.png)
This article was originally published in Blockchain Industry Review - a Crypto Curry Club Magazine published monthly and available in soft copy and the printed version.
Written by Guest Contributors, Allister Manson, and Nicholas Parton,
Partners of financial services group, Opus
Bitcoin
The price of Bitcoin (“BTC”) officially exceeded the $50,000 mark this week: over the past decade, BTC has repeatedly defied its doubters and, despite a string of high profile setbacks, from Mt Gox in 2014 to Quadriga in 2019, nothing has so far managed to derail it.
As most readers will know, the simplest way to acquire BTC and other crypto is to buy it on a crypto exchange, such as Coinbase or Binance. Once you’ve passed AML and KYC checks, you will be allowed to deposit cash at your chosen exchange and the exchange will convert that into BTC (or, another crypto-currency of your choice). Most exchanges also offer to store your crypto for you in a “personal” wallet. (More of that, later).
Some exchanges also allow “crypto traders” to buy and sell at speed and with relative ease, largely in response to the significant rise in price volatility of crypto assets, as they become more mainstream.
The Growth of Cubits
Dooga Ltd, trading as Cubits, was a BTC Exchange, Trading Platform and Storage Facility – and became one of the fastest-growing platforms in Europe, following its launch in 2015. Its clients comprised both corporates and individuals. The trading platform allowed customers to buy, sell, trade and store BTC.
However, not content simply to grapple with the risk profile and volatility of BTC itself, Cubits decided to specialise in catering for the online gambling industry. Cubits provided a very fast and smooth BTC conversion service to up to 500 different online gambling platforms, enabling their clients to quickly convert their BTC into cash, for betting purposes.
Cubits was young, dynamic and operating in a rapidly evolving industry. Unfortunately, the world of cryptocurrency can be a minefield and its unregulated status facilitated a less than robust approach to the inherent risks.
By mid-December 2017, when the BTC price was c$20,000 and trading volumes were at record highs, Cubits was profiting handsomely from the 100,000 individual clients and 5,000 corporate clients that it was servicing.
The Alleged Fraud
However, in February 2018, the accounts of three Chinese users were compromised. The three customers had between them, in the days leading up to the alleged fraud, amassed €27m worth of BTC in their accounts. Their trading patterns were atypical, and they had not initiated the 2-Factor Authentication security protocol recommended by Cubits. They then reported that their accounts had been hacked and their passwords changed immediately prior to the withdrawal of c.2,800 BTC.
These three Chinese customers had purportedly transferred the Chinese Yuan to purchase their BTC to Pay Secure Online Limited, a third-party payment service provider (“PSP”), which was Cubits’ main PSP in Asia. The PSP, on hearing the allegations of the customers being hacked, allegedly returned the funds to them. So, the money for the BTC was never remitted to Cubits and, worse still, Cubits’ BTC had been withdrawn from the exchange.
The PSP subsequently refused to honour the BTC purchased and also reneged on payment of some €7m of outstanding amounts owed to Cubits for unrelated, prior BTC transactions. Faced with serious liquidity issues, Cubits’ management employed forensic investigators and local lawyers, to help them recover the missing assets.
The results were fruitless and only served to worsen the company’s liquidity problems. In December 2018, some ten months later, Opus was appointed Administrators (now Liquidators) and our Forensic team was instructed to conduct a forensic investigation into the fraud.
Forensic Challenges in the Liquidation of a Cryptocurrency Exchange
What do you do when you’re faced with an alleged fraud, with €35m worth of BTC having been lost, former staff having scattered, and certain key management not cooperating?
Firstly, we set up communication channels for third parties to provide us with relevant information, whilst giving them the option to remain anonymous;
Secondly, we quickly pieced together a picture of those occupying key positions within the business, identifying those who were uncooperative and those aligned to them;
Finally, we worked closely with helpful former employees to gather as much information as possible about the inner workings of the business.
BTC Tracing – Where To Start?
Frustrated by the lack of cooperation from certain former staff and management, who had not given the Liquidators access to the transactional records or the keys to the Company’s crypto wallets, the forensic team sought to piece together the transactional history of the Cubits’ wallet from public sources.
The team was able to verify BTC transactions from the Blockchain (a global, centralised repository of all historic BTC transactions). However, without the customers’ identifying information, it was not possible to decipher which transactions belonged to which customers. Our forensic team hired several specialist cyber investigators to work hand-in-hand with our own forensic accountants. Using proprietary software, the team traced the stolen BTC in respect of several frauds committed against Cubits, and traced BTC which left the wallet in the days prior to the appointment of the Administrators.
The forensics team has encountered a disproportionate number of BTC transactions being sent through “tumblers/mixers” – essentially, money laundering services for BTC – to exchanges. Exchanges are, on the whole, not easy to communicate with and some actively encourage an aura of mystique. This type of trading can attract an affluent customer, but not necessarily the type that would pass your KYC compliance tests!
The forensic team collaborated with the Liquidators’ legal advisors and law enforcement agencies, issuing requests to the exchanges to reveal the identity of the account holders receiving the stolen BTC.
The exchanges also revealed if the account holder had any funds remaining, or if the BTC had been transferred onwards. If the latter, the forensic team resumed the tracing until it hit another exchange/known account; or, if the BTC has been converted into traditional currency, they began the more common asset tracing and recovery exercises.
Lack of transactional data. Data held on servers, but no-one willing or able to provide access…
One helpful factor in a situation of insolvency is that the company’s former suppliers still want to receive payment. For example, as we had no accurate information as to where company’s servers were located and no-one would provide this information, we simply waited for the company’s former suppliers to contact us to chase their debts. In that way, we were able to recover key data which helped us proceed with the investigation and recovery of assets.
Similarly, we were able to identify over 30 different bank account-providers, worldwide, including in some in territories where the Company had never had any customers. The Liquidators have been able to recover funds from accounts based all over the world and the process is ongoing.
Liquidators have fairly wide powers granted by the Insolvency Act 1986 in order to compel third parties to assist them, either in the provision of information, or in the recovery of assets.
Other Bitcoin challenges
One interesting feature of Cubits’ BTC investors, which seems to be a feature of other insolvencies involving cryptocurrency, is their attachment to what they perceive to be “their” BTC. Possibly due to the highly traceable nature of the asset class, the majority of the individual creditors who have lost BTC, talk in terms of getting their BTC back, rather than receiving a monetary distribution. Of course, this is not necessarily always possible under insolvency legislation – the value of claims for lost BTC in previous insolvencies has been calculated using the BTC price at the date of Administration and creditors have been eligible for a monetary distribution for that sum, rather than a return of their BTC.
Indeed the precise nature of BTC is still yet to be settled by the UK Courts: under English law, BTC is neither property that a party can take physical possession of, nor does it create a property right that can only be obtained or enforced through legal action because it is
intangible in nature, being either information or data, and numerous English authorities have affirmed that information or data is not property.
However, the recent case, of Liam David Robertson v Persons Unknown, is helpful in that the Commercial Court granted an asset preservation order over more than GBP 1 million of BTC stolen in a spear-phishing attack, clearly deeming the BTC to be assets. Indeed, in an insolvency context, BTC is more likely to fall within a debtor’s property, as the definition of property in insolvency is extremely wide: however, it is important to stress that its status has not yet been properly defined.
The Singaporean judgment in B2C2 v Quoine Pty (2019) established that proprietary claims may be made against BTC, so it will be interesting to see how this plays out in the context of Cubits and more widely.
Insolvency learning points
It is absolutely essential to get to grips with the technical aspects of these types of assignment, as early as possible, using external consultants if necessary: to use the jargon of the tech world, these types of business are at the “bleeding edge” of technology and modern techniques for identifying and security assets need to be applied;
With that in mind, ensuring that you have a team that understands the systems and is able to access them is of critical importance: obtain and update online bank details, log-ins and passwords, access codes and secret keys on Day One;
Be mindful of the potential value of IP and software, particularly in cutting-edge industries. Employ advanced techniques to ensure the IP is captured and retained;
Actively seek out intelligence to identify potential strategic allies and then work to develop positive relationships with the contacts identified.
Be mindful that the very status of BTC as an asset or property has still yet to be comprehensively defined by the English Courts.
The future of cryptocurrency?
As crypto continues its march towards mainstream acceptance, the restructuring profession is likely to face more and more of these types of cases and we hope that the advanced asset tracing and recovery techniques that we have employed pave the way for others to follow. It goes without saying that the Opus team would be happy to assist anyone in the crypto (and wider fintech) industry who feels that our expertise and experience would be of assistance.
Allister Manson
Partner - Tech & Restructuring
Opus Business Services Group
Allister.manson@opusllp.com
Nicholas Parton
Partner - Forensic Accounting
Opus Business Services Group
nicholas.parton@opusllp.com