-arrests-in-cryptocurrency-fraud-scheme

[4] https://www.sc.com.my/investor-empowerment/lodge-a-complaint

[5] [2022] MLJU 1860

[6] [2024] MLJU 958

[7] Typically, in cryptocurrency cases, it involves tracing the movement of the digital assets through Blockchain Forensics and Exchanges and Wallet Providers.

[8] [2024] MLJU 2703

[9] [2018] 5 MLJ 561

[10] [2019] EWHC 3556

[11] Victoria Ball, AA v Persons Unknown & Ors, Re Bitcoin [2019] EWHC 3556 (Comm) (13 December 2019)

[12] [2019] Sghc(I) 3; [2019] 4 SLR 17

[13] (Hoskins, Peter 2024) US hacker sentenced over Bitcoin heist worth billions  https://www.bbc.com/news/articles/c2dl70wed1lo