Cryptocurrency Crime on the Rise

Cryptocurrency litigation continues to boom, with hackers on the rise, exposing a range of threats and unforeseen dangers. As James McDonald, enforcement director for the U.S. Commodity Futures Trading Commission (CFTC), said in a statement, “Increased public interest in bitcoin and other virtual currencies has provided new opportunities for bad actors.”¹ Cryptocurrency holders are not only defending themselves against anonymous hackers, they are also facing dangerous physical threats, including armed robbery and kidnapping.

While there have already been several instances of armed robbery of cryptocurrencies in countries like Russia, Turkey, and Thailand, there is now a growing trend of these crimes in North American and European countries. In 2017, a New York man was kidnapped at gunpoint by a friend demanding his keys, wallet, and password. As the victim was detained, the friend broke into his apartment and stole $1.8 million in Ether cryptocurrency.² There are certainly respectable people and organizations in the cryptocurrency space, but investors need to be vigilant to protect themselves. According to New York County District Attorney Cyrus Vance, “we can expect these types of crimes to become increasingly common as cryptocurrency values surge upward.”³ 

In Ottawa, Canada, three armed people entered the offices of Bitcoin exchange Canadian Bitcoins, restraining four employees in an unsuccessful attempt to steal bitcoins.⁴ Around the same time, two Bitcoin traders were robbed at gunpoint in their home in Oxfordshire, England, and were forced to transfer an unknown sum of bitcoins while their infant was left outside in a stroller.⁵ Criminals are now going beyond individual heists and stealing valuable computers. In March, 11 people, including a security guard, were arrested in Iceland in connection with the theft of 600 Bitcoin mining computers worth around $2 million.⁶ The thieves stand to make even more money beyond the value of the stolen equipment if they use the computers to mine cryptocurrency and sell it.⁷

A primary challenge in the criminal cases for cryptocurrency theft is identification. Prosecutors have the burden to prove the trail of the cryptocurrency transactions, how the funds got to various locations, and who executed the transactions.⁸ Even if a case appears to be open and shut given a mound of evidence, because of the anonymity of the entire system, it is very difficult to “follow the money” in a traditional sense.⁹ A number of firms and educational institutions are working to solve these problems by developing forensic tools designed to track the flow of cryptocurrency transactions.¹⁰ Although these systems have their limitations and are in a state of developmental infancy, it is a step in the right direction as law enforcement catches up with technology.

In the meantime, threats of hackers have caused people to go beyond conventional methods to protect their cryptocurrency, even to the point of implanting Bitcoin chips under their skin. Martijn Wismeijer is an example; the Dutch marketing manager accesses his bitcoins in that manner. This adds an extra layer (literally) of protection for his cryptocurrency. The chips were implanted in 2014 and have the ability to make purchases just by a wave of his hand. Wismeijer told CNBC Make It that more than 80 percent of his bitcoins have been lost due to hacks, thefts, exchanges gone bad, and other problems, but the chip prevents against these dangers.¹¹ “If I would’ve had the chip in 2010, I’d probably be a rich man by now,” he said.¹²

Phone companies and third-party automation entities are also experiencing an increased risk of liability in the cryptocurrency arena. One common cryptocurrency theft method is a phone-port attack, where hackers search social media looking for conversations in which investors list their contact information, including a phone number and an email address. The assailants then use that information to pose as the victim and persuade the phone company to transfer the phone number to a device that they control, stealing cryptocurrency in the process. A similar issue resulted in a lawsuit against T-Mobile, after a customer claimed that the company’s lack of security permitted a hacker to gain access to his wireless account and steal crypto-coins worth approximately $20,000. 

Carlos Tapang of Washington filed a lawsuit in federal court on February 4, 2018, seeking damages and remedies under the Federal Communications Act, 47 U.S.C. § 201. Tapang’s complaint alleges claims for breach of contract, negligence, and negligent infliction of emotional distress, among other things, for T-Mobile’s failure to provide reasonable and appropriate security to maintain the security of, and prevent unauthorized access to, Tapang’s wireless account. According to the lawsuit, hackers obtained access to Tapang’s mobile number, allowing them to change the password on his cryptocurrency account and transfer the digital assets.¹³ Although it is unclear precisely how the thieves obtained access to Tapang’s account, the complaint suggests they impersonated him to T-Mobile customer service agents and requested that the phone number be transferred to their own device on AT&T’s network.

As cryptocurrencies continue to grow at a rapid rate, the speed of litigation is following suit. This past January, the CFTC filed a federal civil enforcement action against Patrick K. McDonnell and his company CabbageTech Corp. d/b/a Coin Drop Markets, after his fraudulent Bitcoin scheme left customers penniless.¹⁴ The complaint charges the plaintiffs with fraud and misappropriation and seeks injunctive relief, monetary penalties, and restitution of funds received in violation of the Commodity Exchange Act (CEA). According to the complaint, McDonnell and CabbageTech persuaded customers to give them money and virtual currency in exchange for conducting trades and providing crypto-market tips.¹⁵ Instead, McDonnell took the bitcoins without providing anything in return, and “solicitations involved exaggerations of McDonnell’s trading track record.”¹⁶

The key issue at the start of the litigation was whether the CFTC had standing to sue defendants in violation of the CEA. In granting standing to the CFTC, U.S. District Senior Judge Jack B. Weinstein of the Eastern District of New York opined that the CFTC can regulate virtual currency as a commodity because a “commodity” encompasses virtual currency.¹⁷ And, the CFTC can exercise its jurisdiction over fraud that does not irectly involve the sale of futures or derivative contracts, because it has broad authority that extends to the claim under Title 7 U.S.C. § 9(1).¹⁸

While U.S. courts and agencies continue to wrangle with standing and jurisdiction over various cryptocurrency-related matters and determine whether cryptocurrencies fall under various laws and regulations, this year will be critical for cryptocurrency litigation. As the legal landscape takes shape, both investors and companies will need to keep abreast of judicial decisions that could impact their rights and options if they become victims of cryptocurrency crimes.