Go back to menu

Stolen Bitcoin frozen as court finds that Bitcoin is property

Ransomware hackers told to let it go

23 January 2020

An English insurer (acting on behalf of its client, a Canadian insurer who was granted anonymity in the proceedings) has obtained a proprietary injunction over $950,000 in Bitcoin which the Canadian insurer paid to deal with ransomware.

This decision is notable for:

  • its finding that Bitcoin is property
  • an order to freeze the Bitcoin held in specified accounts
  • an order that the hearing be private to avoid tipping off persons who might dissipate the Bitcoins, and reprisal or revenge cyberattacks against the applicants.

The decision was issued in December 2019 and released for publication in January 2020.

The insurer had paid the ransom in the wake of a cyber security attack on its systems whereby hackers had breached the firm’s firewall and installed BitPaymer ransomware that encrypted its  IT systems.

Subsequently, the insurer hired a consultancy company who tracked some of the Bitcoin paid to a crypto exchange in the British Virgin Islands.

The insurer applied for orders forcing the exchange to disclose the identities of the persons controlling the account and a proprietary injunction to stop the exchange or the alleged hackers from moving the Bitcoin, but ultimately only pursued the interim proprietary injunction.

Bitcoin is property

Proprietary injunctions can only be granted over property. Hence, to succeed, the applicant had to show that the Bitcoins are property. It was held that while a crypto asset might not be a thing in action on a narrow definition of the term, it does meet the four criteria traditionally understood to define property:

  • it is definable
  • it is identifiable by third parties
  • it is capable in its nature of assumption by third parties
  • it has some degree of permanence. The court was therefore satisfied for the purpose of granting an interim proprietary injunction that cryptocurrencies are a form of property.

In arriving at the decision, Mr Justice Bryan cited from “Crypto Assets and Smart Contracts”, a legal statement by the UK Jurisdiction Taskforce that said they can be dealt with as property. For more on the legal statement, which confirms our previously stated view that cryptoassets are capable of being owned and transferred as property under English law [also see: Do we now have crypto certainty under English law?]

Stolen Bitcoin should be frozen

A proprietary injunction may be granted over stolen funds. The court was satisfied that the requirements for an injunction were met, even stating that so far as the defendants who demanded the Bitcoin and who control the Bitcoins were concerned, he was satisfied that the claims "are very strong" because it had appeared that they had committed extortion and blackmail and obtain the Bitcoins by ransom.

Private Hearing

The order that the hearing be in private is particularly critical in situations where a hack or ransomware is concerned. While the general principle that hearings be held in public is not to be lightly departed, there were compelling reasons in this case to depart from the principle.

First, publicity would defeat the object of the hearing (which was to assist the applicant in recovering the cryptocurrency). Second, there was a real possibility of reprisal or revenge cyber attacks on the insurer or its customer - an analogy was drawn to cases concerning blackmail where it is common for the court to permit hearings to be held in private.

The application was also allowed without notice to the first and second defendants, who if notified, would have taken steps to thwart any order by moving the Bitcoins.