Common legal remedies
For victims of cryptocurrency fraud, Hong Kong, Singapore and other similar common law jurisdictions each have similar legal tools and remedies in place to trace, freeze and recover stolen assets.
While the laws of Hong Kong and Singapore do not directly address ownership and transfer of cryptocurrency, commercial and cyber fraud involving fiat currency have been swiftly tackled by the courts in both jurisdictions using a combination of different legal tools. A similar set of tools can be applied for cryptocurrency:
Norwich Pharmacal disclosure: This order compels an individual or entity based in Hong Kong or Singapore to provide information they hold which is relevant to a fraud. It is not uncommon for banks in these jurisdictions to provide customer information under such orders.
Bankers Trust disclosure: Going one step further, victims of fraud will often want to know whether their stolen funds still remain in the same bank account after the initial transfer. This order can compel banks (or similar entities, such as cryptocurrency exchanges) to disclose information to trace stolen funds.
Freezing injunction: This is a freezing order (also known as a Mareva injunction) which may be granted in Hong Kong and Singapore where a plaintiff has established fraud. This order will restrain a bank from allowing dissipation of funds.
Proprietary declarations and vesting orders: Once monies are frozen in place, the court can vest monies in, or declare monies to belong to, a particular plaintiff. This avoids arguments when multiple parties seek relief against mixed funds.
Garnishee orders: After obtaining judgment (usually by default against fraudsters), this order is available to order the party holding the funds (e.g., a bank or a cryptocurrency exchange) to make payment to you.
Applying old law to new technology
Often, the common law can be quite adept and flexible to accommodate new situations and technology. While the legal tools might remain the same, the approach to tracing and recovering cryptocurrency is very different and involves a different mindset.
No time limitation
It is often said that fraud involving fiat currency is a race against time. If you do not recover quickly, you are likely to have lost the funds forever. The same is not necessarily true for cryptocurrency.
The primary limitation in respect of fiat currency is the ability to trace. While the legal tools are available to seek disclosure, it is onerous and cumbersome to seek a court order every time funds are transferred to a new bank in a new country.
With most cryptocurrency, like Bitcoin, you can freely trace the blockchain indefinitely. Why is this important? Because in most common law jurisdictions, including Hong Kong and Singapore, the limitation period to pursue a fraud claim only begins to run when the victim has discovered the full extent of the fraud.
In many cryptocurrency hacks and frauds, the recipient addresses end up remaining dormant for many years and it may not be possible to link each address to an individual or entity. While the fraud remains concealed, the limitation period will not run. It then becomes a waiting game.
At some point in the future, the fraudsters will want to cash in and the easiest way for them to do so (for the time being) is to transfer the cryptocurrency to a cryptocurrency exchange. If that exchange is based in Hong Kong or Singapore, the full suite of legal remedies described above can be utilized, including a freezing injunction to freeze the account held at the cryptocurrency exchange.
Rules for tracing
One of the greatest hurdles to tracing cryptocurrency arises when fraudsters employ tumbler/mixing services. This is a service that will pool multiple sources of funds together for a random period of time and split them back out to various destination addresses.
Fortunately, dealing with mixed funds is not an uncommon problem for the courts in Hong Kong, Singapore and other common law jurisdictions. A common law principle known as Clayton’s rule has existed for more than 200 years to allow orderly tracing on a ‘first in, first out basis’. This is an important concept which has been widely applied in fraud cases in these jurisdictions.
IP addresses
Every computer connected to the internet has an IP address. There are many ways for hackers to mask their IP address. However, sometimes unwitting or innocent recipients of stolen cryptocurrency will not mask their IP address. This is important because these recipients may hold information critical to the investigation process.
Many cryptocurrencies, like Bitcoin, operate on a peer-to-peer network, which means that when a transaction is made by someone who has not masked their IP address, that IP address can be potentially logged. If that IP address comes from Hong Kong or Singapore, a Norwich Pharmacal order may be used to seek information from the relevant Hong Kong or Singapore internet service provider.
Innocent lawful recipients
With fiat currency, often the stolen funds will come into the hands of an innocent lawful business that had no knowledge of the fraud.
Under common law, if a lawful business can show it provided goods/services for the stolen funds and it had no knowledge of the fraud, the stolen funds can be kept. A bona fide purchaser of property for value without notice of the fraud, commonly known as ‘equity’s darling’, would defeat even the victim’s claim over the stolen funds.
Can a lawful business claim it did not know it was receiving stolen cryptocurrency? This has not yet been determined in Hong Kong or Singapore and will be very sensitive to the facts of the particular situation.
However, an argument could be made that if businesses receive cryptocurrency, they have either done their due diligence, or they accept the risk of potentially receiving tainted cryptocurrency. If the courts in Hong Kong or Singapore accept that argument, it will mean that legitimate businesses may find themselves without the protection of equity’s darling and will be required to return the stolen cryptocurrency to its rightful owners. This has yet to be tested definitively in Hong Kong or Singapore, so watch this space.
Final remarks
Cryptocurrency fraud requires adopting a longer-term mindset and approach to tracing, freezing and recovery. Legal advisers will often need to work alongside cybersecurity experts to identify the appropriate pressure points where both technical and legal remedies are available.
Reed Smith LLP is licensed to operate as a foreign law practice in Singapore under the name and style, Reed Smith Pte Ltd (hereafter collectively, "Reed Smith"). Where advice on Singapore law is required, we will refer the matter to and work with Reed Smith's Formal Law Alliance partner in Singapore, Resource Law LLC, where necessary.
Client Alert 2021-215
