Isle of Man: Bitcoin Fraud: Tulip Power To The Rescue!

Picture the scene:

You are a fiduciary in the Isle of Man managing the assets of your overseas client. A substantial quantity of those assets are bitcoin. Unfortunately, one day, hackers pose as your client and ask you to transfer a substantial quantity of bitcoin to an account that they control. Despite your fraud prevention policies, your staff are taken in and make the transfer. You realise you have been the victim of a scam when the real client discovers the diminished value of the structure and raises the alarm.

After a massive intake of breath, and then notifying your insurers, what can you or your insurers do to recover the bitcoin? Is there any realistic chance of getting the bitcoin back?

Basics

Crypto-currencies are digital currencies created using encryption algorithms. They are held in a digital wallet. Any transactions are recorded in a ledger or database known as a 'block chain'. The block chain has both a public key, which is a bit like an email address, and a private key which is like a password. Both are needed in order to gain access and make a transfer. The holding is only as secure as these details.

The first thing to note is that crypto-currencies are property even though they are merely digital. This needs to be said because, for some time their precise legal nature was not clear. It has now been well established in the UK in AA v Persons Unknown [2019] EWCH Comm 3556 paras 55-61 and in Tulip Trading Limited (discussed below, at para 24) (and also recognised in the Isle of Man) that bitcoin and other crypto currencies are indeed property because it is a feature of their computer code that they cannot be double spent. This means that the victim can assert a proprietary remedy to the asset and reclaim it – if it can be found.

Hitherto, ideas on recovering stolen bitcoin have centred around pursuing the fraudsters and locating the victim's property. Forensic computer experts may be able to identify where the crypto currency is now held and it is potentially possible to get an injunction to freeze the wallet pending substantive proceedings against the persons, likely to be unknown, who have stolen the asset. A disclosure order might be obtained against the exchange to force it to reveal the identity of the new owner of the bitcoin and, once that information is available, the persons unknown might be named, the bitcoin might be traced, and a judgment could potentially issue.

There are of course in practice a number of difficulties with this:

• a proprietary right to obtain your bitcoin back is only of use if you can find it or trace what it has now been exchanged for, and that might prove practically difficult;
• even if the Isle of Man Court makes the necessary freezing and disclosure orders, they may still require enforcement around the world and even in overseas common law jurisdictions that might be problematic, either at all, or in any reasonable timescale.
• a personal right of action against the fraudster will also exist but his identity may remain unclear. Even if it is not, he may be in an unfriendly jurisdiction on the other side of the world and difficult to enforce against.

Tulip power!

A new possibility was recently presented by the decision of the Court of Appeal of England and Wales on 3^rd February 2023 in Tulip Trading Limited v Van der Laan [2023] EWCA Civ 83.

Tulip claims to be the owner of about $4 billion worth of bitcoin which has been stolen in a hack. Instead of pursuing the bitcoin or the fraudsters, Tulip decided to pursue the developers, who control and run the relevant bitcoin networks, to force them to use their control to get their property back. In doing so, they were breaking new ground, in that developers have never before been found liable in this way.

Tulip argue the control which the developers exercise in relation to the software is such that, if a third party identified a bug and the developers with administrator privileges agreed that it should be fixed, then the developers would undoubtedly introduce a change in the source code and update the software. Their role is not passive. Therefore, "the developers should be recognised as a new ad hoc class of fiduciary, owing fiduciary duties to the true owners of bitcoin crypto currency" and their duties "should extend to implementing the necessary software patch to solve Tulip's problem and safeguard Tulip's assets from the thieves" (2).

In contrast, the developers argue that they have no duties toward the owners of bitcoin, and that any such duties would be "highly onerous and unworkable" (2). This dispute goes to the very heart of what crypto currency is: there is no central organisation making decisions but rather they are simply "part of a very large, and shifting, group of contributors without an organisation or structure" (33). If Tulip were to succeed, that "would bypass what is currently a fundamental feature of the networks, namely that private keys are the only way to transfer the digital assets" (84).

Overturning the decision of the High Court, the Court of Appeal determined that there was a serious issue to be tried that the developers did indeed have fiduciary duties to owners. The Court was influenced by the fact that:

As this was an interim judgment only, it establishes only that there is a serious issue to be tried that the developers have these duties. Whether such a duty exists can only be finally determined when the facts are established at a full trial. All the same, the judgment represents a huge stride forward for the victims of fraud looking for a means of redress. Should those duties become established or accepted, they will undoubtedly cause a change in the way that crypto currency is administered and viewed.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.