Asset Tracing And Corporate Intelligence Techniques In Cryptocurrency Investigations – Technology – Canada – Mondaq News Alerts

In the first half of 2018, $1.1 billion USD in cryptocurrency
was stolen or trafficked online, with the majority of attacks
targeting either regular businesses or cryptocurrency exchanges.1 By
2019, that figure had jumped to $4.4 billion.2 Despite these
staggering losses, a harsh reality for private cryptocurrency
investigations is that modern-day tracing operations are difficult
to effectively conduct. The development of new altcoins that use
private ledgers also complicate tracing efforts of forensic
accountants, legal teams or law enforcement agencies attempting to
link together cyber money laundering chains. 3

This article outlines commonly-used investigative techniques for
insolvency professionals or asset tracing agents working on
cryptocurrency recovery initiatives. It also summarizes recent
Canadian and American jurisprudence involving recoveries by private
actors, and concludes with an outline of the basic steps that
professionals should take when initiating cryptocurrency
reclamation suits.

Case Law

While there is limited relevant case law in Canada,4 recent
jurisprudence in the United States indicates the growth of a
general procedure for cryptocurrency recovery in asset tracing
cases, especially involving subpoenas seeking information about the
alleged hackers or thieves in question. This development of
American common law is likely to influence procedural techniques in
Canada, especially in the real-time world of bankruptcy and
insolvency litigation. Three of the most relevant of these cases
are summarized below.

White v. Sharabati5

In a landmark 2018 decision, misappropriated
cryptocurrency funds were awarded to a plaintiff, Elizabeth White.
In total, White alleged that she was defrauded 484,000 XRP after an
anonymous individual purportedly stole the assets from her in
exchange for 46.5 BTC, which she allegedly never received. A
complaint was initially filed by White’s legal team in the
Superior Court of Delaware for information held by Bittrex and
Poloniex, two cryptocurrency exchanges where White’s stolen
assets had been warehoused. White’s lawyers were successful in
petitioning the court for Bittrex’s release of client
information, and as a result of Bittrex’s co-operation, Fadi
Sharabati’s identity was released and the cryptocurrency was
awarded to White.

However, in a later shocking twist of events, Sharabati filed a
successful motion in the Superior Court of the State of Delaware to
dismiss the suit on the basis of lack of personal jurisdiction.
Sharabati’s success centered around the court’s comment
that a nonresident using the website of a Delaware corporation
should not be subject to Delaware jurisdiction.6 The secondary
motion, intended to cause the return of the cryptocurrency to
Sharabati, was stayed for forty-five days “to allow [the]
Plaintiff time to file a subsequent action in a proper jurisdiction
and take the steps necessary to protect the garnished
cryptocurrency for litigation.”7 This decision should be used as a
cautionary example for Canadian litigators to carefully determine a
legal forum’s connection to an digital asset tracing dispute,
prior to initiating a lawsuit.

ZG Top Technology Co. Ltd. v. John Doe8

In another cryptocurrency asset tracing case, the United States
District Court (W.D. Washington, at Seattle) granted a motion in
part by ZG Top Technology Co. Ltd. (“ZG
“), a global blockchain asset trading platform,
that filed a complaint against a John Doe for an allegedly criminal
hack. ZG Top alleged that 330,000 USDT and 100 ETH was lost and
transferred to Bittrex as a result of John Doe’s actions. ZG
Top also argued that expedited discovery from Bittrex was required
to freeze the misappropriated cryptocurrency.

READ  La Liga sign partnership with global cryptocurrency firm - Sport Industry Insider

Jones J ruled that “good cause support[ed] ZG Top’s
request for leave to take expedited discovery”9 and also found that
a request for identifying information from Bittrex would be
reasonably likely to lead to the production of information on the
matter. However, the court fascinatingly held against the tracking,
freezing and recovery of the alleged stolen cryptocurrency, as ZG
Top failed to cite authority for “recovery this early in this
lawsuit”.10 This signifies a divergence in
the development of early case law involving cryptocurrency
recoveries: while information may be sufficient for the purposes of
expedited discovery from cryptocurrency exchanges when a fraudster
is identified, a higher bar will likely be set by courts for the
actual freezing of the assets in question.

Rasmussen v. Smith11

In Rasmussen, a court-appointed receiver sued
defendants for the recovery of funds stemming from a cryptocurrency
payment made by an entity, AriseBank, for the purchase of a
non-existent bank. In summary, AriseBank was a start-up venture
that provided cryptocurrency and banking services to corporations,
raising funds primarily by selling its own cryptocurrency called
PIVX coins. AriseBank’s CEO, Jared Rice, signed a term sheet to
purchase a bank from one of the Defendants. However, the
‘bank’ in question did not actually exist. Rice then
transferred 95,000 PIVX coins as a 10% due diligence deposit on the
fraudulent purchase.

The court-appointed receiver sought the return of the coin
transfer to the estate, and then pursued summary judgment on the
outstanding claims of unjust enrichment, conversion, and fraudulent
transfer. The motion against Kurt F. Matthews, one of the
Defendants, was successful, as Lynn J determined that AriseBank had
not received a “reasonably equivalent value”12
for the coin transfer, was financially vulnerable at the time of
the transfer, and was successful at establishing constructive fraud
against Kurt F. Matthews. Matthews was further noted by the court
as being not a good faith transferee.13 While
Matthews’ suggested knowledge of perpetrating a fraud was key
to the recovery of cryptocurrency assets, it will be interesting to
see how Canadian and international courts eventually treat cases
where assets are transferred to third parties, innocent or
otherwise, via darknet markets specializing in the brokerage of
stolen funds.

Procedural Steps

Conclusions can be drawn from the above jurisprudence, which set
out a clear framework of practical steps. These steps involve the

  1. Investigate the movement of the

  2. If misappropriation is discovered,
    retrieve appropriate know-your-client information; and

  3. Initiate a legal action for the
    recovery of assets in the appropriate jurisdiction.

Step One: Investigation

While free tools exist online that can help trace funds,
successful investigations involving digital ‘money’ often
require the involvement of trained professionals who are skilled in
asset recovery initiatives, depending on the volume and type of
laundered asset. When there are significant funds being dispersed
in a rapid time frame, it is recommended that an independent firm
be hired, and/or that insolvency professionals complete asset
tracing training programs. Clients should always keep in mind that
courts will eventually require legal proof of the fraudulent
transfer of these assets.

Corporate intelligence gathering can also be used as a highly
successful tool for clients aiming to trace or link wallet
addresses to individuals or entities. Examples of techniques
involve investigative due diligence through social media analyses
or public records sourcing from financial and/or legal databases.
On a case-by-case basis, consultants, cybersecurity firms and legal
professionals also may have experience monitoring both the general
and the dark web for assets.

Step Two: Know-Your-Client Information

As seen in the above jurisprudence, the practical next step
after tracing has occurred is to petition the relevant court for
the release of know-your-client information from cryptocurrency
exchanges or platforms. A cost-benefit analysis should be conducted
on the potential success of the legal application in question
before beginning an information gathering exercise, as many
exchanges retain privacy information on a jurisdictional basis. As
an example, certain altcoin exchanges let users use their platforms
anonymously, and do not require verification of identities through
traditional know-your-client obligations. It is yet to be seen how
international jurisdictions will implement Canadian court orders in
cross-jurisdictional actions directed against these exchanges.

Step Three: Court Actions

Once the holder of the misappropriated funds is identified,
clients should consider implementing a lawsuit to freeze and/or
recover the assets in question. An example of a legal process to
prevent assets being dissipated is a Mareva

As an equitable remedy, Mareva injunctions are
extraordinary. They require a high legal bar for proof, and are
routinely sought ex parte within Canadian courts.
Mareva injunctions require applicants to establish:14
(i) a strong prima facie case; (ii) that there is a real and
genuine risk that the respondent will put assets beyond creditors
to avoid judgment; (iii) that the moving party will suffer
irreparable harm; and (iv) that the balance of convenience favours
the moving party.15

Mareva injunctions that tie up a person’s digital
assets are extraordinary and blunt instruments that should only be
resorted to in the clearest of cases.16


While investigative efforts taken by forensic teams working to
trace digital assets can be difficult, there are effective forensic
solutions and recovery efforts if the above-listed steps are
followed. The obiter skepticism expressed by both American
and Canadian courts regarding the speculative nature of
cryptocurrencies should also be kept in mind when seeking forms of
preservation orders or Mareva injunctions. As the
dissipation of digital assets is new legal territory, it will be
exciting to watch growing legal trends as courts establish tests
for both the investigation and recovery of online cryptocurrencies
in the insolvency, fraud, and white-collar crime contexts.


1. Kate
Rooney, “$1.1 billion in cryptocurrency has been stolen this
year, and it was apparently easy to do”, (June 7, 2018),
online: CNBC

Gertrude Chavez-Dreyfuss, “Cryptocurrency crime surges, losses
hit $4.4 billion by end-September”, (November 27, 2019),
online: Reuters

Examples include Dash, Monero, and Zcash, which are
cryptocurrencies purposely designed to obfuscate the source or
destination of funds. The exercise of tracing certain of these
altcoins is discussed further in: Haaron Yousaf, George Kappos, and
Sarah Meiklejohn, “Tracing Transactions Across Cryptocurrency
Ledgers” (Paper delivered at the 28th USENIX
Security Symposium, August 2019) at page 10, online at

4. There
is some Canadian precedent for tracing and/or recovery orders in
the context of lost or stolen cryptocurrency assets. As an example,
in 2018 the British Columbia Supreme Court in Copytrack Pte Ltd
v. Wall,
2018 BCSC 1709, granted an order to trace and recover
cryptocurrency tokens, even though the tokens had been transferred
out of the defendant’s wallet into five different

Elizabeth White v Fadi Sharabati, 2019 WL 2897913 (Del Sup

Ibid at page 2.


8. ZG
Top Technology Co. Ltd. v. John Doe,
2019 WL 917418 (Wash Dist

Ibid at page 2.

Ibid at page 2.

Mark Rasmussen v. Richard Smith, 2020 WL 109863 (Tex Dist
Ct) [Rasmussen].

Ibid at page 2.

Ibid at page 3.

Jajj v. 100337 Canada Ltd., 2014 ONSC 557 at para

15. An
example of a groundbreaking Canadian case is Shair.Com Global
Digital Services Ltd. v. Arnold
, 2018 BCSC 1512, where the
British Columbia Supreme Court granted a preservation order over
digital currencies. This case is an example of a situation where a
digital currency consultant was retained to investigate the
movement of digital assets. However, while the preservation order
was granted, the sought Mareva injunction was denied,
given the speculative growth of the investment.

Ibid at paras 25 – 26.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.


READ  Thai crypto exchange Bitkub bags $1.67M in pre-Series A funding - CoinGeek


Please enter your comment!
Please enter your name here