In these proceedings the Claimant, Mr D’Aloia, alleges that he is the victim of a cryptocurrency scam. His claim against the Second Defendant (Binance) has settled and his claim against the Fifth Defendant (Aux Cayes Fintech) was struck out. He has issued a separate application seeking summary judgment against the First Defendants, the Third Defendant (Polo), the Fourth Defendant (Gate) and the Seventh Defendants. The trial before me principally concerned the issues between Mr D’Aloia and the Sixth Defendant (Bitkub).

Broadly, Mr D’Aloia alleges that a fraud was perpetrated on him by the First Defendants in which he was induced to hand over cryptocurrency in the form of Circle (which is not relevant for this trial) and Tether (USDT) totalling around £2.5m. The First Defendants then passed that cryptocurrency through a number of blockchain wallets before it was withdrawn as fiat currency by the Seventh Defendants. Polo, Gate and Bitkub (the Exchange Defendants) were the cryptocurrency exchanges with whom the Seventh Defendants are said to have held their various accounts.

The parties summarised the issues for determination before me by way of an updated List of Issues. This is a lengthy and, perhaps inevitably, rather technical judgment. Parties quite legitimately are generally more concerned about the end destination than the legal route. I therefore start with a brief summary of the issues and my findings.

The pleading issue comprised a number of sub-issues:

Whether the Claimant and Bitkub are correct in acknowledging that the stablecoin, USDT, that forms the subject matter of the Claimant’s claim against Bitkub, is considered property under the law of England and Wales and if so, what is the nature of the property in question and what is the effect of the same on the Claimant’s claim? USDT attract property rights under English law. It is neither a chose in action nor a chose in possession, but rather a distinct form of property not premised on an underlying legal right. It can be the subject of tracing and can constitute trust property in the same way as other property.

Whether the Claimant can establish, as a matter of fact, with reference to expert blockchain analysis, that his “Identifiable Cryptocurrency” reached the 82e6 wallet for which the Bitkub holds the private key. The Claimant has failed to show that any of his funds were received in the 82e6 wallet.

Whether the Claimant can establish, as a matter of law, that USDT 46,291 of his allegedly “Identifiable Cryptocurrency” reached the 82e6 wallet, for which Bitkub holds the private key by reference to the principles of following or, if pleaded, tracing. Specifically, which methods were legally open to the Claimant to follow/trace the allegedly “Identifiable Cryptocurrency” to the 82e6 wallet. This issue raises a number of sub-issues:

Has Bitkub been “enriched/received a benefit by obtaining possession and/or control” of the relevant portion of the “Identifiable Cryptocurrency” that was allegedly comprised within the USDT 400,000 which entered the 82e6 Wallet on 21 February 2022? The receipt of the USDT 400,000 was a benefit to / enrichment of Bitkub. However, the Claimant has failed to show that any portion of his funds entered the 82e6 wallet, so the enrichment was not at the Claimant’s expense.

Whether the Claimant can establish the alleged enrichment of Bitkub is unjust on the basis that the Claimant “has been deprived of possession and enjoyment of his USDT and USDC, and at the expense of his legal title” as asserted in paragraph 37(iv) of the Re-Amended Particulars of Claim. This does not seem to have been pursued as an unjust factor. Rather, the Claimant relies on unauthorised payment and money paid under a mistake, both of which are recognised unjust factors and both of which are adequately pleaded (and, for the avoidance of doubt, have been established on the facts).

If so, whether Bitkub’s enrichment has been at the expense of the Claimant. See above: the Claimant has failed to show that any of his funds reached the 82e6 wallet, so cannot show that Bitkub was enriched at his expense.

Whether Bitkub acted in a commercially unacceptable way with regards to its provision of User Accounts to the Seventh Defendants / Ms Hlangpan (the account holder of the 82e6 wallet). This is not a pleaded allegation said to found any claim but is relevant for the purposes of certain defences advanced by Bitkub. No evidence was advanced in respect of the Seventh Defendants other than Ms Hlangpan ever having Bitkub accounts, so this issue appears limited to Ms Hlangpan. Bitkub did not act in a commercially unacceptable way in providing her a User Account.

Did Bitkub have constructive knowledge and/or actual notice of the Claimant’s beneficial interest in the Identifiable Cryptocurrency? Bitkub had actual notice of suspicious account activity on Ms Hlangpan’s account, such that it could not proceed to pay away sums it received and avail itself of the relevant defences without further inquiry.

Did Bitkub fail to comply with its KYC/AML and corporate governance duties? The concept of failure to comply with a duty is, necessarily, by reference to a particular standard. No proper evidence was advanced as to what those standards were under Thai law at the relevant time. Accordingly, neither party has established compliance / non-compliance with Thai law or practice. Bitkub was on notice of suspicious account activity, however, and failed or failed properly to investigate it, such that it cannot rely on defences premised on good faith.

Did Bitkub fail to:

Is Bitkub entitled to rely on the defence of ministerial receipt? No; Bitkub was aware of Ms Hlangpan’s breaches of withdrawal limits in circumstances where there was a risk of money laundering, such that it had notice that the funds could not properly be released to her without further inquiry. No or alternatively no adequate inquiry was made.

Is Bitkub entitled to rely on the defence of change of position. For the same reasons, no.

Is counter restitution impossible? No.

Whether the Claimant is able to identify a distinct equitable title and certainty of subject matter in the “Identifiable Cryptocurrency” that is alleged to be comprised within the USDT 400,000 that was transferred to the 82e6 Wallet on 21 February 2022. No, on the basis that the Claimant has not established that the 82e6 wallet received any part of his funds.

What is the basis, if any, for the imposition of a constructive trust on Bitkub in these circumstances? I accept that the contract with td-finan (defined below) was nothing more than a fraud and of no effect. On the basis of Martin J Halley v The Law Society [2003] EWCA Civ 97 that gave rise to a constructive trust as against the First Defendants under the principle set out in Westdeutsche Landesbank Girozentrale v Islington Borough Council [1996] AC 669. If that is wrong, in principle the rescission of the agreement with td-finan could have given rise to a constructive trust, again as against the First Defendants, from the date of rescission (Bristol & West Building Society v Mothew [1998] Ch 1). The imposition of such a trust would be prospective from the date of rescission, which was the date of service of proceedings on the First Defendants, although the right to rescind would, in itself, support tracing retrospectively. No such trust was alleged by the Claimant in any of the statements of case, however. No constructive trust arises directly against Bitkub.

Whether it was unconscionable for Bitkub to receive and/or continue to hold the ‘Identifiable Cryptocurrency’ and thereby deny the Claimant’s interest in it. This seems to be a claim premised on knowing receipt. No such claim is pleaded and it was further confirmed, in the course of trial, that no such claim is advanced.

If a constructive trust may be imposed on Bitkub pursuant to the rescission of a voidable transaction on the grounds of fraudulent misrepresentation, when has recission occurred, or will occur, and what is the consequence of the date of rescission for the Claimant’s constructive trust claim against Bitkub? Such a trust can arise and takes effect prospectively from the date of rescission. Rescission can be achieved by bringing proceedings against the contractual counterparty. Since the rescission must be communicated to the counterparty, typically it will be effective on service of the claim form. The constructive trust would arise against the First Defendants, not Bitkub. In principle, such a trust could found a claim against parties that receive the trust property and are not bona fide purchasers for value without notice. However: (i) the claimant has not shown that Bitkub received any of his funds; (ii) it appears that the funds received have been paid away, such that there is nothing against which the proprietary claim can be asserted; and (iii) no claim in knowing receipt is pleaded.

Whether the defence of bona fide purchaser for value without notice is recognised in the context of the transfer of crypto assets? Yes, at least in respect of USDT.

If the defence of bona fide purchaser for value without notice is available in the context of the transfer of crypto assets, what is the appropriate standard of notice that applies? In circumstances where the evidence before me demonstrates that Bitkub was aware of the risk of money laundering, permitted the transactions to go ahead and has offered no explanation or evidence as to why it felt able to do so, Bitkub had sufficient knowledge to constitute actual notice. Accordingly, this specific issue does not arise for determination.

Whether Bitkub can establish the defence of bona fide purchaser for value without notice. No.

Whether Bitkub can be fairly excused from any breach of duty as a trustee on the basis that it acted honestly and reasonably. The question does not arise. In permitting Ms Hlangpan to pay away funds despite (i) receipt of those funds being considered suspicious; and (ii) her repeated breaches of withdrawal limits, Bitkub did not act reasonably. However, in the absence of a constructive trust being imposed on Bitkub there is no breach of duty in the first place.

This was a legally complex case. It was made more complicated because the claim that Mr D’Aloia sought to advance before me was not, in key respects, that pleaded in the Re-Amended Particulars of Claim and the Re-Amended Reply. Several of the issues that I have to decide are therefore pleading issues.

I emphasise at the outset that responsibility for the pleaded case does not rest with Mr Bergin KC or Mr De Azevedo. They did not settle the original pleadings and the scope they had to amend was ultimately limited.

Mr Connell advanced a number of arguments for requiring the Claimant to stay strictly within the four corners of his pleaded case. He stressed the requirements of PD 16 paragraph 8.2, which requires that details of all breaches of trust and notice or knowledge of any fact must be specifically pleaded. He submitted, and I accept, that in order to plead a breach of trust one must first plead what the trust is said to be.

He also referred me to the requirements of the Chancery Guide at paragraph 4.7, which sets out the purpose of the statements of case as being:

Finally, Mr Connell took me through a number of authorities supporting the importance of the statements of case. I note in particular the observation of Mummery LJ in Boake Allen Ltd v HMRC [2006] EWCA Civ 25 at [131]:

Mr Bergin submitted that this was a case where Bitkub was taking purely technical points. It knew, and had always known, the case that it had to meet. That was what mattered. The Court of Appeal has repeatedly stressed balance to be struck between fairness and certainty on the one hand and undue technicality on the other (UK Learning Academy v Secretary of State for Education [2020] EWCA Civ 370 per David Richards LJ, as he then was, at [47]; Dhillon v Barclays Bank plc [2020] EWCA Civ 619 per Coulson LJ at [19]; Satyam Enterprises Ltd v Burton [2021] EWCA Civ 287 per Nugee LJ at [35]).

While there should not be formalism for the sake of it, the statements of case are fundamental to the trial. In the context of this case the statements of case were particularly important to the question of expert evidence. The Claimant now seeks to advance a positive case premised on Bitkub’s alleged failure to act in a commercially reasonable manner in the way it permitted Ms Hlangpan to operate her account. The Claimant applied to adduce expert evidence on compliance and AML, which application Bitkub opposed in part on the basis that no issue between the parties required expert evidence in the field of “Compliance and AML”. Permission was refused by Master Pester in February this year. Had a positive claim been pleaded premised on breaches of Thai law on KYC/AML, Bitkub may well have taken a different decision in that regard.

The position is compounded because there has already been an application to amend, which was rejected by Bacon J in a judgment given on 13 February 2024. Permission to appeal that judgment was sought from the Court of Appeal and refused. If I were to allow a case to be advanced that reflected those amendments, I would be allowing a collateral attack on Bacon J’s judgment. Plainly, that is unacceptable.

Mr Bergin is a skilled advocate; in various ways he stretched the statements of case to their limit. In assessing where that limit was I had in mind the need not to be “pernickety” (Boake Allen Ltd) nor to allow “technical points [to] be used to prevent the just disposal of a case” (UK Learning Academy). In many cases I accepted that Mr Bergin was entitled to take the points that he did; where he went too far, however, that was itself a proper ground on which Bitkub could resist Mr D’Aloia’s claim.

There was a further aspect to the pleading question that was less prominent but, to my mind, of equal importance. In its Re-Amended Defence Bitkub advanced defences of good faith change of position, bona fide purchase and ministerial receipt. It did so on the basis that Bitkub “was at all material times wholly ignorant of any facts alleged to affect its conscience” (Re-Amended Defence paragraph 7.6) “acted in good faith at all material times” (paragraph 8.6) and “relies on the defence of ministerial receipt” (paragraph 8.7).

In closing, Mr Connell advanced further points, to the effect that if Bitkub was aware of any suspicious account activity it might have been due to its unusual diligence, or transactions may have gone ahead because of a system malfunction or there might have been an investigation into any suspicious activity that concluded satisfactorily. None of those were pleaded.

Mr Bergin took no pleading point in respect of this, perhaps for understandable reasons. A party is entitled to decide that it does not object to its opponent departing from its pleaded case, and in those circumstances the court will not typically require amendment (Loveridge v Healey [2004] EWCA Civ 173 at [23]). However, the fact that Mr Bergin did not raise these points in respect of the statements of case did not, in any way, limit the attack he was entitled to advance on the ground that the submissions were unevidenced.

Mr D’Aloia is the Claimant in this case. He gave evidence as to the circumstances around his transfer of USDT to td-finan, the proceeds of which he now seeks to recover. He was an honest witness whose evidence was not seriously challenged and I accept it.

Mr Dhanasarnsilp is a Director of Risk Management and Investigations at Bitkub. He gave his evidence by videolink and through a translator. The quality of the link throughout his evidence was good and I felt I had a good impression of him as a witness. I found him to be honest and straightforward and clearly attempting to assist the court. Again, I had no reservations in accepting the evidence he was able to give.

The only issue with Mr Dhanasarnsilp’s evidence was that he was not involved in events at the time. He had relevant firsthand knowledge of the Bitkub platform and how it operates but was not involved in the transactions that occurred on 21-24 February 2022 that form the core of this case. Through no fault of his, that limited the assistance his evidence could offer.

Miss Vijitpinyo is an Assistant KYC Manager at Bitkub. She explained in her witness statement that this is a “senior manager role at Bitkub”. Again, she gave her evidence via videolink and through a translator but again the quality of the link was good throughout. She, like Mr Dhanasarnsilp, had had no involvement with the transactions in question prior to proceedings being commenced.

She was very cautious in her answers, to the extent that Mr Bergin directly put it to her that she was being evasive. With one significant exception I do not accept that. The fact is that she had little directly relevant evidence to give other than as to Bitkub’s processes; it was unsurprising to me that she frequently ended up referring back to them. Moreover, at one point she was being questioned about an unofficial English translation of a Thai law being translated back to Thai for her by the court interpreter. Miss Vijitpinyo is not a lawyer, but even a lawyer would have struggled with those questions in the circumstances. I would characterise her evidence generally as careful rather than evasive, but the end result was the same; I accept Mr Bergin’s submission that her evidence was of only limited assistance.

The exception was a question that was put to her as to the purpose of daily withdrawal limits on customer accounts. Mr Bergin put it to Miss Vijitpinyo that the limits were in place to reduce the risk of money laundering. She said she did not know why such limits were in place. Frankly, I did not believe that answer.

In my view, someone in Miss Vijitpinyo’s position, a position she described in her witness statement as a “senior role” in the KYC function, ought to have known the purpose of daily limits. Moreover, I think she did know. Miss Vijitpinyo’s evidence was that she was “very familiar” with the different customer levels within Bitkub and the need for enhanced KYC if a customer wanted higher withdrawal limits. She addressed the way that Bitkub’s systems generated risk scores, and the way that the due diligence process can take longer for customers considered high risk. Miss Vijitpinyo explained in her statement that she could not disclose details of the processes undertaken for those customers because of concerns that doing so might violate the Thai Anti-Money Laundering Act, directly linking higher daily withdrawal limits with the need for enhanced KYC and an increased risk of money laundering. That was precisely the connection that Mr Bergin put to her. She further explained in her statement that KYC was conducted by employees involved in Bitkub’s Anti-Money Laundering or Counter Terrorism or Proliferation of Weapons of Mass Destruction Financing Policy. She was, as I have noted, in a senior role in that team; as she acknowledged in her statement, she therefore needed to have an understanding of Bitkub’s AML/CFT policies.

The only realistic conclusion, it seems to me, is that Mr Bergin was right, that the daily withdrawal limits were driven by Bitkub’s AML policies and that Miss Vijitpinyo was uncomfortable acknowledging the position.

I had no witness evidence from Bitkub from anyone involved at the time of the relevant transactions. Specifically, I was told that a block would have been placed on Ms Hlangpan’s account immediately before the receipt of funds said to include those of Mr D’Aloia. That block was in place because she breached her daily withdrawal limits, and as such was there to address the risk of money laundering. Neither of Bitkub’s witnesses could explain how or why that block was removed. That gap in the evidence was, so far as I could ascertain, Bitkub’s choice and is relevant to some of the findings I have to make.

The experts, Mr Moore and Mr Pinto, both have extensive intelligence experience, Mr Moore in the armed services and Mr Pinto in the police. Both are now private investigators specialising in blockchain analytics.

I regret to say that I found the evidence of both experts, particularly their reports, not to be especially helpful. That is especially problematic in a case such as this, where much turns on their work to understand the flow of funds, if any, from Mr D’Aloia to the 82e6 wallet.

That alleged flow occurred over a series of 14 transactions, or Hops, on the blockchain. The blockchain creates an immutable, publicly accessible record of transactions, yet even reconciling what the experts thought the 14 Hops involved in the form set out at paragraph 80 of this judgment was far from straightforward. It seems that, at least in parts of his evidence, Mr Moore had the payment out of wallet 1dDA as Hop 1, whereas Mr Pinto had treated the first payment into 1dDA as Hop 1. Mr Moore gained a Hop at the end by including the sweep into the Bitkub hot wallet, which I will go on to describe.

Mr Moore has been subject to criticism by Bitkub for inaccuracies in his reports, which in part was fair for reasons I address later in this judgment. But it was equally the case that reconciling the times of different transactions within Mr Pinto’s report was difficult, if not impossible, since what seem to be the same Hops are described with different time stamps in different tables. Equally, wallet addresses in places appeared to be incorrect and in one case (Hop 12), Mr Pinto identified two different transactions as the same Hop. Payments in the table analysing the Hop 1 transaction are described as “Inbound (non-claimant)” yet appear to come from Mr D'Aloia’s Coinbase account. Finally, Mr Pinto used the term Hop to describe both the movement of funds and the origin or destination of those funds. For example, he described Hop 2 simply as “Hop 2”, but the next transaction as “Hop 2 to Hop 3 transaction”. It would have been clearer had he been consistent.

I was also concerned that there was so little attempt to find common ground on the issues, when in fact it transpired that there were numerous areas on which the experts agreed. This was most evident in what was described as the joint statement from Mr Moore and Mr Pinto. In fact, it was nothing of the sort. Mr Pinto made certain assertions; Mr Moore responded. Yet when I asked Mr Moore whether he agreed with certain limited aspects of Mr Pinto’s portion of the statement he confirmed that he did. I am sure that the reverse would equally have been true. It should not have required a question from me to ascertain that.

In closing Mr Bergin submitted that Bitkub had not put its case squarely to Mr Moore. Specifically, while it was put to Mr Moore that his methodology was not FIFO, it was not put to him that the methodology he used was inaccurate or unreliable. Accordingly, he was not given the opportunity to explain why he considered that his results and conclusions were reliable and accurate. In the Claimant’s written closing it was argued that it was not open to Bitkub to challenge Mr Moore’s methodology; in oral closing Mr Bergin accepted that it was open to Bitkub to make that submission, but cautioned that it was a factor I needed to take into account in considering Mr Moore’s evidence. He referred me to Markem Corp v Zipher Ltd [2005] EWCA Civ 267 and BPY v MXV [2023] EWHC 82 (Comm).

Mr Bergin further noted that Mr Pinto had not offered any alternative analysis; indeed, he undertook no tracing analysis at all. Accordingly, he submitted, there was no evidence before me that formed a basis to challenge Mr Moore’s conclusions.

Mr Connell, in closing, rejected the criticism and took me through the sections of Mr Moore’s cross-examination where Bitkub’s case had been put to him.

The law on this issue was recently summarised by Butcher J in BPY at paragraph [34]:

I also had in mind the guidance given in Chen v Ng [2017] UKPC 27 at [52]-[57].

I accept Mr Bergin’s point that Mr Pinto’s analysis was limited and essentially negative – he sought to show that Mr Moore had not used the FIFO methodology. I also accept that Mr Moore’s cross-examination was fluid and at times jumped from topic to topic. It was not always easy to follow. Finally, Mr Bergin rightly noted that no time limits were imposed on Mr Moore’s cross-examination.

Set against that Mr Moore’s evidence was advanced in a way that was chaotic and, ultimately, contradictory. For reasons that I come on to address, Mr Moore’s report purported to rely on, and only on, FIFO. There was some argument by the Claimant that Mr Moore had not used “strict FIFO” but had instead used “customer FIFO”. That simply added to the confusion. In using the term FIFO in this judgment I refer to the rule in Clayton’s Case – a strict application of the approach whereby the first amounts paid into an account are deemed to be the first amounts paid out. That is also what Mr Moore stated, in terms, his understanding of FIFO to be in his report prepared for use at trial (the Arrowsgate Report) and the justification he offered for his approach related to FIFO, not some other methodology.

In fact, it was apparent that Mr Moore was not using FIFO from a relatively early stage, indeed from before the date of the Arrowsgate Report. By the time of what is described as the experts’ joint statement, on 6 March 2024, Mr Moore’s stated position was that FIFO was not workable, or at least would be “incredibly time-consuming and difficult to complete accurately”. He explained at paragraph 2.6 of that statement that the methodology he used was taught by Crystal Blockchain and TRM Labs, the software that he employs. As I will address when considering Mr Moore’s evidence, those systems produced quite different results, as Mr Moore acknowledged during his cross-examination, and so presumably employ different methodologies and approaches. Nowhere in the joint statement did Mr Moore set out those methodologies, or indeed his own to the extent it is different. Nothing was exhibited evidencing the Crystal Blockchain or TRM Labs methodologies, potentially in breach of PD 35 paragraph 3.2(2).

Details of what that methodology was said to be were only set out in correspondence from Giambrone & Partners on 31 May 2024, less than a week before trial started. Remarkably, no attempt was made to serve a supplemental report from Mr Moore correcting the methodology section of the Arrowsgate Report. Again, nothing was provided from Crystal Blockchain supporting the assertion that Giambrone & Partners had accurately summarised the methodology. The Claimant’s expert case at the start of trial was, therefore, that Mr Moore had used FIFO (which remained the position in the Arrowsgate Report), had not used FIFO (which was obvious from his answers to questions asked by Binance and by Bitkub), and that FIFO was not practically workable in this case (the experts’ statement). The Claimant’s position in correspondence was a new methodology set out in Giambrone & Partners’ letter. That methodology was inconsistent not just with FIFO but with the earlier iterations of Mr Moore’s methodology.

One of the factors to which I must give considerable weight in considering whether Bitkub’s case was properly put to Mr Moore is procedural fairness to the Claimant; it seems to me that this sequence of events is relevant to that question. By the time of trial it was simply not clear what Mr Moore’s methodology was said to be and there was no evidence showing what he claimed was the basis for this approach. In the circumstances, it was unsurprising that the challenge to Mr Moore’s approach was put in general terms.

That can be seen in his cross-examination. The position set out in Giambrone & Partners’ letter was adopted by Mr Moore during his cross-examination. After some back and forth over an example, there followed a challenge to that methodology:

Mr Moore then clarified that he was not referring to the crypto-industry as a whole as a “giant washing machine” and his evidence moved on to other issues.

The cross-examination came back to his methodology towards the end:

It therefore seems to me that at least the following were put directly to Mr Moore:

In the circumstances I accept that it is open to Bitkub to submit that Mr Moore’s methodology was incorrect and lacked a principled basis. It is also open to Bitkub to submit that the number arrived at was wrong because Mr Moore had followed false leads, which I take to include tracing the money into the wrong account. It can challenge Mr Moore’s application of the methodology to the figures.

Moreover, as I go on to address, there are serious difficulties in applying Mr Moore’s methodologies to the flows of USDT in this case, simply as a matter of mathematics. In my view, even where those were not directly put to Mr Moore in cross-examination it is also open to me to identify where, numerically, the figures do not add up. I say that for two reasons. First, when Mr Moore was asked to justify his figures he instead answered by reference to his mission to identify those responsible for the fraud. Secondly, it is hard to see what alternative answer he could have given when the question is purely or largely numerical.

This claim is not about cryptoassets in general but, specifically, about cryptocurrency and, more specifically still, USDT, a stablecoin tied to the value of the US dollar.

The original cryptocurrency was Bitcoin. In proposing the idea in “Bitcoin: A Peer to Peer Electronic Cash System” (the Bitcoin White Paper), Satoshi Nakomoto observed (my emphasis):

Much of the paper then addresses the problem of double payment, which Bitcoin was designed to solve, and the integrity of the system against attack. So far as is relevant for this judgment, what is striking about the Bitcoin White Paper is that Bitcoin was never based merely on trust, it was based on cryptographic proof. The idea was that with sufficient computational power Bitcoin would be secure without the need for legal rights. One of the issues raised with cryptocurrencies being property is that they are not based on legally enforceable rights; they are, however, intended by the participants in the system to be secure and enforceable.

In Tulip Trading v Van der Laan [2023] EWCA Civ 83 Birss LJ summarised the operation of Bitcoin. Mr Bergin emphasised that USDT does not sit on the Bitcoin blockchain but, rather, on a layer above it (and linked to it) called the Omni Layer. Otherwise, the parties agreed that this is also an accurate summary of the operation of USDT:

In “Tether: Fiat currencies on the Bitcoin blockchain” (the Tether White Paper) the authors emphasised (page 1):

Proof of Reserves was an important element of the Tether White Paper (page 4):

A consequence of this was that (page 8): “Tether Limited is the only party who can issue tethers into circulation (create them) or take them out of circulation (destroy them).”

USDT therefore built on the Bitcoin idea of a system that replaced the need for trust with cryptography rather than rights. It appears that there may have been legal rights associated with the USDT in the form of exchangeability for fiat currency, but there was no evidence before me as to what those rights might have been or how they operated.

Mr D’Aloia is the founder of Microgame, which operates in real money and online betting markets. Microgame has been very successful and the profits from that success have permitted Mr D’Aloia to build a portfolio of investments. In December 2021 he was considering further investment opportunities and in particular an investment through a website, https://td-finan.com (td-finan).

Mr D’Aloia took this to be associated with TD Ameritrade. In fact, the two are entirely unconnected. TD Ameritrade is a regulated US brokerage with substantial assets under management; td-finan was a scam alleged to have been operated by the First Defendants in these proceedings.

Believing that he was dealing with a legitimate operation, on 21 December 2021 Mr D’Aloia opened an online trading account with td-finan. On 22 December 2021 Mr D’Aloia started to transfer cryptocurrency to wallets associated with his account.

For the purposes of the current claim the critical steps started on 10 January 2021, when Mr D’Aloia transferred funds to the 1dDA wallet controlled by the First Defendants. Mr D’Aloia asserts, on the basis of Mr Moore’s evidence, that through a series of 14 Hops a part of those funds, arrived in a Bitkub wallet linked to the account of Ms Hlangpan (the 82e6 Wallet). For ease of reference I will refer to Ms Hlangpan as the controller of the 82e6 Wallet. In fact, she may either have exercised only nominal control, simply following the instructions of others, or no control at all, having handed over control to someone else. The total transferred to Ms Hlangpan was USDT 400,000, of which USDT 46,291 is said to have been either the USDT belonging to Mr D’Aloia or their traceable proceeds.

The validity of Mr Moore’s tracing exercise, including whether it was tracing at all, is a key issue in dispute. Moreover, as I have noted, it seemed to me there was some confusion in the expert evidence over which Hops are which. For the sake of clarity, I understood the position to be as follows (using abbreviated descriptions of the various wallets for convenience).

Bitkub, as I have noted, is a cryptoexchange. It offers its customers custodial digital wallet services for cryptocurrency, including USDT. The difference between a custodial and a non-custodial digital wallet is that in the case of the former the exchange, here Bitkub, manages the private key necessary to execute transactions on the blockchain; in the latter, the customer would control the private key. What that meant for current purposes is that in order to execute any transaction, Ms Hlangpan had to instruct Bitkub, who would execute it on her behalf.

Ms Hlangpan opened her Bitkub account in May 2021. Miss Vijitpinyo’s evidence was that although she was not involved in the process at the time, for the purposes of this litigation she had reviewed the account opening documents for Ms Hlangpan’s account and considered that all relevant anti-money laundering, KYC and customer due diligence processes had been complied with.

She was challenged on this by Mr Bergin by reference to an unofficial translation of a Notification of the Bank of Thailand and a Thai Ministerial Regulation in place at the time. It is worth emphasising how remarkable this was. As I have noted, Miss Vijitpinyo gave her evidence through a translator. Yet Miss Vijitpinyo was not referred to the Thai law itself; the unofficial translation was translated back to Thai for Miss Vijitpinyo by the translator in court. Unsurprisingly, Miss Vijitpinyo, who is not in any event a lawyer, could offer no meaningful assistance in such circumstances. Mr Bergin further referred to investigations carried out by Mr Moore and by Mr D’Aloia’s solicitors, including in respect of Ms Hlangpan’s social media accounts, her residential address and the use of her WhatsApp.

Even assuming that research was factually accurate, it was impossible to assess what significance, if any, it had. Bitkub is resident in Thailand and is subject to Thai law. To consider its compliance with that law would have required expert evidence on Thai KYC and money-laundering procedures in place in May 2021 – permission for which was refused by Master Pester – and for the case to have been pleaded – permission for such amendment having been refused by Bacon J. The issue was highlighted by Mr Connell, who noted that the Bank of Thailand Notification did not in fact apply to Bitkub. That, equally, was not supported by expert evidence, but the burden of showing that the Notification was relevant to Bitkub rested on the Claimant, and in the absence of expert evidence it was not one that the Claimant could discharge. Mr Bergin submitted that he was not alleging a breach by Bitkub of Thai law but, rather, giving an indication of what was usual in the Thai market. That seemed to me to go nowhere. The fact that there were other laws applying to other types of financial institutions told me nothing about what Bitkub was required to do.

In the absence of expert evidence contradicting Miss Vijitpinyo, I accept her conclusion that Bitkub considered there was nothing from a KYC perspective to raise concerns with Ms Hlangpan’s account when it was opened.

Miss Vijitpinyo further explained that Bitkub has two levels of due diligence. A level one customer has to provide their name, address, date of birth, gender, marital status and national ID card number. They also provide a second number (which I understood may be represented in the form of a barcode) from the back of their ID card which allows Bitkub to access their record on the relevant Thai Government database for verification purposes. Mr Bergin put to Miss Vijitpinyo that the ID card check is the only external verification that Bitkub carried out, and I accept that it was. Everything else was under the control of the customer. Again, however, in the absence of any evidence showing that the relevant Thai law required further checks, I do not consider that the Claimant has established a failing on the part of Bitkub.

One further piece of information that the customer must provide (but which is not verified) is their income. Ms Hlangpan’s gave her income as THB 15-29,999 per month.

To move to level two a customer must provide further proof of address and proof of income. The principal difference between the levels is that a level two customer has higher daily withdrawal limits – THB 15 million per day for level two as opposed to THB 2 million for level one. As I have noted in considering Miss Vijitpinyo’s evidence, those limits were in place to address concerns over money laundering. Ms Hlangpan was (and I understand still is) a level one customer of Bitkub.

The funds arrived in the 82e6 wallet on 21 February 2022 at 5:18am GMT (which was 12:18pm local time in Thailand). Mr Dhanasarnsilp’s evidence was that the receipt would be considered suspiciously large for somebody with Ms Hlangpan’s declared income and would trigger an alert that somebody should have investigated. Shortly before on the same day Ms Hlangpan had made a series of five withdrawals in the course of three minutes totalling THB 9 million, significantly in excess of her daily limit as a level one customer. Mr Dhanasarnsilp explained that Bitkub’s systems block further withdrawals once the daily limit is reached and trigger a further alert; again, he explained, that should have been investigated.

Neither witness was involved at the time and they did not know, and had no reason to know, why further transactions were permitted after the block was imposed. Bitkub did not offer any evidence as to what had happened, but it cannot sensibly have been the result of an investigation into Ms Hlangpan’s withdrawal activity that provided a satisfactory answer because the whole series of five transactions was completed in a very short space of time. Mr Bergin put to both witnesses that it could only be either a system error or a failure by Bitkub’s employees to investigate. On the evidence before me, plainly that is right.

At 5:23am the 82e6 Wallet was swept into the Bitkub hot wallet and USDT 400,000 was credited to Ms Hlangpan’s account. The operation and legal effect of sweeping was summarised by Trower J in Piroozzadeh v Persons Unknown [2023] EWHC 1024 (Ch) at [8], and I gratefully adopt his formulation of them:

I would add only two glosses to that summary for the purposes of this case. First, the evidence before me suggested that the exercise of tracing after the USDT had been swept into the hot wallet may, in fact, be something that could be carried out by Tether Ltd itself. Secondly, however, it would be an academic concern for at least the unjust enrichment aspects of Mr D’Aloia’s claim because once the link has been made to Bitkub, even at common law it is irrelevant that one cannot trace further (see Agip (Africa) Ltd v Jackson [1991] Ch 547 at 566B).

Over the next hours Ms Hlangpan converted the USDT 400,000 into THB (totalling THB 13,684,995.91) and proceeded to withdraw almost the entirety of those funds on 22 and 24 February, again in obvious breach of the daily limit on withdrawals. Bitkub’s systems would have imposed multiple blocks on her account but there is no evidence to suggest that any investigation was conducted. Bitkub offered no reason for why it allowed its systems and controls to be bypassed with such apparent ease.

For completeness, I note that Ms Hlangpan received a further USDT 300,000 on 24 February 2021, which again was converted into Thai baht, of which THB 9.7 million was withdrawn the same day. In summary, someone with a declared monthly income of between THB 15,000 and 29,999 had received the equivalent of a little over THB 24 million into her Bitkub account in the form of cryptocurrency and withdrawn a total of THB 33 million in the space of three days. On the evidence of Bitkub’s witnesses multiple alerts would have been raised and the account blocked multiple times. Yet the evidence suggests that no meaningful investigation was carried out by Bitkub in response.

It was put to both of Bitkub’s witnesses by Mr Bergin that Ms Hlangpan was a money mule, who allowed her Bitkub account to be used for the purposes of money laundering. They had no explanation for how Ms Hlangpan could legitimately have obtained those funds, nor could they explain why nothing was done to investigate what was obviously suspicious account activity that breached Bitkub’s procedures for level one customers. As I have repeatedly emphasised, that is no criticism of those witnesses; they had no reason to know. But theirs was the only evidence that Bitkub put forward.

It is accepted by Bitkub that Hop 1 is part of the td-finan fraud on Mr D’Aloia. Mr Moore’s evidence that the Hops were laundering on a large scale – “a giant washing machine” – was not challenged. In any event it seems to me right. When the money started to move from Hop 2 onwards it did so quickly, at times spending only seconds in a wallet. No good reason was suggested for this and I accept Mr Moore’s conclusion that it was simply an attempt to obfuscate the flow of funds and throw anyone trying to track the funds off the trail. That, in turn, supports Mr Moore’s conclusion, which I accept, that Hops 2-13, and most likely Hops 1-13, were the work of a single controlling mind.

Finally, I accept Mr Moore’s evidence, which seemed to be common ground, that at some point the fraudsters need an “off-ramp”, a route to get the funds off the blockchain and into the traditional banking system. That accordingly means that I accept a link between the First Defendants and Ms Hlangpan, in that the blockchain shows that she received USDT 400,000 and for the reasons I give I have concluded that it comes from the party or parties behind the td-finan fraud. It follows that Ms Hlangpan and, in turn, Bitkub were in receipt of laundered funds.

I recognise that Ms Hlangpan may have an explanation that shows she was not knowingly involved in the fraud. I am also conscious of the guidance given in cases such as MRH Solicitors Ltd v The County Court Sitting at Manchester [2015] EWHC 1795 (Admin) at [34]:

This is a different case to MRH, however, in that the Seventh Defendants of whom Ms Hlangpan is said to form a part have been served with these proceedings in accordance with the court’s order and allegations of fraud are plainly part of the pleaded case against those defendants. She has had the opportunity to rebut the allegations but has not done so. In any event, as the decision in MRH contemplated at [24]: “In complex commercial frauds it may well be that part of the case that an absent person or institution was party to dishonest conduct somewhere in the chain.” Ms Hlangpan’s role is significant in considering Bitkub’s defences of bona fide purchase, good faith change of position and ministerial receipt and I need to make findings in respect of it.

In my view the Claimant has established that Ms Hlangpan not only received laundered funds but also had some active involvement in the fraud, whether as a perpetrator of it or as a money mule who lent the use of her account to those behind the fraud. No sensible honest explanation has been offered for the flows of funds through her Bitkub account, regularly involving sums well in excess of her stated earnings. That activity would have triggered multiple alerts within Bitkub but Ms Hlangpan was allowed to proceed, in that the automatic blocks on her account must have been lifted by Bitkub without any meaningful investigation. The automatic block was there to address the risk of possible money laundering; lifting that block permitted the very off-ramping it was designed to stop. It was a very significant failure in Bitkub’s internal systems and controls.

Mr D’Aloia made further transfers to td-finan after 25 February 2022. These are not part of his monetary claims: he does not allege that he can trace from any of the sums he transferred after that date into the 82e6 Wallet or, indeed, into any other wallet controlled by Bitkub. They are relevant in showing that Mr D’Aloia was the victim of a fraud. They are also relied on by Bitkub to show that such fraud could not reasonably have been suspected at the time.

Since the facts are not contested they can be taken quite quickly:

On 1 June 2022 Mr D’Aloia contacted Giambrone & Partners, his solicitors in these proceedings, and in the course of June 2022 they consulted with Mr Moore, his expert before me. Following these discussions, Mr D’Aloia came to realise that td-finan was a sham and he was the victim of a significant fraud.

The status of cryptoassets as property has been repeatedly addressed at interim hearings and was recently the subject of a Law Commission Report, Law Comm No 412 “Digital Assets: Final Report” (the Final Report). Counsel had not identified any previous case in this jurisdiction where the question had to be decided at trial, however.

The nature of USDT is relevant to these proceedings, but it is important to note at the outset that neither party sought to suggest that USDT could not be property. Mr D’Aloia is seeking in these proceedings to recover cryptoassets; it is not remotely in his interests to say that those assets are not property because to do so would prejudice his ability to follow or trace them. Similarly, Bitkub is a cryptoasset exchange; its business model is premised on that exchange serving some function. The statements of case reflected that consensus.

Courts determine disputes, not hypotheticals, and there is an argument for saying the point should be left for another day. On balance, however, I do not believe that I can. Central to this case are issues of tracing and following of assets. Addressing those issues depends not just on the USDT being property, but the nature of the property rights associated with them. Specifically, Bitkub asserts that the USDT cannot be followed or traced through a mixed fund; the Claimant’s position on that is more nuanced but ultimately he does not accept that Bitkub is right. It seems to me that the answer depends on the nature of the property interest in USDT, on which the parties were also at odds.

Both parties accepted that USDT is something to which property rights can attach, and both referred me to the Final Report. Mr Connell swung in firmly behind the Law Commission’s conclusions. Mr Bergin focussed more heavily on whether the rights and remedies that adhered to other property also adhered to USDT; if they did, he submitted, it did not matter whether USDT was technically property.

There is now a strong line of authority in this jurisdiction accepting that, at least for the purposes of interim applications, there is a good arguable case that cryptoassets are to be treated as assets to which property rights can attach. The starting point is generally taken to be Bryan J’s judgment in AA v Persons Unknown [2019] EWHC 3556 (Comm). An insurer had paid a ransom in bitcoin (Footnote: ¹) on behalf of its insured customer. It sought, among other things, a freezing injunction and a proprietary injunction against both the parties that made the ransom demand and the operators of two exchanges on which the bitcoin were held.

Bryan J adopted the reasoning in the Legal Statement of the UK Jurisdictional Task Force (the UKJT) of November 2019 and accepted that property was not limited to choses in possession and choses in action. At paragraph [59] he concluded:

The Final Report noted that, at the date it was published, that test had been cited with approval in 14 subsequent cases; a total of 23 cases had accepted, expressly or implicitly, that cryptoassets such as bitcoin are property.

The position is most definitively stated in Tulip Trading v Van Der Laan [2023] EWCA Civ 83. At paragraph [71] of this judgment I have quoted the core of Birss LJ’s analysis at [21]-[25]. It is worth further noting his observation at [72]:

A number of points flow from Birss LJ’s judgment. First, there is broad recognition that it is at least arguable that cryptoassets attract property rights. I frame it in that way because the decisions have been in the context of interim applications, where no final determination needed to be made, but in fact the judgments have been more definitive than that and have found that such assets do attract property rights. Secondly, a key aspect of cryptoassets is that they are rivalrous, that is to say ownership by one person prevents ownership by another. That can be contrasted with information, which is not rivalrous even if it has value – the fact that I know the post code for the Rolls Building does not give me any means to stop you also obtaining that information, nor does your obtaining it in any way dilute my own knowledge. Thirdly, cryptoassets exist as something outside the minds of their users.

The Final Report at 3.48 endorsed the approach taken by the courts:

It added further to the analysis of Birss LJ by noting at 3.68 that:

This, it seems to me, is both right and significant in the analysis: cryptoassets have a conceptual existence that is independent of the legal system and of their individual users.

While the bulk of academic commentary supports those positions, strong arguments have been advanced in opposition. Two, in particular, are raised in the Final Report and are important to address in considering both whether USDT attract personal property rights and, if so, what form the property interest takes.

In his article “Crypto is not Property” (2023) 139 LQR 615 Professor Stevens advances an argument based on the nature of property, which, he submits, is inextricably tied to legal rights. That is most apparent in the case of choses in action. As Professor Stevens observes, those are “rights only capable of being vindicated through court action, that do not have as their subject matter a thing capable of possession” (page 618). However, as he goes on to note, tangible property is also about rights:

“Choses in possession” refers to rights in relation to things that are capable of being possessed (i.e. rights to tables, chairs, and mobile phones etc). Such rights are, of course, also capable of being vindicated through court actions.

The analysis up to this point is uncontroversial. For example, the Law Commission reached the same conclusion (Final Report paragraphs 3.28-3.30).

Where the difference seems to arise is that advocates for treating cryptoassets as property argue for the recognition of a third class of property that would require them to be neither choses in possession nor choses in action. Professor Stevens rejects that (pages 618-619):

The reference to Hohfeldian claim-rights, powers, privileges and immunities is, I understand, a reference to a distinction drawn by Professor Hohfeld, in two articles both titled “Fundamental Legal Conceptions as Applied in Judicial Reasoning” in (1913-14) 23 Yale LJ 16 and (1916-17) 26 Yale LJ 710. Professor Hohfeld summarised his concern at (1913-14) 23 Yale LJ 28-29:

He then addressed a particular case in point: the use by lawyers of the term “right” (page 30): “the term ‘rights’ tends to be used indiscriminately to cover what in a given case may be a privilege, a power, or an immunity, rather than a right in the strictest sense”. By a “right in the strictest sense” he meant what he called a claim and Professor Stevens calls a claim-right: a right that is matched by the party against whom it is held owing the corresponding duty, which duty can be legally enforced. If I have a right to be paid £50 under a contract, my contractual counterparty has a corresponding duty to pay me £50, and if they fail to do so I can enforce my right (and their duty) by way of legal proceedings.

By contrast, the “right” to self-defence is of a very different nature. If I am attacked and act reasonably in defending myself, my attacker cannot sue for what would otherwise be a battery. But that “right” gives rise to no claim that I could bring. Rather, it creates what Professor Hohfeld described as a privilege (page 26): “the otherwise existing duty of Y [the victim of the initial attack] to refrain from the application of force to the person of X [the attacker] is, by virtue of the special operative facts, immediately terminated or extinguished.”

In addition to claim-rights and privileges, Professor Hohfeld identified powers (which would include such things as the power of an owner of personal property to transfer that property and thereby extinguish his or her rights in it – there is, of course, no corresponding duty on anyone to assist in that process by accepting the transfer) and immunities (for example, charities are immune from certain forms of taxation). Professor Hohfeld summarised his terminology at page 55:

Professor Hohfeld’s claim rights, privileges, powers and immunities are all about legal relationships. I understand Professor Stevens’ argument to be that while property may be broader than just claim-rights, it must involve some legal relationship.

On Mr Bergin’s analysis, Professor Stevens’ argument would be irrelevant, since Mr Bergin does not seek to show that USDT is property at all. For reasons I go on to address, I do not accept that, but I do accept the logic of his position: were I with him on the irrelevance of property existing in USDT, it would follow that Professor Stevens’ objection would not be an issue.

Mr Connell invited me to reject Professor Stevens’ argument as circular – the question of whether something attracted property rights could not depend on whether it already created other rights. That, it seemed to me, was not quite right, in the sense that I did not see Professor Stevens’ argument as being circular. I agree, however, that if a “rights” requirement does not exist, Professor Stevens’ doctrinal objection falls away.

The question of whether property can exist in the absence of a legally enforceable right was considered in Ex parte Huggins; In re Huggins (1882) 21 Ch D 85. The case concerned a pension payable to the former Chief Justice of Sierra Leone, who had subsequently been made bankrupt. Payment of the pension was voted on annually by the Colonial Legislature. Jessel MR rejected the idea that simply because the contract could not be enforced in court it was not property for the purposes of section 90 of the Bankruptcy Act 1869. He emphasised at pages 90-91:

While Jessel MR was dealing with property for the purposes of a specific statutory provision, I read what he said as being of broader application. One would, for example, equally expect that French or Italian bonds could be the subject of a trust. Moreover, his observations on assignability can only be a reference to whether something was property for general common law principles, rather than being limited to the statutory provision he was addressing.

Attorney-General of Hong Kong v Nai-Keung [1987] 1 WLR 1339 concerned the theft of export quotas. Under Hong Kong law at the time, textiles could only be exported from Hong Kong under licence. A licence would only be issued to the holder of a valid quota allocation certificate and it was these certificates that the defendant had misappropriated. Export quotas were registered with the Department of Trade and Industry (the DTI) and were transferable with the DTI’s approval on a temporary or permanent basis. The appeal turned in part on whether such quotas fell within the scope of the Hong Kong Theft Ordinance 1970, which defined property as “money and all other property, real and personal, including things in action and other intangible property”.

Significantly, for current purposes, Lord Bridge noted at page 1342B: “In summary, to be registered as the holder of an appropriate quota is a prerequisite to obtaining an export licence; it confers an expectation that, in the ordinary course, a corresponding licence will be granted, though not an enforceable legal right.”

Lord Bridge continued at page 1342B-C:

In my view, two significant points arise from this decision. First, property existed in the quotas which, themselves, afforded no rights, merely an “expectation” that a license would be granted. By contrasting the concepts of right and expectation, the Privy Council made clear that the latter was broader than the former. A parallel can be drawn with the USDT in issue in this case: as I have noted above, both the Bitcoin White Paper and the Tether White Paper talk about the use of cryptography to replace the need for either an intermediary or trust between the parties. Both USDT and Bitcoin are premised on an expectation of performance, albeit secured by cryptography rather than recourse to a court or tribunal.

Secondly, the rationale behind their Lordships’ reasoning was that the quotas were freely bought and sold; it would be “strange indeed” if such a thing were not property. I fully accept Professor Stevens’ point that there are things that have value, like confidential information, that the law does not recognise as property. Insofar as the point goes, I accept his criticism of Professor Goode’s proposal (“What is Property?” (2023) 139 LQR 1) that value and property can in all cases be equated. But I equally accept the Privy Council’s point (and that of Professor Goode) that typically those things do closely correlate.

It is important to recognise that this was a specific statutory definition that assumed the existence of intangible property that was not a chose in action. I address that in due course because the position has subsequently developed, but it seems to me that Nai-Keung itself is not authority for the proposition that a third class of property exists outside defined statutory regimes; it simply shows that there is no conceptual hurdle to such a class of property existing.

I also recognise that there may have been rights associated with the quota certificates. I was not addressed on the state of Hong Kong judicial review law in the early 1980s, but one would expect there to have been some right to reopen a decision of the DTI if made, for example, capriciously. This, it seems to me, would be a non-point, however, because that right was not what was being traded, less still what was stolen. Had one asked a purchaser of quotas what they had just bought, it would be odd to receive the answer, “The right to review certain erroneous decisions of the DTI.” Similarly, Lord Bridge’s reference to the quotas carrying “an expectation, though not an enforceable legal right” demonstrates that the Privy Council did not see ancillary rights, such as any right to judicial review, as relevant to their finding.

Re Celtic Extraction [2001] Ch 475 concerned two companies, both in compulsory liquidation, that had been granted waste management licences under the Environmental Protection Act 1990. In each case, clean-up obligations under the licences exceeded the company’s assets and the liquidator sought to disclaim the licence as onerous property under section 178 of the Insolvency Act 1986. The question therefore arose whether the licences fell within section 436 of the 1986 Act, which provides that “‘property’ includes money, goods, things in action, land and every description of property wherever situated and also obligations and every description of interest, whether present or future or vested or contingent, arising out of, or incidental to, property”.

The Court of Appeal found that they were within the scope of section 436. Morritt LJ noted at [26] that property was not a term of art but, rather, derived its meaning from its context, referring to Nokes v Doncaster Amalgamated Collieries Ltd [1940] AC 1014 at 1051 and Kirby v Thorn EMI plc [1988] 1 WLR 445 at 452. He then addressed the various cases and referred to the passage in Nai-Keung that I have quoted above before concluding at [33]:

I do not read the reference that there “must be” as saying that property could only exist against a statutory backdrop. As Morritt LJ noted by reference to Nokes, property is context specific and he was working against the backdrop of exemptions from a statutory prohibition; plainly, there needed to be a statutory prohibition in the first place if the exemption were to be property.

Significantly, Morritt LJ cited Nai-Keung, in which a sufficiently founded expectation could constitute property even in the absence of a legal right. That is consistent with Morritt LJ’s own reference to a discretion not defeating a finding of property.

Swift v Dairywise (No 1) [2000] 1 WLR 1177 involved milk quotas, which gave producers an exemption from a levy that would otherwise be payable on milk production. The quotas had to be attached to milk producing land. Dairywise loaned money to farmers on the security of such quotas. However, it had no milk producing land, so the quotas were held by an affiliate, Dairywise Farms, which did. Dairywise entered liquidation with its sole asset being debts owed to it by farmers. A question arose as to the ownership of the milk quotas. Jacob J found at 1183H-1184A that quotas could be the subject of a trust:

At 1184G to 1185A he applied what he described as the threefold test from Re Celtic Extraction set out above: a statutory framework conferring an entitlement; transferability; and the exemption or licence had to have value. Again, of course, he was operating against the backdrop of a statutory scheme that was premised on entitlements having some legal effect, and the points I have made above about the context specific nature of the enquiry in my view apply equally here.

Armstrong DLW GmbH v Winnington Networks Ltd [2012] EWHC 10 (Ch), a decision of Stephen Morris QC sitting as a Deputy High Court Judge, concerned a claim for restitution in respect of the unauthorised transfer of EU emissions allowances (EUAs). As the learned Judge explained at [17]:

As with the dispute before me, it was not disputed by the defendant in that case that an EUA was a property right “of some sort” (paragraphs [31] and [40]); what was in issue was their precise nature and characterisation as property (paragraph [40]).

At paragraph [48] the learned Judge accepted that an EUA was not a claim-right “in the Hohfeldian sense” because there was no correlative obligation. Rather, it represented what he described, again in Hohfeldian terms, as a permission or an exemption from a fine.

The learned Judge then applied at paragraph [50] the test in National Provincial Bank v Ainsworth [1965] AC 1175 at 1247-1248 (“Before a right or an interest can be admitted into the category of property, or of a right affecting property, it must be definable, identifiable by third parties, capable in its nature of assumption by third parties, and have some degree of permanence or stability.”) He concluded that an EUA was property:

He noted that an EUA was not a chose in possession. He then considered the cases that I have addressed above and concluded at paragraph [58] that the threefold test in Re Celtic Extraction led to the conclusion that EUAs were intangible property. He found that the test was not limited to specific statutory definitions but applied equally at common law, noting that Morritt LJ had relied on National Provincial Bank v Ainsworth.

He concluded at [61]:

Finally I come to Gwinnutt v George [2019] EWCA Civ 656. Mr George was a barrister who, at the time of his bankruptcy, had outstanding fees. Those fees were incurred under the old regime where a barrister had no contract and was not entitled to sue to recover his or her fee; as was noted in Rondel v Worsley [1969] 1 AC 191 per Lord Upjohn at 279: “fees due to counsel create no debt”. The question was whether they constituted property such that they formed part of the bankruptcy estate. The Court of Appeal found that they did.

Giving the leading judgment, Newey LJ considered Ex parte Huggins and concluded at [17] that it related not to the money received but to the right (such as it was) to receive that money. I respectfully agree both with that conclusion and the reasons Newey LJ gave for it.

At [20] Newey LJ addressed the argument that there was a distinction between Ex parte Huggins, where there was an unenforceable contract, and the case before him, where there was no contract at all:

He concluded at [28]:

That reasoning is not in any way limited to the particular context or the language of the bankruptcy regime.

From these cases I draw a number of points:

It was accepted in AA at [59] and Tulip Trading at [24] that the Ainsworth criteria are satisfied in the case of bitcoin. As the Tether White Paper makes clear, USDT operates in much the same way but with the added feature of proof of reserves. It therefore also satisfies the Ainsworth criteria, and the starting point is that it is property.

USDT does not confer Hohfeldian claim-rights, powers, privileges or immunities. In not conferring claim-rights USDT cannot be choses in action, but as Nai-Keung and Gwinnutt both make clear that is not necessary provided there is an expectation with a sufficient basis. Here, plainly, there is. The foundation of USDT is the cryptographic security of the blockchain. There is more than a mere hope that transactions will be honoured; as the Bitcoin and Tether White Papers make clear, there is an expectation that this will happen based on cryptographic security that is designed to make it happen.

What would the nature of such an asset be? The Final Report devoted some time to that question, particularly noting Professor Fox’s article “Digital Assets as Transactional Power” (2022) 1 JIBFL 3 (see in particular paragraphs 4.14 and 4.19-4.20 of the Final Report). Professor Fox noted (my emphasis):

The same conclusion was reached by the UKJT Legal Statement at paragraph 60.

I agree. The combination of both data and transactional functionalities in my view satisfies what is required by cases such as Huggins, Nai-Keung and Gwinnutt to give the “expectation”, to use the term from Nai-Keung, that the transaction will be honoured sufficient form to attract property rights. The Court of Appeal in Tulip Trading at [24] considered that the fact the data entries are unique means that the asset is rivalrous – possession by one party excludes possession by another.

The final limb of Professor Stevens’ argument is that cryptoassets are simply information, and there is no property in information as such. That seems to me to be addressed by Professor Fox’s definition that I have accepted above: the property is not merely the data but the combination of the data and the transactional functionalities related to it.

The second argument against the Law Commission’s proposed approach that was recognised in the Final Report is that cryptoassets should be considered property but that there is no need for a third class of property to accommodate them. The Final Report made particular reference to a piece by Professor Peter Watts KC and Professor Kelvin FK Low (“The Case for Cryptoassets as Property” now updated in light of the Final Report and published in Agnew and Smith (Eds) “Law at the Cutting Edge: Essays in Honour of Sarah Worthington” (Hart 2024)).

Professor Watts and Professor Low criticise the idea in the Final Report that cryptoassets are themselves rivalrous, but that their rivalrousness is fragile in that it depends on cryptography that can never be absolutely secure (page 287):

They argue that one option would be to treat the private key as confidential information that can be bequeathed. They conclude at page 290 that there is a better route:

It seemed to me that, on closing, Mr Bergin was advocating for such an approach. As I have noted, his focus was on the rights and remedies that adhere to USDT, more than the nature of the asset itself.

As the Final Report notes at 4.38, an approach focussed on rivalrousness and an approach focussed on control are similar and in practice may lead to functionally equivalent results. However, I find an approach focussed on control less straightforward to reconcile with the caselaw. Most obviously, the Court of Appeal considered that bitcoin are rivalrous in Tulip Trading at [24]. The operation of USDT, which as I have noted is the only type of cryptoasset in issue before me, is designed to be almost identical, such that they, too, are rivalrous.

Moreover, I agree with what is said at 4.39 of the Final Report that it is helpful to focus on the characteristics of the thing itself. Paragraph 3.68 of the Final Report notes that crypto-tokens exist independently of the rights and claims associated with them and are used and enjoyed independently of whether they give rise to rights enforceable by action. That seems to me to be consistent with Birss LJ’s observation in Tulip Trading at [72] that bitcoin have an existence outside the minds of individuals. I take those observations to be more consistent with recognising property in the crypto-token itself, rather than the rights that surround it.

That is not to say that I disagree with what Professor Watts and Professor Lowe say about there being a right to cause the system to operate. That is not a point that arises in this case and so I express no view on it. But I would see any such rights as being in addition to, not the basis of, the recognition of USDT as property.

Finally, not least because concerns over money laundering and the funding of terrorism were central parts of Mr Moore’s evidence, I need to address the arguments around the public policy issues associated with crypto-assets.

Broadly, the concern is that crypto-assets give rise to a range of considerations ranging from money laundering to climate change and courts lack the institutional competence to consider them. Accordingly, the question of whether to recognise property rights attaching to crypto-assets is better left to Parliament. See, for example, Professor Grower, “Better Left to the Legislature? Notes on a Nagging Doubt Over the Legal Recognition of Cryptoassets” in “Law at the Cutting Edge” page 301. Similar issues were raised by Professor Stevens. In the course of trial I was referred, for somewhat different reasons, to the Supreme Court’s recent decision in Philipp v Barclays Bank plc [2023] UKSC 25, where the differing institutional capacities of the courts, legislators and regulators were recognised by Lord Leggatt.

Mr Connell submitted that adopting such an approach was the wrong way round. Typically, at least in private law, courts would determine the rights and obligations of parties and if Parliament disagreed it would step in. At least in this case that seems to me the right approach. In his piece, Professor Grower at page 306 refers to Professor Stapleton’s “Three Essays on Torts” (Oxford University Press 2021). In the first of those essays, at pages 29-30, Professor Stapleton recognised the types of concerns that Professor Grower raises, but she concluded at page 30:

Courts decide the matters that come before them. If Parliament considers that there are broader concerns, it may be one of those cases where it does not acquiesce in the conclusion reached by the judge and acts. But the fact that it might do so is not a bar on the court determining the case at hand.

I am also conscious that leaving matters to the legislature is not necessarily as easy as it sounds. I have concluded that: as a matter of existing English case law an expectation can suffice for the foundation of property rights even in the absence of a legal relationship; that English law recognises that assets that are substantially identical to USDT are rivalrous; and that in respect of USDT the Ainsworth test is satisfied. If I were to conclude that, even so, USDT should not be considered to be property because there are public policy concerns that I am not well placed to consider, I would not be maintaining the status quo until Parliament acts. I would be making a positive finding that, for the purposes of Mr D’Aloia’s claim, he had no property that I was prepared to recognise. And I would be doing so on the basis that there may be concerns of a type that, if they existed, Professor Grower argues I would lack the institutional competence to consider. That, it seems to me, would not be right.

Finally, even if Parliament were to act it might not address the issues that are said to be a concern. The Law Commission’s draft Property (Digital Assets etc) Bill does not seek to say whether crypto-assets, or certain classes of them, are property. It simply clarifies that something can be property that is neither a chose in action nor a chose in possession. Assuming that Bill became law, it is not clear what the judge would be expected to do, given that Parliament would have spoken but would not have resolved the types of concerns that Professor Grower and Professor Stevens raise.

Accordingly, in my view USDT, while neither a chose in possession nor a chose in action, is capable of attracting property rights for the purposes of English law. Those rights attach to the USDT itself, rather than the right to control it, for example the right to use the private key.

Critical to Mr D’Aloia’s claim is to bridge the gap between the 1dDA Wallet into which he paid his USDT and the 82e6 Wallet, from which it left the blockchain universe and re-entered the traditional banking system. For this he relies on Mr Moore’s reports, but before turning to those reports it is important to be clear how the processes work legally because it goes to one of the pleading points raised by Bitkub.

Mr Connell submitted that the difference between following and tracing presented an insurmountable hurdle for Mr D’Aloia, at least in respect of his constructive trust claim, because that claim was advanced expressly on the basis of following and not tracing. Mr Bergin accepted, in rather qualified terms, that he was not advancing a claim on the basis of following, although as I come to address it remained an issue for determination. He further accepted that the statements of case were inelegant, but submitted that they sufficed to set out a tracing claim. He noted that Master Pester had obviously understood that because his order regarding expert evidence covered both tracing and following. He had a further point that neither tracing nor following were required for the claim in unjust enrichment; again, I address that separately later in this judgment.

I agree with Mr Connell that as a matter of law, tracing and following are different things. As Lord Millett explained in Foskett v McKeown [2001] 1 AC 102 at page 127B:

I will address the point on the choice being dictated by the circumstances when I come to consider following.

Mr Connell submitted that tracing was not open to the Claimant because the statements of case and the report of Mr Moore refer only to following. That, it seemed to me, was not correct. I agree that tracing is not referred to using that term, but the concept is part of the Claimant’s case.

The proprietary restitution claim was abandoned at trial, but it still informs the way that the statements of case and Mr Moore’s report are to be read. Both the claims, in terms, apply to “substitutes” or “substitute assets”. As Lord Millett in the passage I have quoted above makes clear, substitutes are the domain of tracing, not following. These claims are therefore premised, at least in part, on tracing. Since both those claims were based on the work of Mr Moore (Re-Amended Particulars of Claim paragraph 34(iii), Re-Amended Reply paragraph 33), work that was described as (and only as) “following”, the Claimant and Mr Moore must have been using that term in a non-technical sense.

Moreover, while the concepts are distinct the law recognises that sometimes they are used collectively or interchangeably. As the Supreme Court recently observed in Byers v Saudi National Bank [2023] UKSC 51 at [68]:

It would seem to me odd if tracing could be used in a combined sense to include following but following had to be limited to its strict meaning.

Nor do I consider that Bitkub or its lawyers were prejudiced by the reference only to following. As Mr Bergin noted, Master Pester ordered expert evidence on tracing and following and it was obvious that Mr Connell was in a position to cross-examine Mr Moore on both. It may have a bearing on costs in due course, but I accept that Mr D’Aloia can advance claims on the basis of tracing.

Again, the starting point is Foskett. As Lord Millett explained at 127H-128D:

He went on to consider the distinction between the legal and equitable rules on tracing at 128G:

He drew a distinction between wrongdoers and innocent parties when tracing through mixed funds. As to wrongdoers he set out what he described as “the basic rule” at 131G:

In the case of funds mixed with those of other innocent victims the position is quite different (page 132D):

Against that backdrop, a number of issues in dispute between the parties fall to be addressed.

In support of the proposition that tracing at common law in this case was impossible, Mr Connell referred me to Tecnimont Arabia Ltd v National Westminster Bank Plc [2022] EWHC 1172 (Comm) at [150]:

The issue is dealt with very briefly, and appears to have been agreed between the parties. Ultimately, I agree with that conclusion but my reasons for doing so are somewhat different and it is worth setting out what they are, given that it may impact on other aspects of the following / tracing issues.

The idea that there should separate tracing regimes in equity and at common law was attacked in Foskett. Lord Millett at 128G-H argued there was “no sense to maintaining different rules”, that “One set of tracing rules is enough.” and that there was “no logical justification for allowing any distinction between them to produce capricious results”. He also agreed at 128H with Lord Steyn. His starting point was at 113C:

Lord Steyn then referred to an essay by Professor Birks, “The Necessity of a Unitary Law of Tracing” in Cranston (Ed), “Making Commercial Law, Essays in Honour of Roy Goode” (Clarendon 1997), an analysis his Lordship described at 113C as “crystalline”. In that essay, in a passage cited by Lord Steyn, Professor Birks stressed at page 258: “The process of identification thus ceases to be either legal or equitable and becomes, as is fitting, genuinely neutral as to the rights exigible in respect of the assets into which the value in question is traced.” Lord Steyn endorsed that view at 113E:

As I read that, Lord Millett was therefore endorsing Lord Steyn’s view that a single rule for tracing was “orthodox principle” and that Professor Birks was simply clarifying “what tracing is about”.

Lord Millett also agreed with the views expressed by Professor Smith in “The Law of Tracing” (Oxford University Press, 1997). In one of the passages to which Lord Millett expressly referred Professor Smith observed, at page 123:

Professor Smith’s argument, with which Lord Millett apparently agreed at least in principle, was not simply that there should be no distinction between law and equity; it was that there was no such distinction.

The editors of “Goff & Jones” The Law of Unjust Enrichment” (10^th Ed, Sweet & Maxwell) endorse that approach at 7-18:

Given the passages of Foskett to which I have referred, I have considerable sympathy with that view. None of this appears to have been addressed before HHJ Bird, and for that reason I am cautious about relying on his clear statement of principle without more.

In my view there is more, however. Foskett was considered by Rimer J as he then was in Shalson v Russo [2003] EWHC 1637 (Ch) at [103]-[104]. He placed particular emphasis on Lord Millett’s comment that Foskett itself was “not, however, the occasion to explore these matters further” and concluded at [104] that “it cannot be said that Foskett v McKeown [2001] 1 AC 102 has swept away the long recognised difference between common law and equitable tracing.”

Importantly, in the recent Supreme Court decision in Byers Lord Burrows observed at [160]:

That, it seems to me, recognises an ongoing distinction between the legal and equitable rules for tracing. It also reflects conclusions that his Lordship had previously expressed academically; see, for example, Burrows, “The Law of Restitution” (3^rd Ed Oxford University Press 2011) page 124:

In light of Shalson and the observations of Lord Burrows in Byers I am, with all respect to the editors of Goff & Jones, unable to accept that the obiter observations of Lord Millett and Lord Steyn have been followed in subsequent cases as Goff & Jones suggests. On the contrary, it seems to me that Mr Connell is right and that English law still recognises separate regimes for tracing in equity and at common law. It therefore follows that Agip (Africa) Ltd v Jackson is binding on me and tracing through a mixed fund is not possible at common law.

The reason why the common law will not permit following through a mixed fund was explained by Millett J as he then was in the first instance decision of Agip (Africa) Ltd v Jackson [1990] Ch 265 at 285D-F:

His decision and reasoning were approved on appeal. In Trustee of the Property of F C Jones & Sons (Trustees) v Jones [1997] Ch 159 Millett LJ, as he then was, recognised at 169 that his reliance on Taylor had been misplaced, since although it was the decision of a common law court it had been decided applying the equitable rules. He confirmed that the broader point remained good law, however.

I have found that USDT is neither a chose in action nor a chose in possession but is, rather, a different class of asset to which property rights attach. As such, the fact that the common law does not allow a party to follow a chose in action is not, of itself, necessarily determinative in Mr Connell’s favour. The question is how best to treat USDT for the purposes of following.

The Final Report at 6.28-6.29 noted the potential different characterisations of what happens to a crypto asset on transfer. The “extinction/creation” analysis posits that on transfer the existing token is destroyed and a new token, with a new output value, is created. The “persistent thing” analysis focusses, instead, on the token as a notional quantity unit that can be tracked as it passes through the system. As the Law Commission noted at 9.25-9.27, the extinction/creation analysis suggests that the asset could be traced but not followed; where the asset is a persistent thing, both are in principle possible.

As I understood it, the Claimant’s case is that USDT is a persistent thing. Mr Bergin in closing referred me to the Tether White Paper, which notes that only Tether has the ability to destroy USDT. Moreover, in his evidence before me Mr Moore indicated that Tether had the ability to track each individual USDT.

Mr Moore’s answer was consistent with the Tether White Paper, which explains that it is possible to “Track and report the circulation of tethers” (page 6) and that the transactional history of USDT is “publicly auditable” (page 9).

In oral closing, Mr Connell resolved an apparent tension in Bitkub’s position and confirmed that it supported the extinction/creation analysis. Bitkub did not consider that the USDT could be followed through a mixed fund. Mr Pinto’s evidence was that USDT could not be individually identified, but he did not address what was said in the Tether White Paper. In his skeleton Mr Connell relied on Lipkin Gorman v Karpnale Ltd [1991] 2 AC 548 at 572 and Millett LJ’s judgment in Trustee of the Property of FC Jones & Sons v Jones [1997] Ch 159 at 169 for the proposition that common law will not follow through a mixed fund. In Lipkin Gorman Lord Goff’s point was premised on money being fungible. In Jones, Millett LJ referred to the observation of Lord Ellenborough CJ in Taylor v Plummer (1815) 3 M&S 562 at 575 that the right of ascertainment would fail “when the subject is turned into money, and mixed and confounded in a general mass of the same description”.

Taking first the characterisation as USDT, I am conscious that the evidence before me is difficult to reconcile with the evidence that appears to have been before Trower J in Piroozzadeh, in which he noted the “possibly impossible” exercise of tracing USDT swept into a hot wallet. The matter was not explored with either expert and the evidence in support of both arguments is thin. On balance, however, the analysis of Mr Moore on this point seems to me to be in line with what is said by Tether itself. It therefore seems to me that USDT is better characterised as a persistent thing. That is also consistent with the approach I have adopted in respect of the proper characterisation of USDT as property. While aspects of the data strings change, acquiring a new output value, that is not what I have found to represent the relevant property. Rather, the property is both the data and the transactional functionalities associated with it. I do not understand those transactional functionalities to change on transfer – a USDT in the hands of the transferor has the same functionality as a USDT in the hands of the transferee.

That conclusion does not automatically mean that the USDT can be followed, but the questions are obviously somewhat linked. One of the reasons I consider USDT to be a persistent thing is that it maintains a distinct identity, even in a mixture. That makes it, for these purposes, more like a chose in possession than a chose in action. Moreover, while the tokens are fungible (Lipkin Gorman at 572) they are not mixed and confounded in a general mass of the same description (Jones at 169). As Goff & Jones notes at 7-23, the rules on following and fungible mixtures are designed to address an evidential uncertainty; where no such uncertainty arises they do not apply. Returning to Lord Millet’s observation in Foskett at page 127B, in the context of USDT nothing in the circumstances dictates tracing over following.

The Final Report recognised at 9.27 that where a crypto-asset takes the form of a persistent thing, following might in principle be an option. I agree. The evidence before me suggests that the identity of the USDT was preserved despite mixing and could be evidenced. On that basis it seems to me that following should, in principle, be an option.

In saying that I keep in mind a point raised by Mr Connell from the Final Report at paragraph 6.92. That deals with the “innocent acquisition rule”, addressing the question of when the defence of good faith purchase for value without notice will apply on transfers of crypto-assets. One possible basis for the defence is the extinction/creation analysis, since that gives rise to new property, not a transfer of existing, tainted property. It is not the only basis, however, as the Law Commission makes clear in that section of the Final Report. For reasons I go on to address I do not need to consider the degree of knowledge required for a good faith purchaser defence, and as such do not address that question in this judgment. Nothing I say here changes that; the knowledge aspects of good faith are simply not an issue before me. Moreover, and in any event, the proper characterisation of USDT is a factual question and one that I have had to decide on the basis of limited evidence.

I accept that in principle the USDT in this case could have been followed, including through different wallets used in the various Hops, even where those wallets contained or subsequently received USDT from other sources. The issue is a practical one. There was simply no evidence before me, from Tether Ltd or any other source, that would allow the exercise to be undertaken. Indeed, Mr Moore, in the passage of his cross-examination I have quoted above, recognised as much: he was not in a position to say with certainty how much, if anything, of any given sum was Mr D’Aloia’s USDT.

Both parties agreed that in principle one approach to a case such as this was the rule in Clayton’s case of FIFO. The question was a practical one – how realistic was it to apply FIFO, given the complexity of the fund flows through the various wallets involved in the Hops? The necessary corollary of that is that this is a case where Mr D’Aloia’s funds were mingled with those of other innocent victims, because FIFO does not apply as between victim and wrongdoer (“Snell’s Equity” (34^th Ed, Sweet & Maxwell) paragraph 30-058; Goff & Jones paragraph 7-53). That reflected Mr Moore’s evidence that the wallets involved in the various Hops would contain the funds of other victims.

In terms of how one goes about tracing, Mr Connell referred me to Charity Commission for England and Wales v Framjee. A charitable trust suffered a shortfall between the sums held and the sums due but unpaid to designated charities. The Commission sought directions on the legal basis on which it should proceed. Henderson J, as he then was, addressed the options at [47]:

He went on to state at [63]: “In short, I am satisfied that the court must in all normal circumstances make a choice between pari passu distribution on the one hand or the rolling charge method on the other hand, always assuming that it is appropriate to depart from the rule in Clayton’s Case 1 Mer 572.”

Mr Connell submitted that Henderson J’s options were therefore the only routes open to Mr Moore and that Mr Moore had followed none of them, such that his evidence should have no weight.

Mr Bergin acknowledged that Mr Moore had not applied “strict FIFO”. As I have noted, it seems to me better to avoid such a term (along with “customer FIFO”) as having the potential to cause confusion. The fact is, Mr Moore did not apply what English law calls FIFO; Mr Bergin’s point was that he was not required to. He referred me to Russell-Cooke Trust Company v Prentis (No 1) [2002] EWHC 2227 (Ch) at [55] and El Ajou v Dollar Land Holdings Plc (No.2) [1995] 2 All ER 213 at 222, noting that the rule in Clayton’s Case was easy to displace. He submitted that Mr Moore had undertaken a somewhat similar exercise modified on the basis of his own experience and the training he received from Crystal Blockchain. He noted that Mr Pinto acknowledged that he would have used a similar, transactionally focussed approach.

I agree with Mr Bergin both that the rule in Clayton’s Case can be displaced where it is appropriate to do so and that where it is displaced the parties are not limited to pari passu distribution or the rolling charge. That much is clear from Federal Republic of Brazil v Durant International Corpn [2015] UKPC 35. Mr Maluf senior was the mayor of Sao Paulo. He received bribes totalling US$10,500,055.35, which he paid into an account under the control of his son, the Channani account, over a four-week period from 9 January to 6 February 1998. In the period 14 to 23 January 1998 payments were made from the Channani account to an account held by Durant, and in the period 22 January to 23 February 1993 payments were made from the Durant account to an account held by Kildare. The Federal Republic sought to trace the c. US$10.5m to the Durant account and, from there, to the Kildare account. It faced difficulties in doing so in that (i) certain of the payments into the Channani account happened only after the final payment had been made to the Durant account; and (ii) payments were made from the Channani account to the Durant account that must, mathematically, have included money other than the bribes.

The Privy Council emphasised at [38]:

A similar approach was adopted in Relfo v Varsani [2014] EWCA Civ 360. I will address the decision more fully in due course, but at this stage it suffices to note what was said at [57] on the relevance of intention:

In my view it therefore is open to the Claimant, at least in the case of a claim involving fraud such as this one, to trace on a basis other than FIFO, pari passu and the rolling charge provided that it treated all innocent claimants and potential claimants comparably and was properly evidenced. I also recognise the conceptual clarity identified by Professor Cutts (“Tracing, value and transactions” (2016) 79 MLR 381) that might be achieved through a more transaction focussed approach.

In support of his tracing claim, Mr D’Aloia relies on Mr Moore’s reports. Mr Moore has produced multiple reports in connection with this dispute. Two are relevant to this trial: the first was produced on 22 June 2022 at a time when he was working at Mitmark (the Mitmark Report); the second was the Arrowsgate Report produced for use at the trial at a time when he had started his own firm. There are a number of fundamental differences between those reports:

Central to the criticism of Mr Moore is whether the methodology he used was recognised as a means of tracing in English law. As I have also noted, there is a question of whether Bitkub’s case was properly put to Mr Moore. Given the way the case developed, and how much turns on his evidence, it is important to address this in some detail.

Mr Moore’s evidence at trial on his methodology can, I think, fairly be said to be summarised by the following answer:

Mr Moore’s position was that he had applied the right approach but used the wrong label for it. He was never applying FIFO, he was doing something more nuanced.

The starting point is what Mr Moore said he was doing. That was described by Giambrone & Partners in a letter dated 16 November 2023, around a month before the service of experts’ reports, in the following terms:

I read that as saying Mr Moore was using FIFO. The second point, I am obliged to say, I found unclear. It becomes relevant later because it appeared to change.

In the Arrowsgate Report Mr Moore set out a diagrammatic overview of his approach. This described the process he had used to identify Mr D’Aloia’s USDT as being “Followed using FIFO”. It further noted “Common links of received criminal funds confirms FIFO methodology.”

This was repeated in the methodology section of the Arrowsgate Report. There, Mr Moore emphasised:

Mr Moore referred to an article that was said to expand on how FIFO was instrumental but no citation was provided. He went on:

Pausing for a moment, the reference to courts recognising FIFO can, I think, only sensibly be to the rule in Clayton’s Case. Mr Moore continued:

He then referred to a number of articles. Several of these related to US tax on crypto-asset based capital gains. That is somewhat different to the situation faced by Mr D’Aloia. There, all the assets are held by the same person and the question is simply how to identify the base price of the asset when calculating the gain – is it the cost of the last asset purchased, the first asset purchased, etc. There is no question of mixing in the sense that it arises here, nor is there the need to allocate losses between equally innocent victims. In contrasting FIFO with LIFO (last in first out) and HIFO (highest in first out) the articles were relevant in showing that Mr Moore’s reference to FIFO was to that term as it is used in Clayton’s Case, but otherwise did not add a great deal.

One reference was much more on-point, however, an article from wired.com from 5 April 2018 titled “A 200-Year-Old Idea Offers a New Way to Trace Stolen Bitcoins”, which dealt with research by Professor Anderson, a computer scientist at Cambridge University. Since this forms the basis of Mr Moore’s methodology, it is worth quoting the salient parts of the article:

Mr Moore also provided a link to the research paper of Professor Anderson, Dr Shumailov and Dr Ahmed-Rengers referred to in the article.

It seems to me clear that the basis stated in the Arrowsgate Report for tracing Mr D’Aloia’s funds was the rule in Clayton’s Case. That is obvious from the wired.com article and the research paper to which it refers. While Mr Moore made reference to his use of Crystal Blockchain, he did not suggest that it applied a different approach to FIFO. On the contrary, he suggested they were the same. For example, at paragraph 22.4 of his report Mr Moore stated: “An overview of the movement of misappropriated funds, using FIFO methodology (See section 11 of this report), is shown below, from left to right.” There followed a diagram that is said to be derived from Crystal Blockchain. Mr Moore then continued to expand on the use of FIFO.

Mr Bergin submitted that it could be seen from the methodology section of Mr Moore’s report that he was not using FIFO. He referred, in particular, to two paragraphs.

The first was 11.3. Having given a simple example showing 9.4 Ethereum being paid into and then out of a wallet, Mr Moore stated:

The difficulty with that reference is that the example is so simple (one payment in, one payment out) that it is both obvious what you would trace and is, in any event, an example of FIFO.

The second is 11.7 (my emphasis):

The highlighted text plainly is not consistent with FIFO. That is, however, one line in the methodology section; the broader methodology section refers explicitly to FIFO and, by reference, to the use of the rule in Clayton’s Case. References to FIFO feature throughout the Arrowsgate Report.

While Mr Moore said he was using FIFO, I accept it was never the approach that he in fact attempted to apply. That is apparent on a number of levels.

The first, and most obvious one, is the flow of funds itself. Mr Connell took me, in opening, and Mr Moore, in cross examination, through Hops 6 and 7 at some length. The starting balance in the 6E52 wallet was slightly over USDT 781,000. On 17 February at 9:18am, USDT 183,000 said to contain the funds of Mr D’Aloia were received into the wallet (Hop 6). At 9:52am USDT 18,731 was paid out, followed by a receipt of USDT 5,433 at 10:00am. There was a further payment out of USDT 31,000 at 10:04am. Finally, at 11:01am a further USDT 500,000 was received into the wallet. On a FIFO basis approximately USDT 730,000 of the starting balance therefore remained in the wallet at this point. At 4:58am on 18 February USDT 400,000 was transferred out (Hop 7), and that amount is said by Mr Moore to include Mr D’Aloia’s funds. On a FIFO basis that is obviously wrong; the USDT 400,000 would be attributable to the starting balance, not the USDT 183,000 receipt the previous day.

Secondly, in response to a question asked by Binance Mr Moore explained on 5 July 2022 (my emphasis): “MITMARK chose to trace the 195,649 USDC in Serial 8 due to it being the closest match to the amount lost by the client (which is 229,400 USDC – See Annex A, Serial 8).” FIFO is not about choice – it is a mechanical exercise. That answer predated the Arrowsgate report by around 18 months.

Thirdly, following the meeting of experts a “joint statement” was prepared on 6 March 2024. As I have noted, it was really two statements, one from each expert, but in his section Mr Moore at 2.6, 2.14 and 2.17 made clear that he had not used the FIFO methodology as understood by Mr Pinto (whose understanding of FIFO was correct). He further explained (at 2.6) that the methodology he adopted was “taught and followed by Crystal Blockchain and other tooling I have used, including TRM Labs”, although he did not expand on what that methodology or methodologies was or were.

Finally, in the Claimant’s Responses to the Sixth Defendant’s Questions to Mr Robert Moore on 19 April 2024, the Claimant confirmed (my emphasis):

It remained unclear what the “refinement” was but since FIFO is a mechanical process, it was obviously not consistent with the rule in Clayton’s Case.

While it was by this stage clear that Mr Moore had not used FIFO, it was not clear what he had done. Giambrone & Partners wrote to Quillon Law on 31 May 2024 attempting to explain Mr Moore’s methodology. As I have noted, this was a matter of days before trial. No revised report was served; Mr Moore agreed only in the course of his cross-examination that the letter accurately reflected the approach he adopted. In their letter Giambrone & Partners stated:

There are a number of issues with this.

First, while I accept that Mr Moore had by this stage made clear that he did not use FIFO, as I have noted, the Arrowsgate Report advanced as its rationale the rule in Clayton’s Case. The article in wired.com and Professor Anderson’s research to which Mr Moore refers in support of his approach could not be any clearer. Leaving aside the confusion that was bound to be caused in purporting to use FIFO if Mr Moore was always intending to use a different approach, it means that the arguments he advanced in the Arrowsgate Report as to the strength of FIFO do not offer any support for his actual approach.

Secondly, Giambrone & Partners purported to describe how Mr Moore “usually traces the funds”. That suggests that Mr Moore has other methodologies; nothing is said about how he selects between them, yet where there is a range of opinions PD 35 paragraph 3.2(6) requires the expert to say what they are and to give reasons for his opinion.

Thirdly, the only justifications he now offers for the approach he adopted are that it is taught by TRM Labs and Crystal Blockchain and in his experience it better reflects the practices of organised crime groups. As I have noted, TRM Labs’ approach produces a significantly different figure to that produced using Crystal Blockchain, so it is not clear how two different approaches are both likely to reflect the approach of those behind td-finan. The issue is compounded because, as Mr Moore recognised himself at paragraphs 2.2 and 2.4 of the joint statement of the experts, the methods of organised crime groups are unknown and unknowable save in the rare cases where arrests are made. It is therefore difficult to understand the basis on which he selected between Crystal Blockchain and TRM Labs (or, indeed, any other system), given that evidential gap.

Fourthly, and relatedly, in closing Mr Bergin submitted that the experts work in broadly the same way but use different systems. Accepting that, there is obviously a range of opinion as to which system is best, which may depend on the particular circumstances of the individual case. As I have noted, Mr Moore himself has used two different systems in this case. Yet nowhere does he explain how he selected between them, or how he came to prefer those systems, and ultimately Crystal Blockchain, over any other system. Again, it seems to me that he was required to explain this under PD 35 paragraph 3.2(6).

Fifthly, and again somewhat relatedly, there is a question as to how far the process is driven by the system as opposed to the expert. The thrust of Mr Moore’s evidence was that much of the work was done by the software; Mr Pinto said there was a significant subjective element to his work. In my view Mr Pinto’s evidence was significantly stronger on this point and reflects what Mr Moore has previously said. As I have noted, in his answer to Binance on 5 July 2022 he stated that he “chose to trace the 195,649 USDC”; that is consistent with Mr Pinto’s description of the expert’s role. At that time Mr Moore would have been using TRM Labs, or a combination of TRM Labs and Crystal Blockchain, but he gave a similar answer on 19 April 2024 – “the FIFO methodology was refined” – at a time when he was solely using Crystal Blockchain. Finally, in his cross-examination Mr Moore explained that one of the changes made to the amount claimed in these proceedings resulted from him changing his approach to the use of the system. Crystal Blockchain has a function that allows the user to switch between seeing the next transaction in time or, alternatively, the closest outbound transaction to the inbound transaction. The outcome, therefore, is not determined by the system, it is determined at least in this respect by the operator’s choice. I do not know, because Mr Moore has not explained, what other choices he must make, how he makes them or why.

Sixthly, the Giambrone & Partners letter stated that at stage (iv) one looks for the largest outgoing transaction next in time. That was not the answer given to Binance in July 2022 – there Mr Moore said that he looked for “the closest match to the amount lost by the client”. Again, I recognise that at the time Mr Moore was using TRM Labs, but if that is the justification for the different approach it simply ties back to my point above that I do not know, because Mr Moore has not explained, why he shifted from TRM Labs to Crystal Blockchain. At paragraph 11.7 of the Arrowsgate Report, when he was using Crystal Blockchain, he stated that “the next outbound transaction that is the same or more is followed.” Patently, those are not different ways of phrasing the same concept, as I will address by reference to the figures in this case in a moment. Yet all three versions were given pursuant to some form of statement of truth or adopted by Mr Moore during his cross examination.

Seventhly, it is unclear how Mr Moore, using this methodology, could have traced funds in the way that he did for Hop 2. Mr Connell submitted, and I accept, that this is fundamental to Mr D’Aloia’s case against Bitkub: given the way that he puts his case, if he cannot show that his funds were part of the USDT 326,868 then what happens thereafter is irrelevant because Mr Moore would be tracing somebody else’s funds. Applying Mr Moore’s methodology in its various iterations:

In saying all this I appreciate, as I have noted, that the USDT 999,987.1 was not the only sum paid by Mr D’Aloia into the 1dDA wallet. On the contrary, the bulk of the funds paid into that wallet seem to have come from the same Coinbase account, which I understand means they came from Mr D’Aloia. That is not the point. The question is how Mr Moore traced the USDT 999,987.1 into the USDT 326,868 at Hop 2. It does not appear to be through any of his stated methodologies; the numbers do not add up.

One sees further difficulty applying the methodology to later Hops. As I have noted, Hop 6 was a payment into wallet 6E52 of USDT 183,000 on 17 February at 9:18am. There then followed a further receipt of (non-Claimant) USDT 500,000 the same day at 11:01am. Hop 7, which Mr Moore traced, was a payment out of the wallet of USDT 400,000 at 4:58am on 18 February. Applying stage (iv) of Mr Moore’s methodology, the USDT 400,000 is (a) the largest outgoing transaction next in time in respect of both the USDT 183,000 and the USDT 500,000; (b) a closer match to the USDT 500,000 than the USDT 183,000; but (c) even though it is significantly closer in value, the USDT 400,000 is not the same as or more than USDT 500,000 but it is more than USDT 183,000.

Mr Moore ultimately made clear that he ignores incoming transfers. That rule presumably takes precedence over stage (iv) of his methodology, since otherwise he would have tied the USDT 400,000 outbound payment to the USDT 500,000 receipt. His reasons for that are not stated, which is an issue in itself, but it also produces an odd result in practice. Because (and only because) he is acting for the party tracing the USDT 183,000, the USDT 500,000 is ignored (as in intermediate receipt) and the USDT 400,000 paid out relates to the USDT 183,000 receipt; whereas if he were acting for a party tracing the USDT 500,000, his methodology would tell him that that the USDT 183,000 had to be ignored (as an opening balance) and the payment out of USDT 400,000 related to the USDT 500,000 receipt. It is not clear how that approach could reflect the methodology of the organised crime group behind the td-finan fraud; whoever controlled that wallet had one methodology, and its identification should not depend purely on whose case Mr Moore is advancing. As the point was put in Durant International at [38]: “the availability of equitable remedies ought to depend on the substance of the transaction in question and not on the strict order in which associated events occur.”

These issues were not directly put to Mr Moore in these terms but nor, on balance, do I consider that they needed to be. On the question of fairness, Mr Moore’s ultimate methodology was first set out a week before trial and was only formally adopted as his evidence in the course of his cross-examination. From Giambrone & Partners’ letter there appears to be a range of methodologies that Mr Moore uses but, in apparent breach of PD 35, no explanation of how he settled on his current approach for this case. In further apparent breach of PD 35, the material upon which he claims to have relied from Crystal Blockchain has not, so far as I am aware, been disclosed. There is no explanation of how Mr Moore chooses between systems, nor is there any explanation of how he chooses which options to employ within Crystal Blockchain (or even what those options are), again in breach of PD 35. Finally, and again as I have noted, his methodology was described in three different places and in three different, contradictory ways. In such circumstances, I think the somewhat more general terms in which Mr Moore was challenged – to the effect that his methodology lacked coherence or a principled basis – gave him ample opportunity to expand upon and explain his analysis. In fact, when he was challenged on the figures he referred to his broader mission to identify those behind the td-finan fraud. I have no reason to think he would have engaged with the figures I have worked through above had they been put to him.

More to the point, the question appears to be largely a mathematical one. Simply as a matter of arithmetic, USDT 920,000 is much closer to USDT 999,987.1 than is USDT 326,868 and USDT 326,868 is not the same as or more than USDT 999,987.1. Likewise, USDT 400,000 is closer to USDT 500,000 than it is to USDT 183,000, and the outcome at Hop 7 depends on whether Mr Moore is acting for the party tracing the USDT 183,000 or the party tracing the USDT 500,000. It is hard to see how Mr Moore could have contradicted that had the point been put to him.

Eighthly, there is a question of how appropriate that methodology is as a means of tracing by reference to the concern referenced in Foskett, and indeed repeatedly elsewhere, that there is no good reason why one innocent victim should be favoured over others. FIFO is considered acceptable because while it is arbitrary, it is equally arbitrary to all parties. Similarly, pari passu distribution does not favour one party over another. Mr Moore’s approach seeks to ignore the funds of other innocent victims, both in terms of pre-existing balances and incoming funds. It then seeks to trace into the largest sums, which improves the prospects of recovery by minimising leakage at each stage. But it seems to do so by favouring Mr D’Aloia over other victims of fraud.

Finally, there is a question about how reliable the approach and its application have been. As I noted at the outset of this judgment, the claim against Aux Cayes Fintech has been struck out. That was a result of shifts in Mr Moore’s conclusions that meant that the wallet into which he had traced Mr D’Aloia’s funds in fact contained none of Mr D’Aloia’s USDT. Similarly, in this claim, the amount sought is now less than half the original amount, again a result of shifts in Mr Moore’s conclusions. Mr Connell submitted that in the circumstances this, in itself, casts doubt on the reliability of Mr Moore’s conclusions. In light of the lack of transparency of Mr Moore’s methodology, I agree that it does.

I accept, and indeed Mr Connell I think accepted, that FIFO can be disapplied. That does not give Mr Moore a free hand, however. It was important to understand his methodology and why, in his view, it was reliable. Instead, he explained why FIFO was reliable in circumstances where he had employed a different approach, the details of which were not really set out until immediately before trial and even then in only broad and contradictory terms that are impossible to apply to the transfers in issue in this case. Mr Bergin noted that Mr Rubin had carried out a FIFO approach in his report and that “strict FIFO” and “customer FIFO” produced similar results in relation to the Binance wallets. For the reasons I have set out, they do not produce similar results here. I needed to understand why I could rely on Mr Moore’s approach. I was never able to do so. Mr Moore did not even attempt to explain the basis for his methodology, or how he made the various choices that he obviously had to make.

I therefore do not accept that Mr Moore’s evidence reliably demonstrates any flow of Mr D’Aloia’s funds to the 82e6 wallet. That is fatal to Mr D’Aloia’s claims against Bitkub so far as they rely on tracing. Even though I accept that Ms Hlangpan was involved in, or fronted for those involved in, fraudulent or illegal activity, I cannot properly conclude that the fraudulent activity in which she was involved included the fraud perpetrated on Mr D’Aloia.

The parties agreed that there are four questions that I need to answer in addressing the unjust enrichment claim, and both referred me to the speech of Lord Steyn in Banque Financière de la Cité v Parc (Battersea) Ltd [1999] 1 AC 221 at 227A-B:

Mr Bergin highlighted the observations of the Supreme Court in Investment Trust Companies v HMRC [2017] UKSC 29 at [41]-[42]:

After the close of the trial I was directed to the decision of HHJ Paul Matthews sitting as a judge of this Court in Terna Energy Trading v Revolut Ltd [2024] EWHC 1419 (Comm), which was handed down during the course of this trial. I received no submissions on it, but I found the learned Judge’s analysis of the question of enrichment clear and insightful, and I was grateful for it. In the context of principal-agent cases he there makes the logical, and in my view correct, link between the question of enrichment and the defence of ministerial receipt: one can only say the agent has been enriched if he or she has a legal excuse for ignoring an instruction from the principal as to payment elsewhere (paragraph [66]). For reasons I go on to address, I consider that the mere crediting of Ms Hlangpan’s account was not sufficient to establish the defence of ministerial receipt because the credit was provisional and could have been reversed; only payment away was sufficient. That, in turn, means that I accept that Bitkub was enriched by the payment at the point of receipt.

The approach to ascertaining whether the defendant’s enrichment was at the expense of the claimant is driven by the decision of the Supreme Court in Investment Trust Companies. Lord Reed explained at [46]-[51]:

He concluded at [51]: “Where, on the other hand, the defendant has not received a benefit directly from the claimant, no question of agency arises, and the benefit does not consist of property in which the claimant has or can trace an interest, it is generally difficult to maintain that the defendant has been enriched at the claimant's expense.”

For the reasons I have already given, as a matter of law Mr D’Aloia cannot trace through a mixed fund in support of his unjust enrichment claim. Even were tracing possible in principle, I have also found that Mr D’Aloia has not demonstrated that his funds can be traced to the 82e6 wallet as a matter of fact.

That is not the end of the enrichment analysis, however. Mr D’Aloia’s case is that the 14 Hops were not true transactions but, rather, simply attempts to conceal the flow of funds. Mr Bergin referred me to Relfo and invited me to find that they were a sham, such that this was a case of a direct payment from Mr D’Aloia to Ms Hlangpan and, once the USDT were swept into the hot wallet, on to Bitkub.

Mr Connell cautioned against drawing such an analogy. Relfo was, he submitted, a very different case. Relfo was a company controlled and owned by Mr and Mrs Gorecia. Mr Gorecia had close links with the Varsani family; he made and managed investments on the family’s behalf, and the family was a source of funding and loans for Mr Gorecia’s business projects. In May 2004 Relfo owed £1.4 million to HMRC. On 5 May Mr Gorecia wrongfully caused Relfo to pay £500,000 to the account of Mirren at Rietumu Banka in Latvia. The payment left Relfo insolvent and it subsequently entered creditor’s voluntary liquidation. Later the same day, Intertrade Group LLC transferred US$878,479.35 from its account with Ukio Bankas in Lithuania to Mr Varsani’s account with Citibank in Singapore. This equated to £500,000 less a 1.3% charge. The Intertrade payment was, in turn, funded by two payments received by it, also on 5 May. On 13 May Mr and Mrs Gorecia received US$100,000 from Mr Varsani’s Citibank account. However, Relfo was unable to show how the Relfo/Mirren payment was translated into the Intertrade payment. Nevertheless, Sales J as he then was found that Mr Gorecia had caused the Relfo/Mirren payment to be made intending that this would result in a payment to Mr Varsani. The Court of Appeal found that this amounted to a direct enrichment of Mr Varsani at Relfo’s expense, even though there was no direct transfer from Relfo to Mr Varsani and the precise mechanism by which the transfers were made could not be shown. Floyd LJ noted at 115: “provided one focusses on substance and not on form, or as it is put in some of the cases, on economic reality, the facts of the present case showed that the arrangement by which Mr Gorecia benefitted and enriched Bhimji Varsani using Relfo’s money were equivalent to a direct payment.” He went on to emphasise at [121]:

Mr Connell focussed in particular on the similarities of the amounts of the Relfo/Mirren payment and the Intertrade payment, the prior dealings between Mr Varsani and Mr Gorecia and their association with individuals who had access to money-laundering vehicles. No such factors, he submitted, were present here.

In his novel Anna Karenina, Tolstoy made the now famous observation: “All happy families are alike; each unhappy family is unhappy in its own way.” It has become known as the Anna Karenina principle, and applied by analogy in a number of fields. This, I think, is one of them. Legitimate transactions of course follow legal rules, notably those of the law of contract, and so inevitably have many features in common. Shams are often idiosyncratic because of the different ways that those who perpetrate them ignore or break the legal rules. The fact that one sham is dissimilar to another does not change the fact that it is a sham.

There certainly are differences between the current case and Relfo, but that does not in itself seem to me to be critical. In particular, Mr Moore’s evidence as to the nature of crypto-currency frauds and the use of multiple hops to conceal the flow of funds was unchallenged. Indeed, Mr Pinto largely agreed with it. That is reflected in the facts. Bitkub accepts that td-finan was a fraud. As I have set out in the table at paragraph 80 above, once money started to move it did so quickly, passing through some wallets in a matter of seconds. All of Hops 2-13 completed in under 24 hours. No honest explanation for this was suggested. The fact that the amounts involved in many of the Hops changed is consistent with what Mr Moore said about the attempt to disguise the flow of funds.

Mr Connell further submitted that the only thing linking the First Defendant to Ms Hlangpan was Mr Moore’s tracing analysis, and Mr Moore’s tracing analysis was flawed. That, I think, takes the point too far. For the reasons I have given I consider that the Claimant has established a link between the First Defendants and Ms Hlangpan in terms of a flow of funds and that Ms Hlangpan was either actively involved in laundering funds or, possibly, was a money mule for the First Defendants.

What I do not accept is that the Claimant has shown that Ms Hlangpan was the off-ramp for his funds. This was a far more complex fraud than was Relfo, where there was one payment in and one payment out. Mr Moore recognised that it involved the funds of multiple victims being mixed at multiple stages, it obviously involved multiple sham transactions and the funds re-entered the fiat banking system through multiple off-ramps.

I recognise that sham and tracing are different ways of showing enrichment and there will be cases where one cannot trace but can show a sham and vice versa. On the facts of this case, however, there are common factors that are relevant to both exercises. Indeed, as I understand the Claimant’s case, Mr Moore’s reports support both his case on tracing and his case that there was, in truth, a direct payment from Mr D’Aloia to the 82e6 wallet once the sham transactions are ignored. That means that many of the issues I have identified with the tracing exercise resurface here:

In a complex fraud such as this, in order to demonstrate that Bitkub was enriched with Mr D’Aloia’s USDT it is not enough simply to show that the Hops were shams. It must be shown why the sham transaction, for instance the payment from 1dDA to dcEO at Hop 2, was said to contain Mr D’Aloia’s funds and not those of another victim. Indeed, one sees this with the changes in Mr Moore’s evidence in respect of Bitkub. Mr D’Aloia’s losses have not changed, nor have the 14 Hops, but the amount that Mr Moore now says ended up with Bitkub is less than half the amount he started with. The way the shams are penetrated is critical. For the reasons I have given, I do not accept that Mr Moore’s evidence shows that any of Mr D’Aloia’s funds reached the 82e6 wallet.

Very little time indeed was devoted to this. The Amended Particulars of Claim put the basis for that claim in the following terms:

That plea was against all Defendants. A more specific plea against Bitkub was advanced in the Re-Amended Reply:

In the Claimant’s skeleton argument for trial at paragraph 91 two unjust factors were advanced:

In High Commissioner for Pakistan, the unauthorised transfer was made by the former finance minister of Hyderabad ostensibly on behalf of the ruler of Hyderabad, the seventh Nizam. In fact, the Nizam had not authorised the payment to be made (paragraph [132] of Marcus Smith J’s judgment). That was the basis for finding an unjust factor (paragraph [271]). I did not understand Bitkub to challenge that aspect of Marcus Smith J’s judgment.

Here, there is no question of the payment by Mr D’Aloia being unauthorised; it was Mr D’Aloia’s USDT and he made the transfer to td-finan. There is a suggestion in the skeleton that it is intended to refer to the payment away by Bitkub. It was not clear to me how an unauthorised payment by Bitkub could make Bitkub’s receipt unjust, and the point was not developed in submissions.

What seems to me significant is the allegation, at paragraphs 19(iv) and 23 of the Re-Amended Particulars of Claim, to the effect that the transfer by td-finan through the Hops, was unauthorised. Those paragraphs were neither admitted nor denied (Re-Amended Defence paragraph 19). As I have noted, the evidence of Mr D’Aloia was not seriously challenged, however, and I consider that those paragraphs of the Re-Amended Particulars of Claim have been established.

I appreciate that the allegation was made in connection with the fraudulent misrepresentation claim against the First and Seventh Defendants. However, the reference to the USDT being “misappropriated” in the unjust enrichment claim can only, it seems to me, be to this. As Mr Bergin emphasised to me, statements of case plead facts, not law. It does not seem to me right, and if right it is a technical point that risks the just disposal of the case (UK Learning Academy at [47]), to say that the allegation of unauthorised conduct at paragraphs 19(iv) and 23, which is essentially not contested, cannot apply equally to the unjust enrichment claim. In my view, this factor was both pleaded and established.

A claimant need only establish one unjust factor, of course, such that it is not strictly necessary to consider the point on mistake. In case I am wrong in what I say above, however, I should address it.

Kleinwort Benson obviously is authority for the proposition that money paid under a mistake (in that case of law) can in principle be recovered in unjust enrichment. Again, the facts of that case are rather different to this one but, as is apparent from what is said by Lord Hoffmann at page 399, he was stating a general proposition not tied to the facts of the case.

There is no reference to mistake in the unjust enrichment sections of either the Re-Amended Particulars or the Re-Amended Reply. Mr D’Aloia does assert, at paragraph 27 of the Re-Amended Particulars of Claim, that he made the transfers he did because he was misled by td-finan. Again, his evidence on that point was not seriously challenged and Bitkub now accepts that Mr D’Aloia was a victim of fraud, such that the claim has been made out.

In my view that factual allegation is enough to allow Mr D’Aloia to assert mistake. Doubtless it could have been made much clearer, and I do not consider this point to be as clear as the point on unauthorised payment. However, the legal characterisation of a point is not a matter for statements of case, it is a matter for submissions. In my view Mr D’Aloia has done enough to allege that the payment was made under a mistake and to establish that unjust factor.

The second area of disagreement was the application of defences. Bitkub relies on good faith change of position, ministerial receipt and the alleged impossibility of counter-restitution.

In the course of his closing Mr Bergin noted that there was a question as to whether good faith change of position applied in the context of crypto-assets as a matter of law. I was not addressed on the point in any detail, but in recognising change of position as a defence to claims in unjust enrichment in Lipkin Gorman v Karpnale Ltd Lord Goff offered a broadly framed justification at page 579F: “where an innocent defendant’s position is so changed that he will suffer an injustice if called upon to repay or to repay in full, the injustice of requiring him so to repay outweighs the injustice of denying the plaintiff restitution.” The focus was not on the nature of the asset that comprised the enrichment but, rather, to the relative injustice as between the parties. That logic to my mind applies equally to crypto-assets, and accordingly in principle I do not see why the defence should not be available where claims are asserted in respect of them.

Lord Goff framed the defence in broad terms at page 580F: “…the defence is available to a person whose position has so changed that it would be inequitable in all the circumstances to require him to make restitution, or alternatively to make restitution in full.”

In Niru Battery Manufacturing Co v Milestone Trading Ltd [2003] EWCA Civ 1446 the Court of Appeal considered the good faith element of the defence. Clarke LJ, as he then was, at paragraph [164] of his judgment approved the approach adopted by Moore-Bick J, as he then was, at first instance ([2003] EWHC 1032 (Comm) at [135]):

The position is the same in the case of alleged wrongdoing. Papadimitriou v Crèdit Agricole Corpn [2015] UKPC 13 concerned the attempt to recover proceeds of sale of a collection of furniture. The sale had been organised by Mr Symes, who had no title to the furniture and no right to sell it. He then laundered the proceeds through a series of offshore accounts before they arrived in an account with the bank. In considering the bank’s duty to inquire Lord Sumption summarised at [33]:

Because of the way that it was pleaded and presented, applying the law to the facts in this case is best taken in stages.

In the Re-Amended Particulars of Claim, the Claimant launched something of a pre-emptive strike on the good faith change of position defence at paragraph 37(v):

Mr Bergin put some stress on Bitkub’s conduct in allowing Ms Hlangpan to set up an account with what he characterised as minimal due diligence; this, he suggested, amounted to acting in a commercially unacceptable way. I had a number of issues with that submission.

First, it is not consistent with the Claimant’s pleaded case. The Claimant in his Re-Amended Reply specified that:

The allegation was not that Bitkub failed to seek adequate KYC; it was that Bitkub did not seek any KYC. Bitkub addressed that allegation in its disclosure by producing the KYC material provided to it.

Secondly, if the Claimant had wanted to criticise the due diligence that Bitkub had carried out it needed to do so by reference to a standard. The starting point, at least in the written opening, was that English law rules on money laundering would apply unless foreign law were specifically pleaded, which it was not. That was not developed at all in the course of trial, nor were the English standards put to any of the witnesses. For the avoidance of doubt, I reject the argument. It seems to be founded on the Court of Appeal’s decision in R v Rogers [2014] EWCA Crim 1680. That case involved alleged offences under the Proceeds of Crime Act 2003 and at least part of the defendant’s alleged conduct took place in the United Kingdom. Bitkub’s actions were carried out exclusively in Thailand. Nor does it work to point purely to the jurisdictional nexus that has resulted in Bitkub being before me. Bitkub could be subject to the jurisdiction of the English courts without being subject to English law, less still UK commercial practice.

There was no evidence as to what that standard was in the Thai market, and as I have noted a late application to adduce such evidence was opposed by Bitkub and was rejected by Master Pester.

Given the lack of such expert evidence all I have to rely on is Miss Vijitpinyo’s evidence that she considered the local regulations to have been satisfied, which I accept she did. That does not equate to saying that Bitkub did, in fact, comply with local laws and regulations; Miss Vijitpinyo was not involved at the time and was not, in any event, called as an expert on Thai KYC. It does show that Bitkub believes it was compliant, and the Claimant has adduced no evidence that would allow it to challenge that belief. The pre-emptive strike based on KYC failed.

One then moves to the next stage, which arises in two places in the statements of case:

It was for Bitkub to show the former and for Mr D’Aloia to show the latter.

Mr Dhanasarnsilp repeatedly recognised in his evidence before me that Ms Hlangpan’s withdrawals on the morning of 21 February 2022, less than two hours before the receipt of the USDT in issue in this case, breached her account limits and should have caused her account to be blocked pending further inquiry and an alarm to be raised on Bitkub’s systems requiring someone at Bitkub to look into what Bitkub considered to be suspicious account activity. The receipt of USDT 400,000 shortly thereafter would not have caused a block on the account in itself, but would have caused a further alarm to be raised, again because Bitkub considered a transaction of that size to be suspicious for someone with Ms Hlangpan’s declared income. To paraphrase the language of Niru Battery, Bitkub had, or at least thought that it had, multiple good reasons to look into these transactions. Or in the language of Lord Sumption, there were features of the transactions that, if left unexplained, were indicative of wrongdoing.

Mr Connell referred me to the Tecnimont decision. There, HHJ Bird at [166] drew a contrast:

This, in my view, was the latter type of case. Although the gap in time between Ms Hlangpan receiving the funds and her paying them away was hours rather than months, Mr Dhanasarnsilp’s evidence was that Bitkub’s systems automatically stopped withdrawals when the THB 2 million daily limit was reached. Under clause 2.3(9.3) of the User Agreement, Bitkub had the right, at its sole discretion, to block any transactions, expressly including withdrawal transactions, that involved a Prohibited Use of the account. Under Appendix 1, Prohibited Use included “Fraud: Activities that defraud companies other users using the website of the Company or any other person…”. Under clause 2.3(10.1(2)) it had the further right, again at its sole discretion, to suspend the account where it suspected the customer was using the account for a Prohibited Use. Under clause 8.8 Bitkub had the right to “suspend suspicious transactions of the Client at its sole discretion in order to investigate and report to relevant government agencies or suspend use of the customer’s account for such suspicious reasons.” The Customer agreed to waive any claim for damages in such circumstances.

Put simply, Ms Hlangpan could only act because Bitkub permitted her to do so. Until Bitkub did so her account was blocked and Bitkub was fully within its rights to keep that block in place pending an investigation. I recognise that the User Agreement is governed by Thai law, but it was not suggested that Thai law would produce a different outcome to English law in interpreting what I consider to be clear terms. There is nothing to suggest that Bitkub was under any time pressure when it came to investigating these transactions.

In his written closing Mr Connell suggested that Ms Hlangpan might have been able to pay away the USDT 400,000 because there was an internal approval to exceed the daily limit or, alternatively, a system malfunction. The evidence needed to support such a submission, which one would expect Bitkub to have if it existed, was not before me, however. In any event, both explanations seem to me improbable. Ms Hlangpan’s freedom to continue using her account following breach of the withdrawal limits does not appear to have been the result of any considered approval, given that the gap between the first and second transactions breaching the limit was a little over a minute. It also seems unlikely to have been a system failure, given that Ms Hlangpan was repeatedly able to breach the daily limit over a period of some time, which one would not expect if Bitkub properly monitored and tested its systems.

Mr Connell further submitted that I had no evidence as to what systems and controls were required by Thai law; it might be that Bitkub’s systems were unusually stringent, and a failure to measure up to its potentially higher standards should not be held against a party. I cannot accept that submission:

Finally, there was at least some argument by Bitkub that it was impossible for Bitkub to know of the fraud in February 2021 when Mr D’Aloia himself did not realise he had been a victim of fraud until June. To the extent that point was being advanced it seems to me wrong. Bitkub did not need to know the specifics of the fraud being perpetrated on Mr D’Aloia; it needed to have, or to think it had, good reason to believe that the sums received into the 82e6 wallet were tainted. On the evidence before me, plainly it did.

In my view, the burden of showing good faith for the purpose of the change of position defence was on Bitkub, and Bitkub has failed to discharge it.

Mr Bergin submitted that Bitkub’s failure to adduce evidence explaining why Ms Hlangpan had been able to continue using her account despite the suspicious transactions and the resulting block gave rise to an obvious inference – that Bitkub could not explain what had happened. He referred me to the following passage of “Lewin on Trusts” (20^th Ed, Sweer & Maxwell):

My only reservation with that submission is that, on the evidence, I am not sure why actual knowledge needs to be inferred. Senior Bitkub employees have explained that there would have been blocks placed on Ms Hlangpan’s account and alarms raised requiring an investigation due to concerns over money laundering; those blocks were apparently lifted, permitting Ms Hlagnpan to deal with the USDT 400,000, with full knowledge of that account activity. In the circumstances, the evidence seems to me to establish that Bitkub did know of at least the serious risk of money laundering in allowing Ms Hlangpan to continue to use her account and was willing to take that risk. If, however, a further inference based on Bitkub’s failure to offer an explanation supported by evidence is needed to establish actual knowledge, on the basis of Eagle Trust I would draw it.

The second defence is ministerial receipt. An agent who receives a benefit on behalf of their principal and pays over to the principal the value of that benefit or applies it in accordance with the principal’s instructions has a defence to a claim for restitution provided that they acted in good faith and without notice of the claim. Bitkub’s case is that the receipt of the USDT was balanced by an immediate credit to Ms Hlangpan’s account, a credit that she converted to Thai baht and withdrew long before Bitkub was informed of Mr D'Aloia’s claim.

Again, Mr Bergin noted there was an open question as to whether the defence is available in the context of crypto-assets. Given the similarities between this defence and the defence of good faith change of position, which I touch on below, it seems to me they should approach the same issue in the same way, such that the defence of ministerial recipe should also be available, in principle, to receipts of crypto-assets.

There are, it seems to me, two issues in the application of the defence here: the question of enrichment and the question of good faith.

Much time was spent on the enrichment issue: could Bitkub assert ministerial receipt simply by showing that it had credited the relevant sum of USDT to Ms Hlangpan’s account or did it also need to show that those sums had been paid to Ms Hlangpan? The point was fiercely contested, in part because there is a clash of authority but also, I think, because Bitkub only disclosed documents relevant to this issue as part of its supplemental disclosure.

The chronology of Ms Hlangpan’s account as set out in her account statements is, it seems to me, decisive on the enrichment issue:

I have found that Ms Hlangpan’s Bitkub account was being used to launder the proceeds of fraud and that the transaction volumes could not be sustained by her legitimate income. It follows that the subsequent transactions were likely to involve the funds of other victims. On a FIFO basis those transactions resulted in all of what is said to be Mr D’Aloia’s USDT being converted to Thai baht and withdrawn; on a pro rata basis around 95% of the original USDT 400,000 received into the account on 21 February 2022 had been paid away by 24 February. There was then a pause in the transactions until late March, when the account became active again. I do not have full details of the later transactions, but it seems to me likely that even on a pro rata basis the overwhelming majority of the USDT received on 21 February 2022 had gone by the time that Bitkub was notified of Mr D’Aloia’s claim in June 2022.

In those circumstances, the enrichment issue does not seem to me a significant one. The debate in those cases is whether an agent can rely on the defence of ministerial receipt where it had no notice of the claim when it credited the principal’s account or whether, instead, it also needed to be unaware of the claim when it paid the money to the principal. Here, Bitkub’s state of knowledge was the same at both points in time: it knew before Ms Hlangpan received the USDT 400,000 that she was receiving sums into her account well in excess of her stated income and that she was breaching her daily withdrawal limits; it did not know about Mr D’Aloia’s individual position until after the money was paid away.

To the extent that I need to decide the point, I would prefer the approach of Marcus Smith J in High Commissioner for Pakistan v Prince Muffakham Jah (to the effect that payment is required) to that of Sales J in Jeremy D Stone Consultants Ltd v National Westminster Bank plc [2013] EWHC 208 (Ch) (that simply crediting the account is sufficient) for the reasons that Marcus Smith J gives at [290] and that are developed by HHJ Paul Matthews in Terna Energy at [30]-[66]. In particular, I agree that the crediting would only be provisional and could be reversed. That is particularly clear in this case, given the evidence that Ms Hlangpan’s account activity was considered suspicious by Bitkub and would have triggered both blocks on her account and alerts to Bitkub personnel and given Bitkub’s clear rights to suspend Ms Hlangpan’s use of her account pending an investigation.

That moves the analysis to what seems to me to be the more important question here. Bitkub can only rely on the defence of ministerial receipt if it was in good faith when it acted (in my view by paying away the funds). The position was summarised by Millett LJ as he then was in Portman Building Society v Hamlyn Taylor Neck [1998] 4 All ER 207h-j:

When will an agent have “notice of the claim” in cases such as this? Mr Connell suggested that the first notice that Bitkub had of Mr D’Aloia’s actual claim was in June 2022. That seems to me irrelevant; nothing in the cases suggests that proceedings need to have been issued or contemplated. The reference to “claim” is shorthand for a somewhat earlier stage.

In Jeremy Stone, Sales J addressed the requisite knowledge at [145]:

As I read that, had Mr Aplin had grounds for believing that a fraud was being committed, such that he had good grounds to refuse to follow SEWL’s instructions, the defence of ministerial receipt would no longer have been open to the bank. That is in line with the requirements for showing good faith change of position, a defence with obvious similarities to ministerial receipt (indeed, as noted in Goff & Jones at paragraph 28-02, there are arguments for saying that the latter has been or should be subsumed into the former).

The factors that I have addressed above therefore apply equally here. Bitkub knew that Ms Hlangpan was exceeding her withdrawal limits, limits which were imposed to address the risk of money laundering; it had the contractual right to suspend further use of the account and the benefit of a waiver of damages from Ms Hlangpan; yet it chose to let her go ahead anyway and has offered no explanation for doing so. It took a risk by allowing Ms Hlangpan to breach policies put in place to counter money-laundering. There is nothing unjust in holding Bitkub liable in such circumstances if Ms Halngpan was, in fact, involved in laundering funds. The defence of ministerial receipt is not available.

Very little time was devoted to the defence of counter-restitution being impossible. The rule is summarised in Goff & Jones at 31-01:

It was not at all clear to me what benefit Bitkub suggested Mr D’Aloia had received, whether from Bitkub or anyone else. He is a victim of fraud who has lost money as a consequence. There are no benefits for him to restore.

In the section of his written closing dealing with constructive trust, Mr Connell noted that restiutio in integrum is impossible because Ms Hlangpan has withdrawn the relevant funds from her account. I accept that she has, but to the extent that is also relied on for the purposes of this defence it seems to me to be focussed on the wrong relationship.

In opening, Mr Bergin put the constructive trust claim in four ways, submitting that it did not much matter which was adopted. I disagree with the latter point because the different routes give rise to different trusts with different trustees that come into existence at different points in time. The four routes are:

This basis is said to arise from the speech of Lord Browne-Wilkinson. His Lordship started by identifying certain general principles of trust law at page 705C-E:

He then addressed the position of the recipient of trust property at page 707B-D:

Finally, Lord Browne-Wilkinson specifically addressed fraud at page 716C-D:

That latter passage was considered by Ferris J in Box v Barclays Bank [1998] Lloyd’s Rep Bank 185, who concluded at page 200:

Rimer J in Shalson v Russo endorsed Ferris J’s approach and conclusion at [115]. Mr Connell also referred me to the judgment of Millett LJ in Bristol & West Building Society v Mothew at pages 22-23:

Since he shortly after referred to what Lord Browne-Wilkinson said in Westdeutsche (see page 23) I accept that he must have had that decision well in mind. Evidently, Mr Connell submitted, Millett LJ also did not read Lord Browne-Wilkinson’s speech as setting down a general principle that a fraudulent representation inducing a contract makes the representor, without more, a constructive trustee; otherwise, he would not have concluded that beneficial interest vested in the transferee.

In terms of Westdeutsche not laying down a general rule applicable in all cases of fraud I accept the submission. I do not understand Mr D’Aloia’s case to be so ambitious, however; he relies on a particular type of fraud addressed by the Court of Appeal in Martin J Halley v The Law Society. At paragraphs [45]-[48] Carnwath LJ, as he then was, distinguished between a contract induced by fraud and a contract that was, itself, the instrument of the fraud:

In respect of the constructive trust claim, the same allegation is advanced here. I have found that the parties behind td-finan never intended to provide Mr D’Aloia with anything – the whole thing was a scam. It was, to use the language of the learned Judge in Halley, “no more than a vehicle for obtaining money by false pretences”.

In the circumstances this seems to me a different type of case to Box, Shalson or Mothew. The facts of Halley seem to me largely indistinguishable, such that it is binding on me. I therefore accept that a constructive trust against the First Defendants arose over the funds they received from Mr D’Aloia at the point of transfer.

The difficulty for Mr D’Aloia is part legal, part factual. As a factual matter I have found he has not evidenced, whether by way of tracing or otherwise, that his funds flowed to Bitkub. That is obviously fatal to the claim.

Legally, there is the question of how the First Defendants’ breach of trust in paying away Mr D’Aloia’s USDT gives rise to a claim against Bitkub. In Byers, Lord Burrows summarised the position at paragraph [157]:

Lord Briggs made similar points at paragraph [42]:

I have found that Ms Hlangpan withdrew the proceeds of the USDT 400,000 well before the commencement of proceedings or service of the freezing order on Bitkub. Mr D’Aloia has not pursued a claim in knowing receipt (or, for completeness, dishonest assistance) and accepts that he is unable to do so. On the face of it, the property has been dissipated or destroyed and there is no knowing receipt claim to come to the rescue.

In the Claimant’s written opening it was submitted that the equitable proprietary remedy depended on there being property subject to a trust that was transferred in breach of trust and received by the defendant; it was not necessary to show that the defendant knew of the breach of trust. Reference was made to Byers at paragraph [18]. It seemed to me that this was being advanced as some sort of alternative to the proprietary claim and the claim in knowing receipt. If that was the case, it seemed to me not to be right.

As Lord Briggs noted at paragraphs [16]-[17], the issue for the Supreme Court related to a claim in knowing receipt. Lord Briggs made his observations at paragraph [18] by reference to what was said by Lord Browne-Wilkinson in Westdeutsche, and as I have noted I consider that passage to be a reference to knowing receipt. That conclusion is reinforced by Lord Briggs’ multiple references to the claimant vindicating his or her title through a claim in knowing receipt (see paragraphs [24], [26] and [27]). His Lordship then addressed three further arguable uncertainties about the equitable principles relating to knowing receipt (paragraph [29]) before returning to “the central issue” (paragraph [36]), which again focussed on knowing receipt. The written submissions also referenced Lewin on Trusts paragraph 42-025. That is also a passage concerning knowing receipt.

No other basis was suggested by which Mr D’Aloia’s breach of trust claim against the First Defendants translated into a claim against Bitkub and it seems to me that it would be somewhat odd if there were to be one. As the judgments of Lord Burrows and Lord Briggs make clear, there is no gap in the law: if the recipient retains the trust property there is the proprietary claim; otherwise there is the knowing receipt claim. To the extent a gap arises on the facts of this case, it is from the way in which Mr D’Aloia has elected to pursue his claim.

In Angove Lord Sumption stated at [30]:

I do not understand this to be more than a summary of general principles. I accept it, of course, but what matters is the detail.

Here, for the reasons I have given it seems to me that a constructive trust arises in accordance with the principles set out in Halley and Westdeutsche. If I am wrong on that, I consider that a somewhat different constructive trust could in principle arise on rescission applying the principles in cases such as Mothew, albeit on the facts I do not accept that has been alleged by Mr D’Aloia in this case. All of that is consistent with what is said in Angove, but I do not regard that decision as giving rise to a separate, free-standing ground for finding a constructive trust.

It seems to me that this only arises if I am wrong in what I say above in connection with Halley and the Westdeutsche constructive trust. Halley contemplates that the beneficial interest never passes and that rescission is pointless because there is nothing to set aside. As such, that type of constructive trust effectively pre-empts a rescission based trust.

Applying the paragraphs of Mothew that I cite above, I agree that in principle if there was a contract induced by fraud, the victim of that fraud has a right to rescind it and that on doing so a constructive trust arises against the fraudster. I do not understand that point to be contested by Mr Connell. He objects to the imposition of such a trust in this case both on the ground that no such trust is pleaded and on the basis that the trust could only arise prospectively from the point of rescission.

Mr Connell submitted that PD 16 paragraph 8.2 requires all breaches of trust to be pleaded, which logically means that the trust that is said to have been breached must also be pleaded. Here, the pleaded case was tied to the agreement with td-finan being void rather than voidable. There was no reference to rescission at all.

Mr Bergin accepted that the statements of case could have been framed more elegantly, but submitted that it was clear that they were intended to catch both an immediately incepting, Halley type trust and a rescission based trust. He directed me to paragraphs 13 and 14 of the Re-Amended Reply and, in particular, to paragraph 30. This, he submitted, was made clear that there was a fallback argument for what was to happen if the legal title passed, which was a rescission based trust.

The pleading as to constructive trust starts at paragraph 39 of the Re-Amended Particulars of Claim, which provides:

Paragraph 40(iii) then specifies part of the reason why a constructive trust has arisen by operation of law:

The Claimant then asserted at paragraph 41:

Paragraph 30 of the Re-Amended Reply states:

In my view, the trust pleaded in the Re-Amended Particulars is expressly premised on a void contract, not a voidable one. Moreover, it is not alleged that the trust needs to be or is backdated to the time of the fraud; it is said that beneficial title never passed. There is no mention of the trust being dependent on rescission of the agreement between Mr D’Aloia and td-finan.

Nor do I accept Mr Bergin’s submission that anything changes with the Re-Amended Reply. The language in paragraph 30, for instance, tracks very closely the language of paragraph 39 of the Re-Amended Particulars. The contrast that is being drawn, in both cases, is with the proprietary restitution claim, which was abandoned on the first day of trial, not between different inceptions of a constructive trust.

If I am wrong on that the question arises as to when the trust incepted. Mr Bergin referred to Shalson at [106]-[120], [122] and [127] and to the commentary on that portion of the decision in Goff & Jones at 40-24. The starting point in Shalson is [122]:

At [123] Rimer J quoted Millet LJ in Mothew at page 23, in which he had referred to his earlier first instance judgment in El Ajou. Millet LJ explained that in El Ajou he was:

Millet LJ in Mothew immediately went on to emphasise:

Rimer J did not quote that part of Millett LJ’s judgment, but he did not in any way suggest that he disagreed with it. He concluded at [124]: “These authorities support the view that, upon the implied rescission of the loan contracts, Mr Mimran became entitled to assert a proprietary interest in the money he advanced to Westland, being an interest which would then entitle him to trace the money further.”

At [126] he stated that he was not excluding the possibility of a wider right, but he made clear at [127] that he was not finding such a right in the case before him; what revested was “the property in the money he advanced to Westland entitling him at least to trace it into assets into which it was subsequently applied.” That is wholly consistent with what Millett LJ said about the equity of rescission arising at the time of the misrepresentation; such an equity would be sufficient in and of itself to permit tracing. It is reflected in the observation in Snell’s Equity at [26-013] that:

Were it pleaded I agree that, following rescission, a constructive trust could arise, subject to there being identifiable trust property. I do not accept that it could in some way be back-dated to the point when Mr D’Aloia paid money to td-finan. Since the basis of the trust is the rescission of the fraudulently induced agreement, the trustees would be the First Defendants. As with the Westdeutsche constructive trust, there would therefore be an issue with how, if at all, this could affect Bitkub. In my view, for the reasons given above, it could not on Mr D’Aloia’s case as advanced before me.

This is very different to the other iterations of the constructive trust. There, Mr D’Aloia is arguing that the First Defendants are the constructive trustees from the point when they received Mr D’Aloia’s funds on 10 January 2022, such that Bitkub takes subject to Mr D’Aloia’s beneficial interest unless Bitkub is a bona fide purchaser for value without notice. Here, the argument is that a constructive trust is imposed on the USDT in the hands of Bitkub itself; Bitkub is the trustee, and the trust arose at the point Bitkub received the funds on 21 February 2022, not before.

What Mr Bergin therefore seeks is a constructive trust premised on the fact that Bitkub failed to implement its own procedures aimed at combatting money laundering when Ms Hlangpan opened her account. When she received the USDT 400,000, converted it to Thai baht and paid it away it was against the backdrop of her suspicious account usage, of which Bitkub was aware; that is the foundation of the constructive trust advanced at trial.

That argument faces immediate, and to my mind insurmountable, hurdles.

The first is that it is not pleaded. For the reasons I set out in respect of the rescission constructive trust, the allegation is that a constructive trust is imposed on the First Defendants by virtue of their wrongdoing in committing the fraud. Bitkub is said to take subject to that interest. Indeed, here the case is stronger because the pleaded trust is against the First and Seventh Defendants, which would be correct for the rescission trust but not the Bitkub trust.

Moreover, the pleaded claim is not that Bitkub’s conscience is impacted by its lack of proper diligence; it is not specific to Bitkub at all. The claim is that because a constructive trust arose against other parties, Bitkub (and the other Exchange Defendants) take subject to that trust. That is reinforced by the pleading as to breach at paragraph 43 of the Re-Amended Particulars:

No breach of trust is alleged against Bitkub, as would be required under PD 16 paragraph 8.2 if that were to be advanced against Bitkub.

I do not accept that the Claimant’s allegations of commercially unacceptable conduct or unconscionable receipt extend to found any claim. Those allegations were made only in respect of the defence of good faith change of position. It seems to me that that is more than a mere technicality. Had Bitkub faced a positive claim premised on the acceptability, or otherwise, of its conduct it may have taken a different view as to the evidence it wished to adduce. In particular, as I have noted, Bitkub opposed the Claimant’s application to adduce expert evidence as to compliance and AML in the Thai market. This is a classic instance, it seems to me, of the point made in Boake Allen that the definition of the issues is fundamental to the evidence necessary at trial.

The position is further compounded because in the amendment application before Bacon J, the Claimant sought permission to amend his claim to assert unjust enrichment and knowing receipt on the basis that the defendants “behaved in a ‘commercially unacceptable way’ by virtue of failings of corporate governance and due diligence in relation to the activities of the exchanges” (see paragraph [10] of Bacon J’s judgment). Essentially, that was an attempt to plead a constructive trust claim, in that if knowing receipt can be established the recipient may become a constructive trustee (Westdeutsche at page 707D). Bacon J refused to grant permission on the grounds that the claim raised questions of foreign law and the defendants should have the opportunity to call expert evidence in response (paragraph [25]) and there was no good reason why the arguments could not have been advanced sooner (paragraph [27]).

What has changed? The claim is now advanced explicitly on the basis of a constructive trust rather than unjust enrichment or knowing receipt; it is not pleaded at all; and it is advanced only at trial. The alleged basis is still the same, however – that Bitkub’s failure to follow its own systems and controls was commercially unacceptable and attached it with sufficient notice that a constructive trust should arise. Had the Claimant sought to amend expressly to plead a constructive trust on that basis as part of his application before Bacon J I believe she would have rejected that application for the same reasons she rejected his application in respect of knowing receipt and unjust enrichment. It cannot be the case that Mr D’Aloia’s position is improved by waiting, not least because Bacon J in part rejected his application because he had delayed.

There was some suggestion by Mr Bergin that if Bitkub had objected to this element of Mr D’Aloia’s claim it could have applied to strike it out, and should not be allowed a back door strike out through a restrictive reading of the statements of case. As I noted to Mr Bergin during closing, I find that argument hard to follow on the facts of this case. Bitkub is not seeking to remove anything from the statements of case; it is simply saying that the case the Claimant seeks to advance at trial is not pleaded. There would be nothing to strike out. The better analysis, it seems to me, is that by taking an expansive reading of the statements of case the Claimant is seeking a back-door amendment to allow it to advance an unpleaded case, and indeed a case for which it sought permission to amend but for which that permission was refused. That simply takes me back to the points I have made in respect of the scope of the pleaded case and Bacon J’s judgment on the amendment application.

The second, very obvious, difficulty is that I have found that the Claimant has failed to show that Bitkub received any of its funds. Accordingly, even if a trust could have been established, it would not be in favour of Mr D’Aloia.

Bitkub asserts that it is equity’s darling – a good faith purchaser for value without notice. For reasons I have already given, I do not accept that Bitkub has shown that it can avail itself of this defence. Bitkub’s witness confirmed that the flow of funds through Ms Hlangpan’s account would have caused a block to be placed on Ms Hlangpan’s account and raised alarms on Bitkub’s systems, putting Bitkub on notice before the receipt of USDT 400,000 said to contain Mr D'Aloia’s funds, yet Bitkub allowed Ms Hlangpan to pay those funds away.

Bitkub’s documentary and witness evidence before me did nothing to address why steps were not taken. I have therefore concluded that Bitkub had more than simple constructive notice of the risk that Ms Hlangpan’s account was being used for money laundering; it had actual notice.

Both parties suggested that it would be useful for me to express a view on the requisite level of knowledge for a party to be deprived of the defence of bona fide purchaser for value without notice in the context of crypto-assets. Given that I have found that Bitkub had actual knowledge that is, in my view, neither necessary nor desirable.

This is a lengthy judgment because the legal points to which it gives rise are novel, contentious or both. Ultimately, they are of secondary importance, in that Mr D’Aloia has failed to show on the balance of probabilities that any of his USDT ever arrived at the 82e6 wallet. In the circumstances, Mr D’Aloia has no claim against Bitkub because it did not receive anything from him. It holds no trust funds; there is no normatively defective transaction as between Bitkub and Mr D’Aloia to undo.

In any event, while I accept, for the purposes of these proceedings, that a constructive trust arose over Mr D’Aloia’s funds in the hands of the First Defendants, the USDT 400,000 received by Bitkub has been paid away and no claim is asserted against Bitkub in knowing receipt. I noted, much earlier in this judgment, that one of the purposes of the statements of case, as is explained in the Chancery Guide, is as a legal audit, to ensure that a complete claim is asserted. That did not happen here, such that the legal link connecting Mr D’Aloia with Bitkub is simply missing from his claim. For this reason, too, he cannot succeed in his breach of trust claim.