Stolen crypto - UK Court of Appeal opens door to software developers' legal duties to users

Introduction

The roller coaster ride that is Tulip Trading v Wladimir van der Laan & Ors – as we have previously discussed – has taken another turn.

On 3 February 2023, the Court of Appeal of England and Wales unanimously decided to allow the appeal of Tulip Trading Limited ("Tulip"), reversing the prior order of the High Court, dated 25 March 2022. In particular, the Court determined that establishing whether or not certain Bitcoin developers owe a legal duty to Tulip – such that they may be compelled to assist Tulip in recovering Bitcoin lost as a result of a computer hack – is a "serious issue to be tried". This determination resulted in the Court of Appeal finding that the English courts do have jurisdiction over the case, as it ensured that the three part test for jurisdiction was found to be satisfied (see, e.g. VTB  paragraphs 99-101). 
As a result, the case is now expected to go to full trial in 2024.

Whilst this decision is largely procedural, and the final position on the existence of any duties will depend on the facts as established at the full trial (e.g. the extent to which the relevant Bitcoin networks are decentralised, and whether it is technologically possible to achieve the remedy sought by Tulip), the decision is a milestone with potentially far-reaching implications for the wider crypto and blockchain world:

1. it (re)opens the door to the imposition of fiduciary duties on software developers who "look after" cryptocurrencies on behalf of users / owners;
2. it may thereby offer victims of crypto theft or fraud a route to recovery; and
3. it indicates that the English courts remain open to adapting complex areas of law to account for fast‑developing technology.

The Court of Appeal Judgment

In its decision, the Court of Appeal focused on evaluating whether there is "a real as opposed to fanciful prospect" of fiduciary duties being imposed on the respondent developers, given the facts of the case. Whilst recognising that, in the words of Lord Justice Birss, "for Tulip's case to succeed would involve a significant development of the common law on fiduciary duties", the Court nevertheless found it to be clearly arguable that fiduciary duties do exist, as the software developers who look after the relevant Bitcoin networks have undertaken roles which bear at least some relationship to the interests of Bitcoin owners.

The Court of Appeal considered there to be a realistic argument that:

"[t]he developers of a given network are a sufficiently well-defined group to be capable of being subject to fiduciary duties. Viewed objectively the developers have undertaken a role which involves making discretionary decisions and exercising power for and on behalf of other people, in relation to property owned by those other people. That property has been entrusted into the care of the developers… The essence of that duty is single minded loyalty to the users of bitcoin software. The content of the duties includes a duty not to act in their own self-interest and also involves a duty to act in positive ways in certain circumstances. It may also, realistically, include a duty to act to introduce code so that an owner's bitcoin can be transferred to safety in the circumstances alleged by Tulip."

In concluding that there was a realistic prospect that fiduciary duties could be found to exist, the Court noted that Tulip had amended its case – moving from its position that a breach of fiduciary duties occurred when the developers did not act following a user raising a theft claim with them, to an amended position which, at its highest, asserted that the alleged duties arose where it was established (e.g. by a court with competent jurisdiction) that a user's cryptocurrency had been stolen. The Court noted that in doing so, Tulip had removed one of "the difficulties with its case". In assessing whether the amended case nevertheless did not stand a realistic prospect of success, on the basis that utilisation of such a court-based standard raised the risk that contradictory judgments could be attained from different courts leading to conflict of laws issues, the Court determined such a risk could not justify a finding that there is no serious issue to be tried – as the Court stated: "[t]he internet is not a place the law does not apply."

The Court of Appeal also made clear that it remains open-minded to the development of this area of law in response to fast technological evolution - as Lord Justice Birss stated, "…the common law often works incrementally and by analogy with existing cases, and rightly so; but if the facts change in a way which is more than incremental I do not believe the right response of the common law is simply to stop and say that incremental development cannot reach that far." It will thus be interesting to see how far the common law of fiduciary duties will advance from existing principles in the final judgment, if at all.

Key observations

This Court of Appeal ruling is perhaps not surprising, given the importance and complexity of the issue as to whether Bitcoin is truly decentralised and the scale of the claim – the Bitcoin in dispute having been valued at some £4bn in 2021. As the Court of Appeal put it, "[i]f the decentralised governance of bitcoin really is a myth, then in my judgment there is much to be said for the submission that bitcoin developers, while acting as developers, owe fiduciary duties to the true owners of that property".

Leaving aside the controversy surrounding Dr. Craig Wright, the owner of Tulip, the reaction to this Court of Appeal decision within the crypto / blockchain community has been divided. On the one hand, the spectre of liability now hangs over crypto software developers in relation to certain types of losses suffered by their users; this may deter some developers/engineers from taking on roles which could conceivably entail fiduciary duties. Notably, as many blockchain networks are more centralised than the networks at the centre of this case – and greater centralisation appears to increase the possibility that fiduciary duties might exist – it is a broad selection of chain administrators that may need to consider the potential implications of this judgment.

On the other hand, this decision may be welcomed by crypto-asset investors, on the basis that it potentially provides an alternative (and more straightforward) route to redress for fraud victims. Currently, crypto owners / investors have little hope of recovering stolen crypto assets and/or private keys, which are at the mercy of the software developers/engineers.

Finally, against the backdrop of the current project on digital assets undertaken by the Law Commission, the Court of Appeal recognised the possible need for statutory intervention if the law on digital assets and blockchain requires developments beyond those possible through common law. Nevertheless, the discussion in this case demonstrates that the English courts are willing to engage with these difficult subjects in order to provide greater legal clarity, as part of the UK's broader strategy to support innovation within the UK's digital ecosystem.