Difficulties due to how assets may be traded in an anonymous and unregulated fashion.
In May 2022, American actor Seth Green lost four non-fungible tokens (NFTs) worth more than US$300,000 (S$405,000) in a phishing attack. One of the stolen NFTs, Bored Ape Yacht Club (BAYC) No. 8398, was sold to someone with the pseudonym DarkWing84.
DarkWing84 claimed that he bought the work in good faith and did not know it was stolen. Mr Green eventually paid 165 ether to reclaim BAYC No. 8398.
Mr Green is not alone. More than US$100 million worth of NFTs were reported to have been stolen through scams between July 2021 and July 2022.
NFTs are tokens that exist on decentralised digital ledgers called blockchains. They can be used to represent underlying assets, which can be digital or physical, such as artwork, videos and music.
Legal recognition of NFTs as property could help to pave the way for the recovery of lost or stolen NFTs. In an insolvency, the owner of a property held by an insolvent debtor also has priority over other creditors if he holds a proprietary interest in the asset.
What progress has been made so far to recognise NFTs or any other digital tokens (such as cryptocurrencies) as assets?
A recent landmark court decision in Singapore held that NFTs could be considered property as they fulfilled certain legal requirements, such as being easily distinguishable from one another and having owners capable of being recognised as such by third parties.
The court decision, released in October 2022, recognised Mr Janesh Rajkumar’s NFT, known as BAYC No. 2162, as property. It reasoned that, first, an NFT was made up of metadata and this could differentiate one NFT from another. Second, the owner could exclude others from using the NFT because it cannot be dealt with without the owner’s private key. Third, the NFT could be traded in a marketplace. Lastly, the NFT had permanence and stability, similar to money in bank accounts that existed as ledger entries.
Mr Rajkumar had put up his NFT as collateral to borrow cryptocurrency from an unknown person with only a pseudonym, chefpierre. The NFT was then transferred into an escrow smart contract for the loan duration. The parties agreed that chefpierre would not exercise the “foreclose option”, a function available on NFTfi.com. Despite this, chefpierre exercised the foreclosed option and the NFT was released into chefpierre’s wallet.
Mr Rajkumar then sought an injunction to prevent the sale of his BAYC No. 2162 NFT. He wanted the NFT to be returned to him since it had unique features. The recognition of the NFT as property enabled the court to grant the injunction. This judgment paved the way for greater legal protection of NFTs in Singapore.
Similarly, in June 2022, the British High Court recognised for the first time that NFTs could be treated as property under British law by granting an injunction against their sale on a marketplace called OpenSea. Ms Lavinia Osbourne, the founder of Women in Blockchain Talks, sought the injunction after her NFTs were removed by fraudsters. The stolen NFTs were traced to two accounts controlled by unknown persons on OpenSea.
Another landmark court decision in Singapore involved stolen cryptocurrencies. In a decision released in March 2022, CLM, the claimant, sued to recover his stolen cryptocurrencies, worth US$7 million then. The cryptocurrencies were stored in two digital wallets and the private key was kept in a physical safe. The stolen cryptocurrencies were transferred to various wallets, and some of these wallets were held by exchanges with operations in Singapore.
Recognising the cryptocurrencies as property, the High Court granted an injunction against the unknown persons to prevent them from dealing with or diminishing the cryptocurrencies. The court also granted a disclosure order requiring the exchanges to disclose information on the accounts credited with the stolen cryptocurrencies.
Although the Singapore courts recognised cryptocurrency and NFT as property in these landmark cases, both these cases were heard only at the interlocutory stage – a pre-trial request for a court order, usually on procedural matters. Hence, there is a possibility that the courts could take a different view on whether cryptocurrency and NFT can be considered property during the actual hearing itself.
The injunction granted to Mr Rajkumar, a Singaporean, to protect his BAYC No. 2162 NFT is said to be the first in Asia. It is also reportedly the first globally for a purely commercial dispute.
The only cryptocurrency recognised as property in the CLM case was Bitcoin and Ether. In Mr Rajkumar’s case, the only NFT recognised as property was the BAYC NFT. There are so many other cryptocurrencies and NFTs with different features in the market that may not fall within the definition of property rights. For example, this could be a situation where the underlying asset of the NFT no longer exists, or where the NFT is not traded in any market.
What still stands in the way of recovering stolen or lost digital assets?
Due to the nature of trading NFTs, where assets may be traded in an anonymous and unregulated fashion, it may be difficult for most users to recover their stolen NFT assets.
Even though blockchains leave a publicly accessible trail of a user’s transactions, criminals circumvent this by depositing their cryptocurrency from the sale of a stolen NFT to a mixer service. A mixer works by mixing coins with other holders’ coins such that none of them can be connected back to their original wallet addresses. An example is Tornado Cash.
These wrongdoers would then receive tokens from a pool of tokens supplied by all users of the service. Once mixed, it is difficult for a transaction trail to be tracked to identify the perpetrator.
Any enforcement action should ideally be taken against a known perpetrator. In the case brought by Mr Rajkumar, chefpierre was identified as the person to whom the BAYC No. 2162 NFT had been transferred to. Chefpierre was also identified as the user behind the account on Twitter and Discord.
It is on this basis that the Singapore court granted the injunction. It held that the description of the persons unknown were sufficiently certain so as to identify both those who were included and those who were not. Commencing an action against unknown persons challenges its enforceability. It would be difficult to compel an unknown person to return the stolen NFT.
The immutability of the blockchain ledger means that one cannot reverse a blockchain transaction. If fraudsters are able to cover their tracks, it may become impossible to recover the stolen asset.
A “Bankers Trust” order (also known as pre-action discovery) could be granted to compel third parties located abroad to allow scam and fraud victims to obtain information on unknown perpetrators.
However, this is possible if the NFT has been transferred to a custodial wallet with an incorporated entity, which is required by law to prevent money laundering by verifying every wallet holder. If the stolen NFTs reside in non-custodial wallets, it would be impossible to identify the owners.
There is another approach the court could take. In April 2021, a Malaysian court granted a “Spartacus order” against unknown defendants in a cyberfraud case. This requires the persons unknown to identify themselves and provide an address for service. The problem with the Spartacus order is that defendants can choose not to comply with such orders, given that their identities are unknown in the first place.
Furthermore, injunctions must be obtained quickly enough to prevent the stolen NFT from being resold. Given the publicity surrounding Mr Rajkumar’s BAYC NFT, it is going to be difficult for a purchaser to claim he acted in good faith if he were to buy the NFT from chefpierre.
NFT marketplaces are also important in combating crime. OpenSea, for instance, has a policy which prohibits the sale of stolen items. But there are limitations. While a marketplace is able to prevent items from being bought or sold using its service, the items are not in the custody of that marketplace. They remain on the blockchain.
Finally, NFTs are highly speculative investments which do not have a deposit insurance corporation to back them, unlike conventional bank accounts. A deposit insurance corporation preserves and promotes public confidence in the financial system. An example of a deposit insurance corporation is the Singapore Deposit Insurance Corporation, which automatically insures eligible deposits with a member bank for up to $75,000 per depositor.
Given the decentralised nature of NFTs, it may be difficult to find a company willing to insure the NFT. The only plausible solution would be regulatory intervention mandating that digital tokens in wallets held by exchanges are required to be protected by a deposit insurance scheme.