Legal Updates

Our first article in this series looked at the way in which the Irish High Court adapted traditional legal remedies, such as injunctions and disclosure orders, to assist cryptocurrency holders who are seeking to recover stolen cryptocurrency.

This second article looks at how the Irish High Court has used the Norwich Pharmacal Order (‘NPO’) to assist cryptocurrency holders seeking to recover stolen cryptocurrency. In the two cases, which are discussed below, the High Court granted NPOs to parties seeking information about the person(s) who owned or had access to certain accounts with a cryptocurrency exchange platform.

Norwich Pharmacal Order

A NPO is a type of court order which compels a respondent to disclose certain information to an applicant. It is an equitable remedy that is often sought against an innocent third party who possesses information about the identity of an anonymous wrongdoer. The order is available in Ireland, though it may be described as a disclosure or discovery order.

In Parcel Connect Ltd & Ors v Twitter International Company [2020] IEHC 279, the Irish High Court noted that the premise of such an application, as set out in Norwich Pharmacal v Customs & Excise [1974] A.C. 133, is that:-

“[E]ven if the defendant is not legally responsible for the wrongdoing … it has nevertheless got so mixed up in the wrongdoing … as to have facilitated the wrongdoing, it has come under a duty to assist the plaintiff by disclosing the identity of the wrongdoer”.

There is an onus on the party seeking a NPO to make out a strong prima facie case of wrongful activity but certainty or a high degree of certainty is not required.

Stolen Cryptocurrency

In Williams v Coinbase Europe Ltd (High Court Record No. 2021/348P), an application for a NPO was made to the Irish High Court by US businessman, Titus Williams, as part of efforts to trace approximately $1.8 million (€1.5 million) in Bitcoin, which was stolen from his cryptocurrency wallet in February 2021.

In Stanbury v Coinbase Europe Ltd (High Court Record No. 2022/714P), a similar application was made to the Irish court by Jack Stanbury. Mr. Stanbury claimed that 41.96 Bitcoin (currently worth around €1.2 million) was stolen from his digital wallet in August 2013, due to a hack of his user account on the now defunct Japanese Bitcoin exchange, MtGox.

Tracing the Bitcoin

Both plaintiffs employed the services of specialist cryptographic tracing firms, which enabled them to trace some of their stolen Bitcoin to accounts held by unknown persons with the Irish registered company, Coinbase Europe Limited (“Coinbase”).

While Coinbase did not object to the plaintiffs’ applications, its position was that, due to its obligations under contract and data protection laws, it could not provide the information sought unless it was ordered by a court to do so.

Norwich Pharmacal Orders were, therefore, sought in order to compel Coinbase to provide information that would assist in identifying the unknown account holders.

Orders granted

In each case, the Irish High Court ordered Coinbase to disclose to the plaintiffs within 5 days all information in its possession that would identify or assist in identifying the person(s) unknown who owned or had access to the relevant accounts. The information to be disclosed included, but was not limited to, the names, e-mail addresses, telephone numbers and IP addresses associated with all log-ins and log-outs relating to the accounts.

The court was satisfied that the plaintiffs in each case had made a strong prima facie case of wrongdoing, and that there was no other means for the plaintiffs to establish the owners of the accounts, save for Coinbase disclosing the information.

The orders in both cases were granted subject to the plaintiffs’ undertakings to only use the information disclosed to seek redress in relation to the wrongdoing complained of.

Conclusion

NPOs have grown in popularity and frequency in Ireland over the past number of years with the growth of the internet and social media platforms. Their recent application to the world of cryptocurrencies is further evidence of the willingness of the Irish courts to adapt traditional remedies and apply them to new technologies.

While cryptocurrencies have brought key benefits for investors, these same benefits have also allowed for the prospect of fraud, misappropriation and theft within the crypto sphere. Although identifying the owner of a wallet is just one step in the recovery process, with retrieval of the assets being yet another hurdle, the above decisions further demonstrate that the Irish courts are willing to provide investors with legal tools to rely upon when their cryptocurrency has been stolen.

If you require advice in relation to the matters covered in this article please contact a member of our Commercial Litigation Team.

The authors would like to thank Aoife Grugan for her contribution to this article.