Cryptocurrencies, non-fungible tokens, the metaverse, and Web 3.0. Just a decade ago, these were science fiction. Yet today, these adolescent creations often hog the headlines, underpinning stories of rags to riches – or spectacular falls from grace.

Like the Wild West of the 1800s, the cryptospace remains a world uncharted. Plundering and thievery abound, and sheriffs struggle to enforce the rule of law. “Wanted” posters are plastered on the walls of the public bar, but a huge question mark obscures the faces.

Take, for example, the Squid Game Token (SQUID) creators. Their “sh*tcoin” (a term describing coins and tokens inspired by memes or – as in this case – pop culture, and have otherwise no real-use case) rose by an astronomical 23,000,000 per cent in a week. Just when punters thought they struck lottery, the anonymous creators pulled the rug and absconded with some US$3.3 million. Or the mystery hacker who broke through security of Ronin Network (a sidechain for a gaming service) for what may now be crypto’s largest breach, riding off into the sunset US$625 million richer. These fraudsters’ identities remain unknown.

Other times, even if the public knows exactly who ought to be public enemy number one, the law may just not have the right ammunition to bring that individual to task.

A prime example: the events of May 2022 concerning the Terra ecosystem and its creator Do Kwon. The “stablecoin” TerraUSD (UST) was meant to be pegged 1:1 to the US dollar, but it irrecoverably lost its value. Why this occurred is not entirely clear. Some speculate that this was part of a concerted attack with holders (or one holder?) dumping the coin in large amounts. Others fingered Do Kwon for committing fraud. Whatever the cause, this also led to UST’s sister token Terra (LUNA) crashing spectacularly from around US$86 per coin to less than US$0.00005 per coin in just nine days. And just a month prior, LUNA was one of the top 10 largest cryptocurrencies by market capitalisation. The crash wiped out US$60 billion and caused many to lose their life savings. Yet, criminal charges against Do Kwon are unlikely to stick.

The next fiasco centred on crypto-lender Celsius. The Celsius platform, like many other crypto lenders, offered customers a way to grow their passive cryptoassets. Deposits on the platform purportedly earn promising interest rates of up to 18 per cent. In contrast, one would be lucky to receive 3 per cent per annum from a bank savings account. And Celsius did not seem like a fly-by-night operation either – it was touted as the “Best Cryptocurrency Wallet” of 2021. This May, Celsius was managing around US$11.8 billion in assets. Reliable, one would think.

A month later, Celsius suddenly froze withdrawals. Customer funds were stuck in the platform, seemingly still earning interest. No one knew whether or when customers would be able to make withdrawals. That is, until 17 July when Celsius filed for bankruptcy in the US and declared it has only US$167 million cash on hand. The question that remains is whether – and how – CEO Alex Mashinsky will be held to task, or will he be allowed to get off with a slap on the wrist while his company goes under. (Generally, a company is a separate entity from its CEO.)

Establishing a strong foothold

Yet, like in the Wild West, the law is slowly but surely extending its boundaries and pioneering new territory in the cryptoverse. Blockchain transactions’ anonymity shroud is no longer as impermeable as it once was. Courts worldwide have shown their readiness to grant freezing and disclosure orders in an effort to prevent dissipation of cryptoassets, even where the beneficial owner of the relevant wallets remain unknown.

In an English case, an insurance company paid a US$950,000 Bitcoin (BTC) ransom after malware locked all of its computer systems. The England and Wales High Court granted an interim order against unknown hackers as well as the Bitfinex exchange, preventing the latter from further dealing with the ransomed Bitcoins stored in the hackers’ Bitfinex wallet. The Court also ordered that Bitfinex provide information to identify the hackers, piercing their cloak of anonymity.

The Singapore Courts have responded similarly to the war on crypto theft. A Plaintiff on vacation in Mexico suddenly found himself 109.83 BTC and 1497.54 Ethereum (ETH) short, cryptocurrencies worth around US$5.7 million at the time of the theft. He suspected that someone had accessed his recovery seed phrases from the apartment safe. (Remarkably, he thought it wise to have read out the safe’s combination within the earshot of others.)

The High Court this March passed Singapore’s first ever “persons unknown” order, prohibiting the unidentified thief from dealing with the stolen assets, and requiring wallet providers to disclose information that may establish the wrongdoer.

Such orders (or injunctions) coupled with disclosure orders are becoming more prevalent. Sometimes, a “Spartacus” order could also be granted – with examples from the English and Kuala Lumpur High Courts – compelling wrongdoers to identify themselves. While such orders may appear superfluous, they act as deterrents: wrongdoers may eventually be outed, and third parties who know their identities and abet non-compliance with the order could find themselves in contempt of court.

The fog remains

There is, however, still much for the law to do. Cryptocurrencies’ nature is not entirely settled. This becomes relevant when determining compensation when someone has lost cryptocurrency. If it is considered currency, then he should be compensated in cryptocurrency; if considered property, then in fiat currency.

Most Courts seem to accept that some cryptocurrencies are property, like those in England and New Zealand. Commentators consider it a type of property of its own kind, with some characteristics of property but not others. No doubt this will find further expression in case law as disputes inevitably arise. Here in Singapore the question isn’t entirely settled, though what is clear is that there is a sufficiently arguable case that BTC is property for proprietary injunctions to be granted.

But how about stablecoins? Notwithstanding the dramatic fall of UST, once the third largest stablecoin, the UK continues to advance regulations that would recognise stablecoins as a form of payment. Does the world then intend to draw a line between two types of cryptocurrencies, with some stablecoins functioning as currency and the rest falling into the category of property? What then are the requirements for a cryptocurrency to be considered “stable”?

And if so, what would be the appropriate relief where a hacker has stolen stablecoins and has converted them into other cryptocurrency, just before the stablecoin implodes, like UST? Is the hacker only liable to repay a hundredth of a cent on the dollar (if stablecoins are currency) or should the hacker be made to restore the claimant the value lost at the time of the theft (if stablecoins are property)?

Over and above this, the practical question of how far the breadcrumb trail can be traced remains, especially if the hacker has already broken up the stolen assets into multiple fragments and performed multiple trades. Or even worse, if the hacker proves savvy enough (as most hackers are) to cover their tracks and run the stolen assets through a cryptocurrency tumbler or mixer, washing the stolen cryptocurrencies together with others.

And if cryptocurrency is property, it should then in theory be possible to argue that crypto lenders such as Celsius (and also recently the similarly troubled Babel Finance) hold assets on trust for its customers, such that they should not be able to unilaterally suspend customer withdrawals indefinitely. But the Courts do not speak with one voice on this issue – the New Zealand Court held that the Cryptopia exchange held cryptoassets on trust for its customers. Yet the Singapore Court in one case reached the opposite conclusion, albeit on different facts. It appears more likely than not though that just as traditional banks ordinarily do not hold monies on trust for its customers (and what the customer has is an enforceable debt against the bank, or a “chose in action”), crypto lenders would not ordinarily hold assets on trust.

What could Courts do if investors commence proceedings against the unknown SQUID creators, or LUNA/UST creator Do Kwon? Whether these will be regarded as cases of caveat emptor (“buyer beware”), or fraud or misrepresentation, also remains to be seen. Arguably, this is an area that requires informed regulation, akin to traditional stock exchanges, but the difficulty will be balancing innovation with protection. If it becomes extraordinarily difficult to list cryptoassets for sale, digital asset creators could “forum shop” for the most accommodating jurisdiction that would allow them to launch their creation. It also opens up a can of worms as to what sort of digital assets should be regulated – should regulation extend to NFTs, especially fractional NFTs (parts of an NFT) which could very well constitute securities under the US’s Howey Test that is used to determine whether something is a security? What about other digital assets like Dota 2 or CSGO skins, which perhaps are not that different from NFTs?

Braving new fronts

These are only some of the new legal issues arising as a result of the rise (and fall) of cryptos. Many questions remain, like whether the traditional legal test for determining which country is a convenient (or non-convenient) forum to bring legal action in has any utility in transactions done completely on the non-jurisdictional blockchain.

The task then falls to lawyers, lawmakers and judicial officers to chart the path ahead. Make no mistake however, the law is evolving to catch up with what commercial actors do. In the first of its kind, the New York Supreme Court has even allowed service of court process on hackers through NFT drops, and the UK Courts have quickly followed suit this month. Through informed regulation, creative court orders, and trailblazing counsel, it is only a matter of time before the rule of law reins in the wild world of crypto.