England and Wales High Court (Chancery Division) Decisions

IN THE HIGH COURT OF JUSTICE
BUSINESS AND PROPERTY COURTS OF ENGLAND AND WALES
BUSINESS LIST (ChD)

		Rolls Building Fetter Lane London EC4A 1NL
		12 September 2024

Richard Farnhill (sitting as a Deputy High Court Judge of the Chancery Division):


 


1. In these proceedings the Claimant, Mr D'Aloia, alleges that he is the victim of a cryptocurrency scam. His claim against the Second Defendant (Binance) has settled and his claim against the Fifth Defendant (Aux Cayes Fintech) was struck out. He has issued a separate application seeking summary judgment against the First Defendants, the Third Defendant (Polo), the Fourth Defendant (Gate) and the Seventh Defendants. The trial before me principally concerned the issues between Mr D'Aloia and the Sixth Defendant (Bitkub).
2. Broadly, Mr D'Aloia alleges that a fraud was perpetrated on him by the First Defendants in which he was induced to hand over cryptocurrency in the form of Circle (which is not relevant for this trial) and Tether (USDT) totalling around £2.5m. The First Defendants then passed that cryptocurrency through a number of blockchain wallets before it was withdrawn as fiat currency by the Seventh Defendants. Polo, Gate and Bitkub (the Exchange Defendants) were the cryptocurrency exchanges with whom the Seventh Defendants are said to have held their various accounts.

The issues

3. The parties summarised the issues for determination before me by way of an updated List of Issues. This is a lengthy and, perhaps inevitably, rather technical judgment. Parties quite legitimately are generally more concerned about the end destination than the legal route. I therefore start with a brief summary of the issues and my findings.

What is the pleaded basis for Bitkub's alleged liability to the Claimant?

4. The pleading issue comprised a number of sub-issues:

i) What is the pleaded basis for the Claimant's allegation that he can identify his "Identifiable Cryptocurrency" and his related contention that his "Identifiable Cryptocurrency" is comprised within the USDT 400,000 that was transferred to the 82e6 Wallet held with Bitkub on 21 February 2022? For the avoidance of doubt, this sub-issue turns on the pleading point: whether the Claimant pleaded that he has relied upon following or tracing. The statements of case adequately plead a claim premised on tracing USDT to the 82e6 wallet. There is, of course, a separate question of whether the alleged flow of assets is adequately evidenced.

ii) What is the pleaded basis for the Claimant's allegation that Bitkub holds the Claimant's "Identifiable Cryptocurrency" on constructive trust and that Bitkub is liable to the Claimant as a constructive trustee? Paragraph 30 of the Re-Amended Reply asserts, in terms, a constructive trust imposed on Bitkub. Paragraphs 40-41 of the Re-Amended Particulars of Claim and paragraph 37 of the Re-Amended Reply set out the basis (and, for the avoidance of doubt, the only basis) on which that constructive trust is said to arise: that the assets were subject to a constructive trust imposed on the First and Seventh Defendants by virtue of their fraud and as a consequence the Sixth Defendant could not acquire the beneficial title, alternatively it held the assets on constructive trust.

iii) What are the matters on which the Claimant's allegation that Bitkub "did not act in a commercially acceptable way" can be permissibly advanced with reference to the Claimant's pleadings? The allegation goes to, and only goes to, the defences of good faith purchase for value without notice, change of position and ministerial receipt (paragraphs 17, 23 and 28(j) of the Re-Amended Reply).

iv) What are the matters on which the Claimant's allegation that Bitkub "unconscionably received" the Claimant's "Identifiable Cryptocurrency" can be permissibly advanced with reference to the Claimant's pleading? The Claimant can refer to the matters pleaded as regards KYC, albeit there is no expert evidence against which to assess them. He can also refer to the systems and controls of Bitkub and Bitkub's application of them in the present case. The unconscionable receipt claim is an aspect of the constructive trust claim set out at (ii), above.

USDT as property

5. Whether the Claimant and Bitkub are correct in acknowledging that the stablecoin, USDT, that forms the subject matter of the Claimant's claim against Bitkub, is considered property under the law of England and Wales and if so, what is the nature of the property in question and what is the effect of the same on the Claimant's claim? USDT attract property rights under English law. It is neither a chose in action nor a chose in possession, but rather a distinct form of property not premised on an underlying legal right. It can be the subject of tracing and can constitute trust property in the same way as other property.

Expert evidence

6. Whether the Claimant can establish, as a matter of fact, with reference to expert blockchain analysis, that his "Identifiable Cryptocurrency" reached the 82e6 wallet for which the Bitkub holds the private key. The Claimant has failed to show that any of his funds were received in the 82e6 wallet.

Following / Tracing

7. Whether the Claimant can establish, as a matter of law, that USDT 46,291 of his allegedly "Identifiable Cryptocurrency" reached the 82e6 wallet, for which Bitkub holds the private key by reference to the principles of following or, if pleaded, tracing. Specifically, which methods were legally open to the Claimant to follow/trace the allegedly "Identifiable Cryptocurrency" to the 82e6 wallet. This issue raises a number of sub-issues:

i) Is tracing at common law possible through a mixed fund? In my view it is not. As such, tracing is only available to the Claimant in respect of his equitable claims, where tracing through a mixed fund is possible.

ii) Was it possible to follow the USDT to the 82e6 wallet? This was expressly part of the agreed issue, although I was not addressed in any detail on it. To my mind it turns on two linked issues. The first is whether in principle the property interest in USDT is, for these purposes, more akin to a chose in action or a chose in possession. If it is to be equated to a chose in action the correct analysis seems to me to be that it cannot be followed because once it passed through a mixed fund it ceased to be identifiable. If it can be equated to a chose in possession, it could, in principle, be followed provided it remained identifiable. That leads to the second question: can USDT in fact be followed through a mixture? Mr Moore's evidence, in passing, suggested that Tether Ltd (the organisation that administers USDT) itself had the records necessary to carry out that exercise. Tether Ltd's own documentation supports that. However, even assuming that was correct there was no evidence before me to suggest that any form of following based on those records had been attempted in this case. Accordingly, on the basis of that limited evidence, I conclude that at law USDT could have been followed but Mr D'Aloia's USDT in this case was not successfully followed as a matter of fact.

iii) Are the first in first out (FIFO), pari passu distribution and rolling charge methods described in Charity Commission for England and Wales v Framjee [2014] EWHC 2507 (Ch) the only approaches open to a party as a matter of law? In my view the law is not so limited and other methods, if methodologically sound and properly evidenced, are available to a party seeking to trace assets, at least in the context of claims arising out of fraud.

Unjust enrichment

8. Has Bitkub been "enriched/received a benefit by obtaining possession and/or control" of the relevant portion of the "Identifiable Cryptocurrency" that was allegedly comprised within the USDT 400,000 which entered the 82e6 Wallet on 21 February 2022? The receipt of the USDT 400,000 was a benefit to / enrichment of Bitkub. However, the Claimant has failed to show that any portion of his funds entered the 82e6 wallet, so the enrichment was not at the Claimant's expense.
9. Whether the Claimant can establish the alleged enrichment of Bitkub is unjust on the basis that the Claimant "has been deprived of possession and enjoyment of his USDT and USDC, and at the expense of his legal title" as asserted in paragraph 37(iv) of the Re-Amended Particulars of Claim. This does not seem to have been pursued as an unjust factor. Rather, the Claimant relies on unauthorised payment and money paid under a mistake, both of which are recognised unjust factors and both of which are adequately pleaded (and, for the avoidance of doubt, have been established on the facts).
10. If so, whether Bitkub's enrichment has been at the expense of the Claimant. See above: the Claimant has failed to show that any of his funds reached the 82e6 wallet, so cannot show that Bitkub was enriched at his expense.
11. Whether Bitkub acted in a commercially unacceptable way with regards to its provision of User Accounts to the Seventh Defendants / Ms Hlangpan (the account holder of the 82e6 wallet). This is not a pleaded allegation said to found any claim but is relevant for the purposes of certain defences advanced by Bitkub. No evidence was advanced in respect of the Seventh Defendants other than Ms Hlangpan ever having Bitkub accounts, so this issue appears limited to Ms Hlangpan. Bitkub did not act in a commercially unacceptable way in providing her a User Account.
12. Did Bitkub have constructive knowledge and/or actual notice of the Claimant's beneficial interest in the Identifiable Cryptocurrency? Bitkub had actual notice of suspicious account activity on Ms Hlangpan's account, such that it could not proceed to pay away sums it received and avail itself of the relevant defences without further inquiry.
13. Did Bitkub fail to comply with its KYC/AML and corporate governance duties? The concept of failure to comply with a duty is, necessarily, by reference to a particular standard. No proper evidence was advanced as to what those standards were under Thai law at the relevant time. Accordingly, neither party has established compliance / non-compliance with Thai law or practice. Bitkub was on notice of suspicious account activity, however, and failed or failed properly to investigate it, such that it cannot rely on defences premised on good faith.
14. Did Bitkub fail to:

i) Evaluate the Seventh Defendants' / Ms Hlangpan's AML/KYC risk? To be clear, there is no suggestion that Bitkub had any obligation to consider AML or KYC in respect of parties other than its customers; the only such customer relevant to this trial was Ms Hlangpan. That is the case for each of these sub-issues. Again, there was no proper evidence of Thai law or practice, so neither party has established compliance / non-compliance with it. However, the evidence does show that Bitkub had policies in place to police suspicious account activity, that those policies were linked to AML concerns, that those policies were repeatedly breached by Ms Hlangpan and that she was repeatedly permitted, by Bitkub, to do so. In that sense, Bitkub was on notice of a money laundering risk and failed to take steps in response.

ii) Monitor the Seventh Defendants' / Ms Hlangpan's customer account for AML/KYC risk purposes? This is another aspect of the previous point. Compliance / non-compliance with Thai law has not been shown by either party; on the facts there was suspicious account activity and Bitkub did not take steps to address those concerns.

iii) Impose the appropriate account withdrawal limit to the Seventh Defendants' / Ms Hlangpan's User Account in accordance with its AML/KYC and corporate governance duties? Bitkub failed to impose its own limits for withdrawals in respect of Ms Hlangpan. On the balance of probabilities, the purpose of those limits was connected to concerns over money laundering; there is no reason to think it was connected to KYC since KYC would typically be conducted before an account became active.

iv) Move the Seventh Defendants / Ms Hlangpan from level 1 to level 2? This would have required an application from Ms Hlangpan and no such application was made. Accordingly, this was not a failure on Bitkub's part.

15. Is Bitkub entitled to rely on the defence of ministerial receipt? No; Bitkub was aware of Ms Hlangpan's breaches of withdrawal limits in circumstances where there was a risk of money laundering, such that it had notice that the funds could not properly be released to her without further inquiry. No or alternatively no adequate inquiry was made.
16. Is Bitkub entitled to rely on the defence of change of position. For the same reasons, no.
17. Is counter restitution impossible? No.

Constructive trust issues

18. Whether the Claimant is able to identify a distinct equitable title and certainty of subject matter in the "Identifiable Cryptocurrency" that is alleged to be comprised within the USDT 400,000 that was transferred to the 82e6 Wallet on 21 February 2022. No, on the basis that the Claimant has not established that the 82e6 wallet received any part of his funds.
19. What is the basis, if any, for the imposition of a constructive trust on Bitkub in these circumstances? I accept that the contract with td-finan (defined below) was nothing more than a fraud and of no effect. On the basis of Martin J Halley v The Law Society [2003] EWCA Civ 97 that gave rise to a constructive trust as against the First Defendants under the principle set out in Westdeutsche Landesbank Girozentrale v Islington Borough Council [1996] AC 669. If that is wrong, in principle the rescission of the agreement with td-finan could have given rise to a constructive trust, again as against the First Defendants, from the date of rescission (Bristol & West Building Society v Mothew [1998] Ch 1). The imposition of such a trust would be prospective from the date of rescission, which was the date of service of proceedings on the First Defendants, although the right to rescind would, in itself, support tracing retrospectively. No such trust was alleged by the Claimant in any of the statements of case, however. No constructive trust arises directly against Bitkub.
20. Whether it was unconscionable for Bitkub to receive and/or continue to hold the 'Identifiable Cryptocurrency' and thereby deny the Claimant's interest in it. This seems to be a claim premised on knowing receipt. No such claim is pleaded and it was further confirmed, in the course of trial, that no such claim is advanced.
21. If a constructive trust may be imposed on Bitkub pursuant to the rescission of a voidable transaction on the grounds of fraudulent misrepresentation, when has recission occurred, or will occur, and what is the consequence of the date of rescission for the Claimant's constructive trust claim against Bitkub? Such a trust can arise and takes effect prospectively from the date of rescission. Rescission can be achieved by bringing proceedings against the contractual counterparty. Since the rescission must be communicated to the counterparty, typically it will be effective on service of the claim form. The constructive trust would arise against the First Defendants, not Bitkub. In principle, such a trust could found a claim against parties that receive the trust property and are not bona fide purchasers for value without notice. However: (i) the claimant has not shown that Bitkub received any of his funds; (ii) it appears that the funds received have been paid away, such that there is nothing against which the proprietary claim can be asserted; and (iii) no claim in knowing receipt is pleaded.
22. Whether the defence of bona fide purchaser for value without notice is recognised in the context of the transfer of crypto assets? Yes, at least in respect of USDT.
23. If the defence of bona fide purchaser for value without notice is available in the context of the transfer of crypto assets, what is the appropriate standard of notice that applies? In circumstances where the evidence before me demonstrates that Bitkub was aware of the risk of money laundering, permitted the transactions to go ahead and has offered no explanation or evidence as to why it felt able to do so, Bitkub had sufficient knowledge to constitute actual notice. Accordingly, this specific issue does not arise for determination.
24. Whether Bitkub can establish the defence of bona fide purchaser for value without notice. No.
25. Whether Bitkub can be fairly excused from any breach of duty as a trustee on the basis that it acted honestly and reasonably. The question does not arise. In permitting Ms Hlangpan to pay away funds despite (i) receipt of those funds being considered suspicious; and (ii) her repeated breaches of withdrawal limits, Bitkub did not act reasonably. However, in the absence of a constructive trust being imposed on Bitkub there is no breach of duty in the first place.

The case as pleaded and the case as advanced at trial

26. This was a legally complex case. It was made more complicated because the claim that Mr D'Aloia sought to advance before me was not, in key respects, that pleaded in the Re-Amended Particulars of Claim and the Re-Amended Reply. Several of the issues that I have to decide are therefore pleading issues.
27. I emphasise at the outset that responsibility for the pleaded case does not rest with Mr Bergin KC or Mr De Azevedo. They did not settle the original pleadings and the scope they had to amend was ultimately limited.
28. Mr Connell advanced a number of arguments for requiring the Claimant to stay strictly within the four corners of his pleaded case. He stressed the requirements of PD 16 paragraph 8.2, which requires that details of all breaches of trust and notice or knowledge of any fact must be specifically pleaded. He submitted, and I accept, that in order to plead a breach of trust one must first plead what the trust is said to be.
29. He also referred me to the requirements of the Chancery Guide at paragraph 4.7, which sets out the purpose of the statements of case as being:

i) To enable the other side to know the case it has to meet.

ii) To ensure the parties can properly prepare for trial.

iii) It serves as a "critical audit" for both sides to ensure they are advancing a complete cause of action or defence.

30. Finally, Mr Connell took me through a number of authorities supporting the importance of the statements of case. I note in particular the observation of Mummery LJ in Boake Allen Ltd v HMRC [2006] EWCA Civ 25 at [131]:

While it is good sense not to be pernickety about pleadings, the basic requirement that material facts should be pleaded is there for a good reason – so that the other side can respond to the pleaded case by way of admission or denial of facts, thereby defining the issues for decision for the benefit of the parties and the court. Proper pleading of the material facts is essential for the orderly progress of the case and for its sound determination. The definition of the issues has an impact on such important matters as the disclosure of relevant documents and the relevant oral evidence to be adduced at trial.

31. Mr Bergin submitted that this was a case where Bitkub was taking purely technical points. It knew, and had always known, the case that it had to meet. That was what mattered. The Court of Appeal has repeatedly stressed balance to be struck between fairness and certainty on the one hand and undue technicality on the other (UK Learning Academy v Secretary of State for Education [2020] EWCA Civ 370 per David Richards LJ, as he then was, at [47]; Dhillon v Barclays Bank plc [2020] EWCA Civ 619 per Coulson LJ at [19]; Satyam Enterprises Ltd v Burton [2021] EWCA Civ 287 per Nugee LJ at [35]).
32. While there should not be formalism for the sake of it, the statements of case are fundamental to the trial. In the context of this case the statements of case were particularly important to the question of expert evidence. The Claimant now seeks to advance a positive case premised on Bitkub's alleged failure to act in a commercially reasonable manner in the way it permitted Ms Hlangpan to operate her account. The Claimant applied to adduce expert evidence on compliance and AML, which application Bitkub opposed in part on the basis that no issue between the parties required expert evidence in the field of "Compliance and AML". Permission was refused by Master Pester in February this year. Had a positive claim been pleaded premised on breaches of Thai law on KYC/AML, Bitkub may well have taken a different decision in that regard.
33. The position is compounded because there has already been an application to amend, which was rejected by Bacon J in a judgment given on 13 February 2024. Permission to appeal that judgment was sought from the Court of Appeal and refused. If I were to allow a case to be advanced that reflected those amendments, I would be allowing a collateral attack on Bacon J's judgment. Plainly, that is unacceptable.
34. Mr Bergin is a skilled advocate; in various ways he stretched the statements of case to their limit. In assessing where that limit was I had in mind the need not to be "pernickety" (Boake Allen Ltd) nor to allow "technical points [to] be used to prevent the just disposal of a case" (UK Learning Academy). In many cases I accepted that Mr Bergin was entitled to take the points that he did; where he went too far, however, that was itself a proper ground on which Bitkub could resist Mr D'Aloia's claim.
35. There was a further aspect to the pleading question that was less prominent but, to my mind, of equal importance. In its Re-Amended Defence Bitkub advanced defences of good faith change of position, bona fide purchase and ministerial receipt. It did so on the basis that Bitkub "was at all material times wholly ignorant of any facts alleged to affect its conscience" (Re-Amended Defence paragraph 7.6) "acted in good faith at all material times" (paragraph 8.6) and "relies on the defence of ministerial receipt" (paragraph 8.7).
36. In closing, Mr Connell advanced further points, to the effect that if Bitkub was aware of any suspicious account activity it might have been due to its unusual diligence, or transactions may have gone ahead because of a system malfunction or there might have been an investigation into any suspicious activity that concluded satisfactorily. None of those were pleaded.
37. Mr Bergin took no pleading point in respect of this, perhaps for understandable reasons. A party is entitled to decide that it does not object to its opponent departing from its pleaded case, and in those circumstances the court will not typically require amendment (Loveridge v Healey [2004] EWCA Civ 173 at [23]). However, the fact that Mr Bergin did not raise these points in respect of the statements of case did not, in any way, limit the attack he was entitled to advance on the ground that the submissions were unevidenced.

The witnesses

38. Mr D'Aloia is the Claimant in this case. He gave evidence as to the circumstances around his transfer of USDT to td-finan, the proceeds of which he now seeks to recover. He was an honest witness whose evidence was not seriously challenged and I accept it.
39. Mr Dhanasarnsilp is a Director of Risk Management and Investigations at Bitkub. He gave his evidence by videolink and through a translator. The quality of the link throughout his evidence was good and I felt I had a good impression of him as a witness. I found him to be honest and straightforward and clearly attempting to assist the court. Again, I had no reservations in accepting the evidence he was able to give.
40. The only issue with Mr Dhanasarnsilp's evidence was that he was not involved in events at the time. He had relevant firsthand knowledge of the Bitkub platform and how it operates but was not involved in the transactions that occurred on 21-24 February 2022 that form the core of this case. Through no fault of his, that limited the assistance his evidence could offer.
41. Miss Vijitpinyo is an Assistant KYC Manager at Bitkub. She explained in her witness statement that this is a "senior manager role at Bitkub". Again, she gave her evidence via videolink and through a translator but again the quality of the link was good throughout. She, like Mr Dhanasarnsilp, had had no involvement with the transactions in question prior to proceedings being commenced.
42. She was very cautious in her answers, to the extent that Mr Bergin directly put it to her that she was being evasive. With one significant exception I do not accept that. The fact is that she had little directly relevant evidence to give other than as to Bitkub's processes; it was unsurprising to me that she frequently ended up referring back to them. Moreover, at one point she was being questioned about an unofficial English translation of a Thai law being translated back to Thai for her by the court interpreter. Miss Vijitpinyo is not a lawyer, but even a lawyer would have struggled with those questions in the circumstances. I would characterise her evidence generally as careful rather than evasive, but the end result was the same; I accept Mr Bergin's submission that her evidence was of only limited assistance.
43. The exception was a question that was put to her as to the purpose of daily withdrawal limits on customer accounts. Mr Bergin put it to Miss Vijitpinyo that the limits were in place to reduce the risk of money laundering. She said she did not know why such limits were in place. Frankly, I did not believe that answer.
44. In my view, someone in Miss Vijitpinyo's position, a position she described in her witness statement as a "senior role" in the KYC function, ought to have known the purpose of daily limits. Moreover, I think she did know. Miss Vijitpinyo's evidence was that she was "very familiar" with the different customer levels within Bitkub and the need for enhanced KYC if a customer wanted higher withdrawal limits. She addressed the way that Bitkub's systems generated risk scores, and the way that the due diligence process can take longer for customers considered high risk. Miss Vijitpinyo explained in her statement that she could not disclose details of the processes undertaken for those customers because of concerns that doing so might violate the Thai Anti-Money Laundering Act, directly linking higher daily withdrawal limits with the need for enhanced KYC and an increased risk of money laundering. That was precisely the connection that Mr Bergin put to her. She further explained in her statement that KYC was conducted by employees involved in Bitkub's Anti-Money Laundering or Counter Terrorism or Proliferation of Weapons of Mass Destruction Financing Policy. She was, as I have noted, in a senior role in that team; as she acknowledged in her statement, she therefore needed to have an understanding of Bitkub's AML/CFT policies.
45. The only realistic conclusion, it seems to me, is that Mr Bergin was right, that the daily withdrawal limits were driven by Bitkub's AML policies and that Miss Vijitpinyo was uncomfortable acknowledging the position.
46. I had no witness evidence from Bitkub from anyone involved at the time of the relevant transactions. Specifically, I was told that a block would have been placed on Ms Hlangpan's account immediately before the receipt of funds said to include those of Mr D'Aloia. That block was in place because she breached her daily withdrawal limits, and as such was there to address the risk of money laundering. Neither of Bitkub's witnesses could explain how or why that block was removed. That gap in the evidence was, so far as I could ascertain, Bitkub's choice and is relevant to some of the findings I have to make.
47. The experts, Mr Moore and Mr Pinto, both have extensive intelligence experience, Mr Moore in the armed services and Mr Pinto in the police. Both are now private investigators specialising in blockchain analytics.
48. I regret to say that I found the evidence of both experts, particularly their reports, not to be especially helpful. That is especially problematic in a case such as this, where much turns on their work to understand the flow of funds, if any, from Mr D'Aloia to the 82e6 wallet.
49. That alleged flow occurred over a series of 14 transactions, or Hops, on the blockchain. The blockchain creates an immutable, publicly accessible record of transactions, yet even reconciling what the experts thought the 14 Hops involved in the form set out at paragraph 80 of this judgment was far from straightforward. It seems that, at least in parts of his evidence, Mr Moore had the payment out of wallet 1dDA as Hop 1, whereas Mr Pinto had treated the first payment into 1dDA as Hop 1. Mr Moore gained a Hop at the end by including the sweep into the Bitkub hot wallet, which I will go on to describe.
50. Mr Moore has been subject to criticism by Bitkub for inaccuracies in his reports, which in part was fair for reasons I address later in this judgment. But it was equally the case that reconciling the times of different transactions within Mr Pinto's report was difficult, if not impossible, since what seem to be the same Hops are described with different time stamps in different tables. Equally, wallet addresses in places appeared to be incorrect and in one case (Hop 12), Mr Pinto identified two different transactions as the same Hop. Payments in the table analysing the Hop 1 transaction are described as "Inbound (non-claimant)" yet appear to come from Mr D'Aloia's Coinbase account. Finally, Mr Pinto used the term Hop to describe both the movement of funds and the origin or destination of those funds. For example, he described Hop 2 simply as "Hop 2", but the next transaction as "Hop 2 to Hop 3 transaction". It would have been clearer had he been consistent.
51. I was also concerned that there was so little attempt to find common ground on the issues, when in fact it transpired that there were numerous areas on which the experts agreed. This was most evident in what was described as the joint statement from Mr Moore and Mr Pinto. In fact, it was nothing of the sort. Mr Pinto made certain assertions; Mr Moore responded. Yet when I asked Mr Moore whether he agreed with certain limited aspects of Mr Pinto's portion of the statement he confirmed that he did. I am sure that the reverse would equally have been true. It should not have required a question from me to ascertain that.
52. In closing Mr Bergin submitted that Bitkub had not put its case squarely to Mr Moore. Specifically, while it was put to Mr Moore that his methodology was not FIFO, it was not put to him that the methodology he used was inaccurate or unreliable. Accordingly, he was not given the opportunity to explain why he considered that his results and conclusions were reliable and accurate. In the Claimant's written closing it was argued that it was not open to Bitkub to challenge Mr Moore's methodology; in oral closing Mr Bergin accepted that it was open to Bitkub to make that submission, but cautioned that it was a factor I needed to take into account in considering Mr Moore's evidence. He referred me to Markem Corp v Zipher Ltd [2005] EWCA Civ 267 and BPY v MXV [2023] EWHC 82 (Comm).
53. Mr Bergin further noted that Mr Pinto had not offered any alternative analysis; indeed, he undertook no tracing analysis at all. Accordingly, he submitted, there was no evidence before me that formed a basis to challenge Mr Moore's conclusions.
54. Mr Connell, in closing, rejected the criticism and took me through the sections of Mr Moore's cross-examination where Bitkub's case had been put to him.
55. The law on this issue was recently summarised by Butcher J in BPY at paragraph [34]:

(1) The fundamental issue is one of fairness to witnesses and to the parties.

(2) Usually fairness will require that when a witness gives evidence as to a specific factual matter and the court will be asked to disbelieve him or her, he or she should be challenged on it so as to have an opportunity of affirming or commenting on the challenge.

(3) But this is not an inflexible rule. There may be cases in which there will be no unfairness because, looked at more generally, the procedures adopted in the litigation mean that a party and the relevant witness(es) have had ample opportunity to comment on the other side's case. It may also be the case that a particular matter does not have to be specifically put to the witness because it is obvious from other evidence which he or she has given as to what his or her response will be. Furthermore, the extent to which there needs to be cross-examination may depend on the procedures which have been adopted by the court (for example in setting time limits for cross-examination).

56. I also had in mind the guidance given in Chen v Ng [2017] UKPC 27 at [52]-[57].
57. I accept Mr Bergin's point that Mr Pinto's analysis was limited and essentially negative – he sought to show that Mr Moore had not used the FIFO methodology. I also accept that Mr Moore's cross-examination was fluid and at times jumped from topic to topic. It was not always easy to follow. Finally, Mr Bergin rightly noted that no time limits were imposed on Mr Moore's cross-examination.
58. Set against that Mr Moore's evidence was advanced in a way that was chaotic and, ultimately, contradictory. For reasons that I come on to address, Mr Moore's report purported to rely on, and only on, FIFO. There was some argument by the Claimant that Mr Moore had not used "strict FIFO" but had instead used "customer FIFO". That simply added to the confusion. In using the term FIFO in this judgment I refer to the rule in Clayton's Case – a strict application of the approach whereby the first amounts paid into an account are deemed to be the first amounts paid out. That is also what Mr Moore stated, in terms, his understanding of FIFO to be in his report prepared for use at trial (the Arrowsgate Report) and the justification he offered for his approach related to FIFO, not some other methodology.
59. In fact, it was apparent that Mr Moore was not using FIFO from a relatively early stage, indeed from before the date of the Arrowsgate Report. By the time of what is described as the experts' joint statement, on 6 March 2024, Mr Moore's stated position was that FIFO was not workable, or at least would be "incredibly time-consuming and difficult to complete accurately". He explained at paragraph 2.6 of that statement that the methodology he used was taught by Crystal Blockchain and TRM Labs, the software that he employs. As I will address when considering Mr Moore's evidence, those systems produced quite different results, as Mr Moore acknowledged during his cross-examination, and so presumably employ different methodologies and approaches. Nowhere in the joint statement did Mr Moore set out those methodologies, or indeed his own to the extent it is different. Nothing was exhibited evidencing the Crystal Blockchain or TRM Labs methodologies, potentially in breach of PD 35 paragraph 3.2(2).
60. Details of what that methodology was said to be were only set out in correspondence from Giambrone & Partners on 31 May 2024, less than a week before trial started. Remarkably, no attempt was made to serve a supplemental report from Mr Moore correcting the methodology section of the Arrowsgate Report. Again, nothing was provided from Crystal Blockchain supporting the assertion that Giambrone & Partners had accurately summarised the methodology. The Claimant's expert case at the start of trial was, therefore, that Mr Moore had used FIFO (which remained the position in the Arrowsgate Report), had not used FIFO (which was obvious from his answers to questions asked by Binance and by Bitkub), and that FIFO was not practically workable in this case (the experts' statement). The Claimant's position in correspondence was a new methodology set out in Giambrone & Partners' letter. That methodology was inconsistent not just with FIFO but with the earlier iterations of Mr Moore's methodology.
61. One of the factors to which I must give considerable weight in considering whether Bitkub's case was properly put to Mr Moore is procedural fairness to the Claimant; it seems to me that this sequence of events is relevant to that question. By the time of trial it was simply not clear what Mr Moore's methodology was said to be and there was no evidence showing what he claimed was the basis for this approach. In the circumstances, it was unsurprising that the challenge to Mr Moore's approach was put in general terms.
62. That can be seen in his cross-examination. The position set out in Giambrone & Partners' letter was adopted by Mr Moore during his cross-examination. After some back and forth over an example, there followed a challenge to that methodology:

Q. And what you have said in response to the defendant's question was the figure that you're following for the claimant's identifiable cryptocurrency needed to be reduced from 65,022 by 18,700-odd to get a figure of 46,291; correct?

A. Yes.

Q. There is no conceptual coherence, I am suggesting to you, or principled basis upon which that deduction comes from the claimant's identifiable cryptocurrency, or perhaps explain to me why that deduction needs to be made from the claimant's 65,022.

A. As an overarching aim, I'm trying to find as many avenues as I can to unmask – again, the initial mission is to identify who these people are.

Q. On the identifying as many angles as I can, I am going to suggest to you that when you approach your task as a blockchain tracing expert, in following down false leads, you are not properly carrying out your task in providing a very clear, impartial view on what happens in a blockchain in terms of the transactions.

A. Sorry, what do you mean by false leads?

Q. So you say you will follow down different avenues of inquiry and I am suggesting to you that those different avenues of enquiry lead you down false roads of enquiry because you are not following a principled blockchain analysis.

A. I think you are taking out of context here what these addresses here. This is purely one giant washing machine. These are not legitimate addresses that are moving these funds.

63. Mr Moore then clarified that he was not referring to the crypto-industry as a whole as a "giant washing machine" and his evidence moved on to other issues.
64. The cross-examination came back to his methodology towards the end:

Q. If we turn over the page you provided a graphical representation of the flow of funds I think in relation to this. And, as I say, we do not accept that you correctly applied any proper methodology to end up at the 82e6 wallet. It is our position, Mr Moore.

A. Okay, I understand your position.

65. It therefore seems to me that at least the following were put directly to Mr Moore:

i) He had changed his methodology from FIFO to something else.

ii) His new basis was not principled and lacked conceptual coherence.

iii) He was invited to explain how his methodology applied to a specific example.

iv) His objective was not tracing or following as such but the uncovering of potential perpetrators of the fraud.

v) He had pursued false avenues.

66. In the circumstances I accept that it is open to Bitkub to submit that Mr Moore's methodology was incorrect and lacked a principled basis. It is also open to Bitkub to submit that the number arrived at was wrong because Mr Moore had followed false leads, which I take to include tracing the money into the wrong account. It can challenge Mr Moore's application of the methodology to the figures.
67. Moreover, as I go on to address, there are serious difficulties in applying Mr Moore's methodologies to the flows of USDT in this case, simply as a matter of mathematics. In my view, even where those were not directly put to Mr Moore in cross-examination it is also open to me to identify where, numerically, the figures do not add up. I say that for two reasons. First, when Mr Moore was asked to justify his figures he instead answered by reference to his mission to identify those responsible for the fraud. Secondly, it is hard to see what alternative answer he could have given when the question is purely or largely numerical.

Cryptocurrency and the operation of the Bitkub exchange

68. This claim is not about cryptoassets in general but, specifically, about cryptocurrency and, more specifically still, USDT, a stablecoin tied to the value of the US dollar.
69. The original cryptocurrency was Bitcoin. In proposing the idea in "Bitcoin: A Peer to Peer Electronic Cash System" (the Bitcoin White Paper), Satoshi Nakomoto observed (my emphasis):

What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party. Transactions that are computationally impractical to reverse would protect sellers from fraud, and routine escrow mechanisms could easily be implemented to protect buyers. In this paper, we propose a solution to the double-spending problem using a peer-to-peer distributed timestamp server to generate computational proof of the chronological order of transactions. The system is secure as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes.

70. Much of the paper then addresses the problem of double payment, which Bitcoin was designed to solve, and the integrity of the system against attack. So far as is relevant for this judgment, what is striking about the Bitcoin White Paper is that Bitcoin was never based merely on trust, it was based on cryptographic proof. The idea was that with sufficient computational power Bitcoin would be secure without the need for legal rights. One of the issues raised with cryptocurrencies being property is that they are not based on legally enforceable rights; they are, however, intended by the participants in the system to be secure and enforceable.
71. In Tulip Trading v Van der Laan [2023] EWCA Civ 83 Birss LJ summarised the operation of Bitcoin. Mr Bergin emphasised that USDT does not sit on the Bitcoin blockchain but, rather, on a layer above it (and linked to it) called the Omni Layer. Otherwise, the parties agreed that this is also an accurate summary of the operation of USDT:

21. In the bitcoin scheme transactions are recorded in a ledger or database known as a blockchain, with each network having its own ledger. The blockchain constitutes a public registry recording every transaction. A given amount of bitcoin is simply a number held at a certain digital address. A transaction simply involves reducing the value at one address and correspondingly increasing it at another. Whether new addresses are created in this process does not matter for present purposes, as different cryptocurrencies work in different ways. The amounts held at every address are public, but the identity of the parties is not. The blockchain does not reveal the relationship between the digital addresses and any persons.

22. Each digital address is associated with a pair of public and private cryptographic keys. The public key identifies the address on the network. The relevant private key is the means by which bitcoin can be dealt with. The holder of the private key uses it to cryptographically sign a record of the transaction moving bitcoin from one address to another. The record is called a cryptographic hash. The public/private key pair means that the person signing with the private key is proving that they are associated with the public key (and so the address), without revealing the private key itself. The hash ensures that any attempt to alter the record would be noticeable, because even the smallest change would alter the hash.

23. For each network there are devices on the network that undertake "mining". This is the means whereby transactions are validated. The latest transactions are gathered together into a block, which also includes a hash of the previous block (hence each block is chained to its predecessor, making a "blockchain"). The miners work in competition with each other to produce an appropriate hash of this new block. The competition is to find a unique "number used once" or nonce, which causes the hash of the new block to have certain defined characteristics. This is called a "proof of work". Blocks that have been validated this way are broadcast to the network and incorporated into further work. Miners receive both transaction fees and new bitcoin.

24. The signing of the hashed transaction record with users' private keys in the first place, and the incorporation of these records into a hashed chain of blocks produced by the proof of work, solves the double spending problem. This characteristic of bitcoin does not emerge as a matter of law or convention, it is a characteristic which arises as a matter of fact from the way the software works. As a result it is meaningful to describe bitcoin not merely as something which is transferable but as "rivalrous" (see the Law Commission's recent Digital Assets: Consultation Paper [Law Com No 256]). For a transferable thing to be rivalrous, the holding of it by one person necessarily prevents another from holding that very thing at the same time. Because the holder cannot double spend their bitcoin, such that it is rivalrous, the cryptoasset can be said to be capable of assumption by a third party (see the definition of property in National Provincial Bank v Ainsworth [1965] 1 AC 65 ). Thus, as Bryan J held in AA v Persons Unknown [2019] EWHC (Comm) 3556 paras 55-61 citing Ainsworth, a cryptoasset such as bitcoin is property.

25. In a sense the token which is the bitcoin analogue of a real coin is the chain of cryptographically signed and validated transactions relating to the relevant entry in the ledger. Since every transaction relating to that token adds to its chain, some would say a fresh piece of property is created every time bitcoin is transferred, but there is no need on this appeal to get into that debate.

72. In "Tether: Fiat currencies on the Bitcoin blockchain" (the Tether White Paper) the authors emphasised (page 1):

Asset-backed token issuers and other market participants can take advantage of blockchain technology, along with embedded consensus systems, to transact in familiar, less volatile currencies and assets. In order to maintain accountability and to ensure stability in exchange price, we propose a method to maintain a one-to-one reserve ratio between a cryptocurrency token, called tethers, and its associated real-world assets, fiat currency. This method uses the Bitcoin blockchain, Proof of Reserves, and other audit methods to prove that issued tokens are fully backed and reserved at all times.

73. Proof of Reserves was an important element of the Tether White Paper (page 4):

Each tether unit issued into circulation is backed in a one-to-one ratio (i.e. one Tether USDT is one US dollar) by the corresponding fiat currency unit held in deposit by Hong Kong based Tether Limited. Tethers may be redeemable/exchangeable for the underlying fiat currency pursuant to Tether Limited's terms of service or, if the holder prefer, the equivalent spot value in Bitcoin.

74. A consequence of this was that (page 8): "Tether Limited is the only party who can issue tethers into circulation (create them) or take them out of circulation (destroy them)."
75. USDT therefore built on the Bitcoin idea of a system that replaced the need for trust with cryptography rather than rights. It appears that there may have been legal rights associated with the USDT in the form of exchangeability for fiat currency, but there was no evidence before me as to what those rights might have been or how they operated.

The alleged fraud

76. Mr D'Aloia is the founder of Microgame, which operates in real money and online betting markets. Microgame has been very successful and the profits from that success have permitted Mr D'Aloia to build a portfolio of investments. In December 2021 he was considering further investment opportunities and in particular an investment through a website, https://td-finan.com (td-finan).
77. Mr D'Aloia took this to be associated with TD Ameritrade. In fact, the two are entirely unconnected. TD Ameritrade is a regulated US brokerage with substantial assets under management; td-finan was a scam alleged to have been operated by the First Defendants in these proceedings.
78. Believing that he was dealing with a legitimate operation, on 21 December 2021 Mr D'Aloia opened an online trading account with td-finan. On 22 December 2021 Mr D'Aloia started to transfer cryptocurrency to wallets associated with his account.
79. For the purposes of the current claim the critical steps started on 10 January 2021, when Mr D'Aloia transferred funds to the 1dDA wallet controlled by the First Defendants. Mr D'Aloia asserts, on the basis of Mr Moore's evidence, that through a series of 14 Hops a part of those funds, arrived in a Bitkub wallet linked to the account of Ms Hlangpan (the 82e6 Wallet). For ease of reference I will refer to Ms Hlangpan as the controller of the 82e6 Wallet. In fact, she may either have exercised only nominal control, simply following the instructions of others, or no control at all, having handed over control to someone else. The total transferred to Ms Hlangpan was USDT 400,000, of which USDT 46,291 is said to have been either the USDT belonging to Mr D'Aloia or their traceable proceeds.
80. The validity of Mr Moore's tracing exercise, including whether it was tracing at all, is a key issue in dispute. Moreover, as I have noted, it seemed to me there was some confusion in the expert evidence over which Hops are which. For the sake of clarity, I understood the position to be as follows (using abbreviated descriptions of the various wallets for convenience).

Hop	From	To	Date	Transfer Amount (USDT)	Amount traced by Mr Moore (USDT)
1	Mr D'Aloia	1dDA	10 January 2022, 7:29pm	999,987.1	999,987.1
2	1dDA	dcEO	17 February 2022, 8:22am	326,868	326,868
3	dcEO	3209	17 February 2022, 8:24am	323,613	323,613
4	3209	98EB	17 February 2022, 8:50am	183,089	96,022
5	98EB	3180	17 February 2022, 9:15am	183,000	96,022
6	3180	6E52	17 February 2022, 9:18am	183,000	96,022
7	6E52	966d	18 February 2022, 4:58am	400,000	46,291
8	966d	A1C3	18 February 2022, 4:58am	400,000	46,291
9	A1C3	322B	18 February 2022, 5:14am	333,801	46,291
10	322B	6947	18 February 2022, 5:37am	388,273	46,291
11	6947	6F95	18 February 2022, 6:29am	351,294	46,291
12	6F95	4e72	18 February 2022, 6:50am	581,000	46,291
13	4e72	237f	18 February 2022, 7:07am	500,591	46,291
14	237f	82e6 (Ms Hlangpan)	21 February 2022, 5:18am	400,000	46,291

81. Bitkub, as I have noted, is a cryptoexchange. It offers its customers custodial digital wallet services for cryptocurrency, including USDT. The difference between a custodial and a non-custodial digital wallet is that in the case of the former the exchange, here Bitkub, manages the private key necessary to execute transactions on the blockchain; in the latter, the customer would control the private key. What that meant for current purposes is that in order to execute any transaction, Ms Hlangpan had to instruct Bitkub, who would execute it on her behalf.
82. Ms Hlangpan opened her Bitkub account in May 2021. Miss Vijitpinyo's evidence was that although she was not involved in the process at the time, for the purposes of this litigation she had reviewed the account opening documents for Ms Hlangpan's account and considered that all relevant anti-money laundering, KYC and customer due diligence processes had been complied with.
83. She was challenged on this by Mr Bergin by reference to an unofficial translation of a Notification of the Bank of Thailand and a Thai Ministerial Regulation in place at the time. It is worth emphasising how remarkable this was. As I have noted, Miss Vijitpinyo gave her evidence through a translator. Yet Miss Vijitpinyo was not referred to the Thai law itself; the unofficial translation was translated back to Thai for Miss Vijitpinyo by the translator in court. Unsurprisingly, Miss Vijitpinyo, who is not in any event a lawyer, could offer no meaningful assistance in such circumstances. Mr Bergin further referred to investigations carried out by Mr Moore and by Mr D'Aloia's solicitors, including in respect of Ms Hlangpan's social media accounts, her residential address and the use of her WhatsApp.
84. Even assuming that research was factually accurate, it was impossible to assess what significance, if any, it had. Bitkub is resident in Thailand and is subject to Thai law. To consider its compliance with that law would have required expert evidence on Thai KYC and money-laundering procedures in place in May 2021 – permission for which was refused by Master Pester – and for the case to have been pleaded – permission for such amendment having been refused by Bacon J. The issue was highlighted by Mr Connell, who noted that the Bank of Thailand Notification did not in fact apply to Bitkub. That, equally, was not supported by expert evidence, but the burden of showing that the Notification was relevant to Bitkub rested on the Claimant, and in the absence of expert evidence it was not one that the Claimant could discharge. Mr Bergin submitted that he was not alleging a breach by Bitkub of Thai law but, rather, giving an indication of what was usual in the Thai market. That seemed to me to go nowhere. The fact that there were other laws applying to other types of financial institutions told me nothing about what Bitkub was required to do.
85. In the absence of expert evidence contradicting Miss Vijitpinyo, I accept her conclusion that Bitkub considered there was nothing from a KYC perspective to raise concerns with Ms Hlangpan's account when it was opened.
86. Miss Vijitpinyo further explained that Bitkub has two levels of due diligence. A level one customer has to provide their name, address, date of birth, gender, marital status and national ID card number. They also provide a second number (which I understood may be represented in the form of a barcode) from the back of their ID card which allows Bitkub to access their record on the relevant Thai Government database for verification purposes. Mr Bergin put to Miss Vijitpinyo that the ID card check is the only external verification that Bitkub carried out, and I accept that it was. Everything else was under the control of the customer. Again, however, in the absence of any evidence showing that the relevant Thai law required further checks, I do not consider that the Claimant has established a failing on the part of Bitkub.
87. One further piece of information that the customer must provide (but which is not verified) is their income. Ms Hlangpan's gave her income as THB 15-29,999 per month.
88. To move to level two a customer must provide further proof of address and proof of income. The principal difference between the levels is that a level two customer has higher daily withdrawal limits – THB 15 million per day for level two as opposed to THB 2 million for level one. As I have noted in considering Miss Vijitpinyo's evidence, those limits were in place to address concerns over money laundering. Ms Hlangpan was (and I understand still is) a level one customer of Bitkub.
89. The funds arrived in the 82e6 wallet on 21 February 2022 at 5:18am GMT (which was 12:18pm local time in Thailand). Mr Dhanasarnsilp's evidence was that the receipt would be considered suspiciously large for somebody with Ms Hlangpan's declared income and would trigger an alert that somebody should have investigated. Shortly before on the same day Ms Hlangpan had made a series of five withdrawals in the course of three minutes totalling THB 9 million, significantly in excess of her daily limit as a level one customer. Mr Dhanasarnsilp explained that Bitkub's systems block further withdrawals once the daily limit is reached and trigger a further alert; again, he explained, that should have been investigated.
90. Neither witness was involved at the time and they did not know, and had no reason to know, why further transactions were permitted after the block was imposed. Bitkub did not offer any evidence as to what had happened, but it cannot sensibly have been the result of an investigation into Ms Hlangpan's withdrawal activity that provided a satisfactory answer because the whole series of five transactions was completed in a very short space of time. Mr Bergin put to both witnesses that it could only be either a system error or a failure by Bitkub's employees to investigate. On the evidence before me, plainly that is right.
91. At 5:23am the 82e6 Wallet was swept into the Bitkub hot wallet and USDT 400,000 was credited to Ms Hlangpan's account. The operation and legal effect of sweeping was summarised by Trower J in Piroozzadeh v Persons Unknown [2023] EWHC 1024 (Ch) at [8], and I gratefully adopt his formulation of them:

It is convenient to describe at this stage what happens to crypto assets held at a deposit address with the eighth defendant as explained in its evidence. The uncontradicted evidence adduced by the eighth defendant is that the user does not retain any property in the Tether deposited with the exchange. As it is put in Mr Quest's skeleton argument, the user's account is credited with the amount of the deposit and they are then permitted to draw against any credit balance as in a conventional banking arrangement. The Tether, like other crypto assets, are then swept into a central unsegregated pool address known as a "hot wallet" where they are treated as part of the eighth defendant's general assets. They are not specifically segregated to be held for the sole benefit of the user from whose account they have been transferred. This is what happened in the present case. All of the Tether deposited in the three user addresses held at the eighth defendant were swept into one of two hot wallets. Since that exercise was carried out, there have been hundreds of transactions an hour passing through each of the hot wallets which operate as a central pool. It is evident that, in those circumstances, any attempt to trace the Tether swept into the pool from the three user accounts at the eighth defendant would have been as at the time of the order made by Sir Anthony Mann over nine months later an essentially futile and close to impossible and possibly impossible exercise.

92. I would add only two glosses to that summary for the purposes of this case. First, the evidence before me suggested that the exercise of tracing after the USDT had been swept into the hot wallet may, in fact, be something that could be carried out by Tether Ltd itself. Secondly, however, it would be an academic concern for at least the unjust enrichment aspects of Mr D'Aloia's claim because once the link has been made to Bitkub, even at common law it is irrelevant that one cannot trace further (see Agip (Africa) Ltd v Jackson [1991] Ch 547 at 566B).
93. Over the next hours Ms Hlangpan converted the USDT 400,000 into THB (totalling THB 13,684,995.91) and proceeded to withdraw almost the entirety of those funds on 22 and 24 February, again in obvious breach of the daily limit on withdrawals. Bitkub's systems would have imposed multiple blocks on her account but there is no evidence to suggest that any investigation was conducted. Bitkub offered no reason for why it allowed its systems and controls to be bypassed with such apparent ease.
94. For completeness, I note that Ms Hlangpan received a further USDT 300,000 on 24 February 2021, which again was converted into Thai baht, of which THB 9.7 million was withdrawn the same day. In summary, someone with a declared monthly income of between THB 15,000 and 29,999 had received the equivalent of a little over THB 24 million into her Bitkub account in the form of cryptocurrency and withdrawn a total of THB 33 million in the space of three days. On the evidence of Bitkub's witnesses multiple alerts would have been raised and the account blocked multiple times. Yet the evidence suggests that no meaningful investigation was carried out by Bitkub in response.
95. It was put to both of Bitkub's witnesses by Mr Bergin that Ms Hlangpan was a money mule, who allowed her Bitkub account to be used for the purposes of money laundering. They had no explanation for how Ms Hlangpan could legitimately have obtained those funds, nor could they explain why nothing was done to investigate what was obviously suspicious account activity that breached Bitkub's procedures for level one customers. As I have repeatedly emphasised, that is no criticism of those witnesses; they had no reason to know. But theirs was the only evidence that Bitkub put forward.
96. It is accepted by Bitkub that Hop 1 is part of the td-finan fraud on Mr D'Aloia. Mr Moore's evidence that the Hops were laundering on a large scale – "a giant washing machine" – was not challenged. In any event it seems to me right. When the money started to move from Hop 2 onwards it did so quickly, at times spending only seconds in a wallet. No good reason was suggested for this and I accept Mr Moore's conclusion that it was simply an attempt to obfuscate the flow of funds and throw anyone trying to track the funds off the trail. That, in turn, supports Mr Moore's conclusion, which I accept, that Hops 2-13, and most likely Hops 1-13, were the work of a single controlling mind.
97. Finally, I accept Mr Moore's evidence, which seemed to be common ground, that at some point the fraudsters need an "off-ramp", a route to get the funds off the blockchain and into the traditional banking system. That accordingly means that I accept a link between the First Defendants and Ms Hlangpan, in that the blockchain shows that she received USDT 400,000 and for the reasons I give I have concluded that it comes from the party or parties behind the td-finan fraud. It follows that Ms Hlangpan and, in turn, Bitkub were in receipt of laundered funds.
98. I recognise that Ms Hlangpan may have an explanation that shows she was not knowingly involved in the fraud. I am also conscious of the guidance given in cases such as MRH Solicitors Ltd v The County Court Sitting at Manchester [2015] EWHC 1795 (Admin) at [34]:

We well understand how the Recorder's suspicions were aroused. However, in the absence of good reason a Judge ought to be extremely cautious before making conclusive findings of fraud unless the person concerned has at least had the opportunity to give evidence to rebut the allegations. This is a matter of elementary fairness.

99. This is a different case to MRH, however, in that the Seventh Defendants of whom Ms Hlangpan is said to form a part have been served with these proceedings in accordance with the court's order and allegations of fraud are plainly part of the pleaded case against those defendants. She has had the opportunity to rebut the allegations but has not done so. In any event, as the decision in MRH contemplated at [24]: "In complex commercial frauds it may well be that part of the case that an absent person or institution was party to dishonest conduct somewhere in the chain." Ms Hlangpan's role is significant in considering Bitkub's defences of bona fide purchase, good faith change of position and ministerial receipt and I need to make findings in respect of it.
100. In my view the Claimant has established that Ms Hlangpan not only received laundered funds but also had some active involvement in the fraud, whether as a perpetrator of it or as a money mule who lent the use of her account to those behind the fraud. No sensible honest explanation has been offered for the flows of funds through her Bitkub account, regularly involving sums well in excess of her stated earnings. That activity would have triggered multiple alerts within Bitkub but Ms Hlangpan was allowed to proceed, in that the automatic blocks on her account must have been lifted by Bitkub without any meaningful investigation. The automatic block was there to address the risk of possible money laundering; lifting that block permitted the very off-ramping it was designed to stop. It was a very significant failure in Bitkub's internal systems and controls.
101. Mr D'Aloia made further transfers to td-finan after 25 February 2022. These are not part of his monetary claims: he does not allege that he can trace from any of the sums he transferred after that date into the 82e6 Wallet or, indeed, into any other wallet controlled by Bitkub. They are relevant in showing that Mr D'Aloia was the victim of a fraud. They are also relied on by Bitkub to show that such fraud could not reasonably have been suspected at the time.
102. Since the facts are not contested they can be taken quite quickly:

i) Mr D'Aloia first experienced issues with his td-finan account on 2 February 2021 when all his open trades were closed. While Mr D'Aloia was very specific about this date in his witness statement he was much vaguer in his oral evidence before me. It seems to me likely that this was something that did not cause him undue concern; systems have glitches and as someone experienced with online platforms (albeit not necessarily cryptoassets) Mr D'Aloia would understand that.

ii) By 29 March Mr D'Aloia had decided to test td-finan's systems and submitted a withdrawal request for $1,000. His account was blocked. An email exchange followed with someone purporting to be a broker, who convinced Mr D'Aloia that the issue arose from him using two different bank accounts from which to transfer funds to td-finan. He further persuaded Mr D'Aloia that to remedy the situation Mr D'Aloia needed to pay a "security deposit" of US$229,400, which was 5% of his current balance, to address concerns that Mr D'Aloia was not laundering money. On 13 April 2022 Mr D'Aloia paid the requested sum.

iii) Mr D'Aloia's account was unlocked but he remained unable to make withdrawals. In a further exchange with td-finan he was informed that because his account had been blocked for suspected money laundering, restrictions had been imposed on it. He was advised by td-finan that he should upgrade to a VIP account for a payment of US$60,000. On 21 April 2022 Mr D'Aloia paid the requested amount.

iv) Mr D'Aloia's account was blocked again shortly thereafter, however. This time he was told that it was to do with suspicions of insider trading; he was asked for proof of address, his social security number and a further security deposit of $198,335, which was 4% of his account balance.

v) On 27 April 2022 Mr D'Aloia transferred $198,330, the shortfall being due to currency fluctuations. Mr D'Aloia transferred a further $50 to make good the shortfall but td-finan refused to unblock his account, instead demanding a further US$50,107.52. Mr D'Aloia made that payment on 3 May 2022; his account remained blocked, td-finan demanding a further $200,000 as a security deposit.

vi) On 11 May 2022 Mr D'Aloia paid the latest demand and asked that all his trades be closed within three days and all sums in his account be transferred to him. Instead, td-finan told him that he needed to pay a profit tax of 30% of the profits made on his trades, the tax being said to amount to US$211,431.81.

vii) It was not clear from his evidence whether Mr D'Aloia paid that sum, but it seems likely that he did because on 26 May 2022 td-finan told him that his withdrawal request had been successful. Mr D'Aloia requested the return of the security deposit.

viii) In fact, Mr D'Aloia received nothing and so contacted td-finan again the following day. He was told he had to pay a US offshore tax at a rate of 3% of the funds withdrawn, which amounted to £109,844.20. He paid the sum on 30 May 2022 and submitted a further withdrawal request. He did not, and has not subsequently, received any of his funds.

103. On 1 June 2022 Mr D'Aloia contacted Giambrone & Partners, his solicitors in these proceedings, and in the course of June 2022 they consulted with Mr Moore, his expert before me. Following these discussions, Mr D'Aloia came to realise that td-finan was a sham and he was the victim of a significant fraud.

Are cryptocurrencies property?

104. The status of cryptoassets as property has been repeatedly addressed at interim hearings and was recently the subject of a Law Commission Report, Law Comm No 412 "Digital Assets: Final Report" (the Final Report). Counsel had not identified any previous case in this jurisdiction where the question had to be decided at trial, however.
105. The nature of USDT is relevant to these proceedings, but it is important to note at the outset that neither party sought to suggest that USDT could not be property. Mr D'Aloia is seeking in these proceedings to recover cryptoassets; it is not remotely in his interests to say that those assets are not property because to do so would prejudice his ability to follow or trace them. Similarly, Bitkub is a cryptoasset exchange; its business model is premised on that exchange serving some function. The statements of case reflected that consensus.
106. Courts determine disputes, not hypotheticals, and there is an argument for saying the point should be left for another day. On balance, however, I do not believe that I can. Central to this case are issues of tracing and following of assets. Addressing those issues depends not just on the USDT being property, but the nature of the property rights associated with them. Specifically, Bitkub asserts that the USDT cannot be followed or traced through a mixed fund; the Claimant's position on that is more nuanced but ultimately he does not accept that Bitkub is right. It seems to me that the answer depends on the nature of the property interest in USDT, on which the parties were also at odds.

Cryptoassets as property

107. Both parties accepted that USDT is something to which property rights can attach, and both referred me to the Final Report. Mr Connell swung in firmly behind the Law Commission's conclusions. Mr Bergin focussed more heavily on whether the rights and remedies that adhered to other property also adhered to USDT; if they did, he submitted, it did not matter whether USDT was technically property.
108. There is now a strong line of authority in this jurisdiction accepting that, at least for the purposes of interim applications, there is a good arguable case that cryptoassets are to be treated as assets to which property rights can attach. The starting point is generally taken to be Bryan J's judgment in AA v Persons Unknown [2019] EWHC 3556 (Comm). An insurer had paid a ransom in bitcoin^[1] on behalf of its insured customer. It sought, among other things, a freezing injunction and a proprietary injunction against both the parties that made the ransom demand and the operators of two exchanges on which the bitcoin were held.
109. Bryan J adopted the reasoning in the Legal Statement of the UK Jurisdictional Task Force (the UKJT) of November 2019 and accepted that property was not limited to choses in possession and choses in action. At paragraph [59] he concluded:

…I consider that cryptoassets such as Bitcoin are property. They meet the four criteria set out in Lord Wilberforce's classic definition of property in National Provincial Bank v Ainsworth [1965] AC 1175 as being definable, identifiable by third parties, capable in their nature of assumption by third parties, and having some degree of permanence.

110. The Final Report noted that, at the date it was published, that test had been cited with approval in 14 subsequent cases; a total of 23 cases had accepted, expressly or implicitly, that cryptoassets such as bitcoin are property.
111. The position is most definitively stated in Tulip Trading v Van Der Laan [2023] EWCA Civ 83. At paragraph [71] of this judgment I have quoted the core of Birss LJ's analysis at [21]-[25]. It is worth further noting his observation at [72]:

The unusual factual feature of the present case is that literally all there is, is software. A physical coin has properties which exist outside the minds of people who use it and in that sense is tangible. Bitcoin is similar. It also has properties which exist outside the minds of individuals, but those properties only exist inside computers as a consequence of the bitcoin software. There is nothing else.

112. A number of points flow from Birss LJ's judgment. First, there is broad recognition that it is at least arguable that cryptoassets attract property rights. I frame it in that way because the decisions have been in the context of interim applications, where no final determination needed to be made, but in fact the judgments have been more definitive than that and have found that such assets do attract property rights. Secondly, a key aspect of cryptoassets is that they are rivalrous, that is to say ownership by one person prevents ownership by another. That can be contrasted with information, which is not rivalrous even if it has value – the fact that I know the post code for the Rolls Building does not give me any means to stop you also obtaining that information, nor does your obtaining it in any way dilute my own knowledge. Thirdly, cryptoassets exist as something outside the minds of their users.
113. The Final Report at 3.48 endorsed the approach taken by the courts:

In England and Wales, across the common law world, and in other jurisdictions, there is now a persuasive, clear, and well-reasoned body of case law that concludes that certain digital assets are capable of being objects of personal property rights. Much of the reasoning in that case law relies on analysis that supports or is consistent with our approach that recognises there is a third category of thing to which personal property rights can relate. As such, our conclusion and recommendation that the law of England and Wales either does recognise, or should explicitly recognise, such a category is intended to be confirmatory only. We conclude that the common law has already moved on from the question as to the proprietary status of certain digital assets, and how best to categorise them.

114. It added further to the analysis of Birss LJ by noting at 3.68 that:

Those things [crypto-tokens] do not exist as rights or claims in themselves (they instead exist independently). They also can be used and enjoyed independently of whether any rights or claims in relation to them are enforceable by action.

115. This, it seems to me, is both right and significant in the analysis: cryptoassets have a conceptual existence that is independent of the legal system and of their individual users.

The arguments against

116. While the bulk of academic commentary supports those positions, strong arguments have been advanced in opposition. Two, in particular, are raised in the Final Report and are important to address in considering both whether USDT attract personal property rights and, if so, what form the property interest takes.
117. In his article "Crypto is not Property" (2023) 139 LQR 615 Professor Stevens advances an argument based on the nature of property, which, he submits, is inextricably tied to legal rights. That is most apparent in the case of choses in action. As Professor Stevens observes, those are "rights only capable of being vindicated through court action, that do not have as their subject matter a thing capable of possession" (page 618). However, as he goes on to note, tangible property is also about rights:

"Choses in possession" refers to rights in relation to things that are capable of being possessed (i.e. rights to tables, chairs, and mobile phones etc). Such rights are, of course, also capable of being vindicated through court actions.

118. The analysis up to this point is uncontroversial. For example, the Law Commission reached the same conclusion (Final Report paragraphs 3.28-3.30).
119. Where the difference seems to arise is that advocates for treating cryptoassets as property argue for the recognition of a third class of property that would require them to be neither choses in possession nor choses in action. Professor Stevens rejects that (pages 618-619):

The term "choses in action" does not however naturally cover transferable privileges and immunities. This is a historical accident: the common law when the terms arose did not recognise, for example, transferable waste management licences which are the modern creation of legislation. However, all forms of "property" in the patrimonial sense must still be a transferable legally recognised right, whether as (ordinarily) a Hohfeldian claim-right or power, or (exceptionally) a privilege or immunity.

120. The reference to Hohfeldian claim-rights, powers, privileges and immunities is, I understand, a reference to a distinction drawn by Professor Hohfeld, in two articles both titled "Fundamental Legal Conceptions as Applied in Judicial Reasoning" in (1913-14) 23 Yale LJ 16 and (1916-17) 26 Yale LJ 710. Professor Hohfeld summarised his concern at (1913-14) 23 Yale LJ 28-29:

One of the great hindrances to the clear understanding, the incisive statement, and the true solution of legal problems frequently arises from the express or tacit assumption that all legal relations may be reduced to "rights" and "duties," and that these latter categories are therefore adequate for the purposes of analyzing even the most complex legal interests, such as trusts, options, escrows, "future" interests, corporate interests, etc. Even if the difficulty related merely to inadequacy and ambiguity of terminology, its seriousness would nevertheless be worthy of definite recognition and persistent effort toward improvement; for in any closely reasoned problem, whether legal or non-legal, chameleon-hued words are a peril both to clear thought and to lucid expression. As a matter of fact, however, the above mentioned inadequacy and ambiguity of terms unfortunately reflect, all too often, corresponding paucity and confusion as regards actual legal conceptions.

121. He then addressed a particular case in point: the use by lawyers of the term "right" (page 30): "the term 'rights' tends to be used indiscriminately to cover what in a given case may be a privilege, a power, or an immunity, rather than a right in the strictest sense". By a "right in the strictest sense" he meant what he called a claim and Professor Stevens calls a claim-right: a right that is matched by the party against whom it is held owing the corresponding duty, which duty can be legally enforced. If I have a right to be paid £50 under a contract, my contractual counterparty has a corresponding duty to pay me £50, and if they fail to do so I can enforce my right (and their duty) by way of legal proceedings.
122. By contrast, the "right" to self-defence is of a very different nature. If I am attacked and act reasonably in defending myself, my attacker cannot sue for what would otherwise be a battery. But that "right" gives rise to no claim that I could bring. Rather, it creates what Professor Hohfeld described as a privilege (page 26): "the otherwise existing duty of Y [the victim of the initial attack] to refrain from the application of force to the person of X [the attacker] is, by virtue of the special operative facts, immediately terminated or extinguished."
123. In addition to claim-rights and privileges, Professor Hohfeld identified powers (which would include such things as the power of an owner of personal property to transfer that property and thereby extinguish his or her rights in it – there is, of course, no corresponding duty on anyone to assist in that process by accepting the transfer) and immunities (for example, charities are immune from certain forms of taxation). Professor Hohfeld summarised his terminology at page 55:

A right is one's affirmative claim against another, and a privilege is one's freedom from the right or claim of another. Similarly, a power is one's affirmative "control" over a given legal relation against another; whereas an immunity is one's freedom from the legal power or "control" of another as regards some legal relation.

124. Professor Hohfeld's claim rights, privileges, powers and immunities are all about legal relationships. I understand Professor Stevens' argument to be that while property may be broader than just claim-rights, it must involve some legal relationship.
125. On Mr Bergin's analysis, Professor Stevens' argument would be irrelevant, since Mr Bergin does not seek to show that USDT is property at all. For reasons I go on to address, I do not accept that, but I do accept the logic of his position: were I with him on the irrelevance of property existing in USDT, it would follow that Professor Stevens' objection would not be an issue.
126. Mr Connell invited me to reject Professor Stevens' argument as circular – the question of whether something attracted property rights could not depend on whether it already created other rights. That, it seemed to me, was not quite right, in the sense that I did not see Professor Stevens' argument as being circular. I agree, however, that if a "rights" requirement does not exist, Professor Stevens' doctrinal objection falls away.
127. The question of whether property can exist in the absence of a legally enforceable right was considered in Ex parte Huggins; In re Huggins (1882) 21 Ch D 85. The case concerned a pension payable to the former Chief Justice of Sierra Leone, who had subsequently been made bankrupt. Payment of the pension was voted on annually by the Colonial Legislature. Jessel MR rejected the idea that simply because the contract could not be enforced in court it was not property for the purposes of section 90 of the Bankruptcy Act 1869. He emphasised at pages 90-91:

If a man died possessing nothing but French or Italian bonds no one would say that he had died without any property. Such bonds are not choses in action in the ordinary sense, and that cannot be the definition of property. The mere fact that you cannot sue for the thing does not make it not "property". I am not going to attempt to define "property", that would be too dangerous. But there can be no doubt that these foreign bonds, both in common language and in the language of lawyers, are "property". Nor can I doubt that if a man had a bond for £10,000 of the British Government it would be "property". The annuities which were granted by the kings of England in former days, charged on the tonnage and poundage dues, were always dealt with as property, and they formed the subject of numerous decisions of the courts. But you would not sue the Crown for them, and they could not even be made the subject of a petition of right, because they were granted out of the voluntary bounty of the Crown. But still they were property and they were assignable.

128. While Jessel MR was dealing with property for the purposes of a specific statutory provision, I read what he said as being of broader application. One would, for example, equally expect that French or Italian bonds could be the subject of a trust. Moreover, his observations on assignability can only be a reference to whether something was property for general common law principles, rather than being limited to the statutory provision he was addressing.
129. Attorney-General of Hong Kong v Nai-Keung [1987] 1 WLR 1339 concerned the theft of export quotas. Under Hong Kong law at the time, textiles could only be exported from Hong Kong under licence. A licence would only be issued to the holder of a valid quota allocation certificate and it was these certificates that the defendant had misappropriated. Export quotas were registered with the Department of Trade and Industry (the DTI) and were transferable with the DTI's approval on a temporary or permanent basis. The appeal turned in part on whether such quotas fell within the scope of the Hong Kong Theft Ordinance 1970, which defined property as "money and all other property, real and personal, including things in action and other intangible property".
130. Significantly, for current purposes, Lord Bridge noted at page 1342B: "In summary, to be registered as the holder of an appropriate quota is a prerequisite to obtaining an export licence; it confers an expectation that, in the ordinary course, a corresponding licence will be granted, though not an enforceable legal right."
131. Lord Bridge continued at page 1342B-C:

It would be strange indeed if something which is freely bought and sold and which may clearly be the subject of dishonest dealing which deprives the owner of the benefit it confers were not capable of being stolen. Their Lordships have no hesitation in concluding that export quotas in Hong Kong although not "things in action" are a form of "other intangible property".

132. In my view, two significant points arise from this decision. First, property existed in the quotas which, themselves, afforded no rights, merely an "expectation" that a license would be granted. By contrasting the concepts of right and expectation, the Privy Council made clear that the latter was broader than the former. A parallel can be drawn with the USDT in issue in this case: as I have noted above, both the Bitcoin White Paper and the Tether White Paper talk about the use of cryptography to replace the need for either an intermediary or trust between the parties. Both USDT and Bitcoin are premised on an expectation of performance, albeit secured by cryptography rather than recourse to a court or tribunal.
133. Secondly, the rationale behind their Lordships' reasoning was that the quotas were freely bought and sold; it would be "strange indeed" if such a thing were not property. I fully accept Professor Stevens' point that there are things that have value, like confidential information, that the law does not recognise as property. Insofar as the point goes, I accept his criticism of Professor Goode's proposal ("What is Property?" (2023) 139 LQR 1) that value and property can in all cases be equated. But I equally accept the Privy Council's point (and that of Professor Goode) that typically those things do closely correlate.
134. It is important to recognise that this was a specific statutory definition that assumed the existence of intangible property that was not a chose in action. I address that in due course because the position has subsequently developed, but it seems to me that Nai-Keung itself is not authority for the proposition that a third class of property exists outside defined statutory regimes; it simply shows that there is no conceptual hurdle to such a class of property existing.
135. I also recognise that there may have been rights associated with the quota certificates. I was not addressed on the state of Hong Kong judicial review law in the early 1980s, but one would expect there to have been some right to reopen a decision of the DTI if made, for example, capriciously. This, it seems to me, would be a non-point, however, because that right was not what was being traded, less still what was stolen. Had one asked a purchaser of quotas what they had just bought, it would be odd to receive the answer, "The right to review certain erroneous decisions of the DTI." Similarly, Lord Bridge's reference to the quotas carrying "an expectation, though not an enforceable legal right" demonstrates that the Privy Council did not see ancillary rights, such as any right to judicial review, as relevant to their finding.
136. Re Celtic Extraction [2001] Ch 475 concerned two companies, both in compulsory liquidation, that had been granted waste management licences under the Environmental Protection Act 1990. In each case, clean-up obligations under the licences exceeded the company's assets and the liquidator sought to disclaim the licence as onerous property under section 178 of the Insolvency Act 1986. The question therefore arose whether the licences fell within section 436 of the 1986 Act, which provides that "'property' includes money, goods, things in action, land and every description of property wherever situated and also obligations and every description of interest, whether present or future or vested or contingent, arising out of, or incidental to, property".
137. The Court of Appeal found that they were within the scope of section 436. Morritt LJ noted at [26] that property was not a term of art but, rather, derived its meaning from its context, referring to Nokes v Doncaster Amalgamated Collieries Ltd [1940] AC 1014 at 1051 and Kirby v Thorn EMI plc [1988] 1 WLR 445 at 452. He then addressed the various cases and referred to the passage in Nai-Keung that I have quoted above before concluding at [33]:

It appears to me that these cases indicate the salient features which are likely to be found if there is to be conferred on an exemption from some wider statutory prohibition the status of property. First, there must be a statutory framework conferring an entitlement on one who satisfies certain conditions even though there is some element of discretion exercisable within that framework… Second the exemption must be transferable… Third the exemption or licence will have value.

138. I do not read the reference that there "must be" as saying that property could only exist against a statutory backdrop. As Morritt LJ noted by reference to Nokes, property is context specific and he was working against the backdrop of exemptions from a statutory prohibition; plainly, there needed to be a statutory prohibition in the first place if the exemption were to be property.
139. Significantly, Morritt LJ cited Nai-Keung, in which a sufficiently founded expectation could constitute property even in the absence of a legal right. That is consistent with Morritt LJ's own reference to a discretion not defeating a finding of property.
140. Swift v Dairywise (No 1) [2000] 1 WLR 1177 involved milk quotas, which gave producers an exemption from a levy that would otherwise be payable on milk production. The quotas had to be attached to milk producing land. Dairywise loaned money to farmers on the security of such quotas. However, it had no milk producing land, so the quotas were held by an affiliate, Dairywise Farms, which did. Dairywise entered liquidation with its sole asset being debts owed to it by farmers. A question arose as to the ownership of the milk quotas. Jacob J found at 1183H-1184A that quotas could be the subject of a trust:

The respondents submit that it is not by its nature capable of forming the subject matter of a trust. They say this follows because it is not a free standing and freely marketable asset. Because it is merely an exemption from a levy and must be attached to a producer's holding, it cannot be held by a producer on trust.

I reject those submissions. Quota has commercial value and a legal effect. Merely because there are limitations on how it may be held or conveyed is not a reason for equity to refuse to impose a trust where conscience so requires.

141. At 1184G to 1185A he applied what he described as the threefold test from Re Celtic Extraction set out above: a statutory framework conferring an entitlement; transferability; and the exemption or licence had to have value. Again, of course, he was operating against the backdrop of a statutory scheme that was premised on entitlements having some legal effect, and the points I have made above about the context specific nature of the enquiry in my view apply equally here.
142. Armstrong DLW GmbH v Winnington Networks Ltd [2012] EWHC 10 (Ch), a decision of Stephen Morris QC sitting as a Deputy High Court Judge, concerned a claim for restitution in respect of the unauthorised transfer of EU emissions allowances (EUAs). As the learned Judge explained at [17]:

EUAs are entirely electronic. They only exist online in national registries. There is no title document or other physical evidence of their existence. However, each EUA has its own individual number and is easily identifiable. If an EUA is sold, it is simply removed from the registry account of one operator or trader and added to that of another operator or trader.

143. As with the dispute before me, it was not disputed by the defendant in that case that an EUA was a property right "of some sort" (paragraphs [31] and [40]); what was in issue was their precise nature and characterisation as property (paragraph [40]).
144. At paragraph [48] the learned Judge accepted that an EUA was not a claim-right "in the Hohfeldian sense" because there was no correlative obligation. Rather, it represented what he described, again in Hohfeldian terms, as a permission or an exemption from a fine.
145. The learned Judge then applied at paragraph [50] the test in National Provincial Bank v Ainsworth [1965] AC 1175 at 1247-1248 ("Before a right or an interest can be admitted into the category of property, or of a right affecting property, it must be definable, identifiable by third parties, capable in its nature of assumption by third parties, and have some degree of permanence or stability.") He concluded that an EUA was property:

It is definable, as being the sum total of rights and entitlements conferred on the holder pursuant to the ETS. It is identifiable by third parties; it has a unique reference number. It is capable of assumption by third parties, as under the ETS, an EUA is transferable. It has permanence and stability, since it continues to exist in a registry account until it is transferred out either for submission or sale and is capable of subsisting from year to year.

146. He noted that an EUA was not a chose in possession. He then considered the cases that I have addressed above and concluded at paragraph [58] that the threefold test in Re Celtic Extraction led to the conclusion that EUAs were intangible property. He found that the test was not limited to specific statutory definitions but applied equally at common law, noting that Morritt LJ had relied on National Provincial Bank v Ainsworth.
147. He concluded at [61]:

In my judgment, strictly an EUA is not a chose in action in the narrow sense, as it cannot be claimed or enforced by action. However to the extent that the concept encompasses wider matters of property, then it could be so described.

148. Finally I come to Gwinnutt v George [2019] EWCA Civ 656. Mr George was a barrister who, at the time of his bankruptcy, had outstanding fees. Those fees were incurred under the old regime where a barrister had no contract and was not entitled to sue to recover his or her fee; as was noted in Rondel v Worsley [1969] 1 AC 191 per Lord Upjohn at 279: "fees due to counsel create no debt". The question was whether they constituted property such that they formed part of the bankruptcy estate. The Court of Appeal found that they did.
149. Giving the leading judgment, Newey LJ considered Ex parte Huggins and concluded at [17] that it related not to the money received but to the right (such as it was) to receive that money. I respectfully agree both with that conclusion and the reasons Newey LJ gave for it.
150. At [20] Newey LJ addressed the argument that there was a distinction between Ex parte Huggins, where there was an unenforceable contract, and the case before him, where there was no contract at all:

On the other hand, there is force in Mr Grant's comment that "unenforceable contract" has an "oxymoronic quality". If, Mr Grant asked, rhetorically, a contract is unenforceable from the outset, what right can there be to payment under the contract? In a contractual context, one would normally expect a "right" to connote an ability to mount a legal claim. The maxim "ubi ius ibi remedium" encapsulates the idea that, wherever there is a right, there is a remedy. Turning that round, one may wonder whether there can be a true legal right in the absence of a remedy.

151. He concluded at [28]:

A barrister had more than a mere moral claim to such fees and more than just a hope (or "spes") that he would receive them. If needs be, the barrister could invoke the Bar Council's Withdrawal of Credit Scheme, and a solicitor's failure to pay a fee could potentially amount to professional misconduct. The highly unusual character of a barrister's fee is also manifest in the client's inability to revoke his solicitor's authority to pay counsel and the solicitor's right to reimbursement. The law recognised that, notwithstanding the absence of a contract, payment of an outstanding fee was not to be regarded as voluntary. In practice, a barrister would normally be paid.

152. That reasoning is not in any way limited to the particular context or the language of the bankruptcy regime.
153. From these cases I draw a number of points:

i) Choses in action relate to a right only capable of being enforced through proceedings, a Hohfeldian claim-right.

ii) Accordingly, when the courts recognised the existence of property rights in respect of Hohfeldian privileges and immunities they were recognising, to the extent that it had not been done before, a different category of property right. Cases such as Celtic Extraction, Dairywise and Armstrong can be understood in such Hohfeldian terms (and indeed the interest in Armstrong was described in those terms). Up to that point I accept Professor Stevens' analysis.

iii) As Huggins, Nai-Keung and Gwinnutt make clear, however, an expectation not based on a legal right, power, immunity or privilege may also be something to which property rights can attach, provided that expectation was clear and well founded. Professor Stevens' argument cannot, in my view, explain those cases. I do not read those cases as laying down an approach only in respect of the statutory regime under which they arose; they are of general application. I recognise, of course, that Nai-Keung was applied in some of the "Hohfeldian" cases, so plainly analogies can be drawn, but I see the distinction as a significant one, at least in principle. I am therefore cautious about the terminology of a "third category" used in the Final Report, as it combines things that are potentially quite different, as the Final Report itself recognises at 4.26(4). One could simply subdivide the third category, but for the reasons given in the Final Report at 3.36-3.37 in respect of subdividing the category of choses in action that seems to me potentially undesirable. Professor Hohfeld's concern that "chameleon-hued words are a peril both to clear thought and to lucid expression" applies equally here. That is not to say that things such as carbon credits are not property; as Armstrong makes clear, carbon credits in fact are property. It is simply that I would not seek to bracket all assets that are neither choses in action nor choses in possession under a single category of property for all purposes. I note that this is consistent with the approach proposed in the Law Commission's draft Property (Digital Assets etc) Bill.

iv) The starting point is the test in National and Provincial Bank v Ainsworth; that will also, often, be the end point.

154. It was accepted in AA at [59] and Tulip Trading at [24] that the Ainsworth criteria are satisfied in the case of bitcoin. As the Tether White Paper makes clear, USDT operates in much the same way but with the added feature of proof of reserves. It therefore also satisfies the Ainsworth criteria, and the starting point is that it is property.
155. USDT does not confer Hohfeldian claim-rights, powers, privileges or immunities. In not conferring claim-rights USDT cannot be choses in action, but as Nai-Keung and Gwinnutt both make clear that is not necessary provided there is an expectation with a sufficient basis. Here, plainly, there is. The foundation of USDT is the cryptographic security of the blockchain. There is more than a mere hope that transactions will be honoured; as the Bitcoin and Tether White Papers make clear, there is an expectation that this will happen based on cryptographic security that is designed to make it happen.
156. What would the nature of such an asset be? The Final Report devoted some time to that question, particularly noting Professor Fox's article "Digital Assets as Transactional Power" (2022) 1 JIBFL 3 (see in particular paragraphs 4.14 and 4.19-4.20 of the Final Report). Professor Fox noted (my emphasis):

But to see the asset as mere data would ignore its larger functionality, just as we would fail to appreciate the full economic or legal significance of a coin by treating it as a mere metal disc. If the law is to recognise digital assets as property for private law purposes, then it would benefit from analysing them as composite things. The asset is more than mere data. It is a set of transactional functionalities. The most important of these is the capacity of the person who holds the private key to effect new transactions which will be recognised as valid by the rules of the system. Analysed in this way, the asset can be viewed as a specific transactional power over unique data entries on the ledger.

157. The same conclusion was reached by the UKJT Legal Statement at paragraph 60.
158. I agree. The combination of both data and transactional functionalities in my view satisfies what is required by cases such as Huggins, Nai-Keung and Gwinnutt to give the "expectation", to use the term from Nai-Keung, that the transaction will be honoured sufficient form to attract property rights. The Court of Appeal in Tulip Trading at [24] considered that the fact the data entries are unique means that the asset is rivalrous – possession by one party excludes possession by another.
159. The final limb of Professor Stevens' argument is that cryptoassets are simply information, and there is no property in information as such. That seems to me to be addressed by Professor Fox's definition that I have accepted above: the property is not merely the data but the combination of the data and the transactional functionalities related to it.
160. The second argument against the Law Commission's proposed approach that was recognised in the Final Report is that cryptoassets should be considered property but that there is no need for a third class of property to accommodate them. The Final Report made particular reference to a piece by Professor Peter Watts KC and Professor Kelvin FK Low ("The Case for Cryptoassets as Property" now updated in light of the Final Report and published in Agnew and Smith (Eds) "Law at the Cutting Edge: Essays in Honour of Sarah Worthington" (Hart 2024)).
161. Professor Watts and Professor Low criticise the idea in the Final Report that cryptoassets are themselves rivalrous, but that their rivalrousness is fragile in that it depends on cryptography that can never be absolutely secure (page 287):

Rivalrousness is by definition an absolute concept, and in property law terms relates not to an object per se, but to control of the said object. Possession is rivalrous because A's possession of an object ipso facto means B is not in possession and vice versa. That it is the form of control that is protected rather than the object per se can be seen from the absence of any conception of trespass by merely viewing something. All forms of control are imperfect – A may be dispossessed by B – but their imperfection has no impact on the rivalrousness of possession as a form of control. When dispossessed, B is in possession of the object and by definition A is not. The Law Commission appears to have fallen into the mistake of concluding that just because possession is an imperfect and rivalrous form of control that other imperfect forms of control (such as via a private key in a decentralised system) can also be regarded as rivalrous.

162. They argue that one option would be to treat the private key as confidential information that can be bequeathed. They conclude at page 290 that there is a better route:

However immune to suit the creators and operators of the data system may be to legal suit, it seems fairly obvious that a legal system with jurisdiction should conclude of a functioning cryptoasset system that each holder of the cryptoasset defined by a public key has the legal right as against all parties outside the system to use the corresponding private key in order to cause the data system to recognise a new transaction involving the cryptoasset. That right is a species of intangible property.

This is so whether or not the private key remains secret; it is the right to cause the system to operate, not the key, that is the property.

163. It seemed to me that, on closing, Mr Bergin was advocating for such an approach. As I have noted, his focus was on the rights and remedies that adhere to USDT, more than the nature of the asset itself.
164. As the Final Report notes at 4.38, an approach focussed on rivalrousness and an approach focussed on control are similar and in practice may lead to functionally equivalent results. However, I find an approach focussed on control less straightforward to reconcile with the caselaw. Most obviously, the Court of Appeal considered that bitcoin are rivalrous in Tulip Trading at [24]. The operation of USDT, which as I have noted is the only type of cryptoasset in issue before me, is designed to be almost identical, such that they, too, are rivalrous.
165. Moreover, I agree with what is said at 4.39 of the Final Report that it is helpful to focus on the characteristics of the thing itself. Paragraph 3.68 of the Final Report notes that crypto-tokens exist independently of the rights and claims associated with them and are used and enjoyed independently of whether they give rise to rights enforceable by action. That seems to me to be consistent with Birss LJ's observation in Tulip Trading at [72] that bitcoin have an existence outside the minds of individuals. I take those observations to be more consistent with recognising property in the crypto-token itself, rather than the rights that surround it.
166. That is not to say that I disagree with what Professor Watts and Professor Lowe say about there being a right to cause the system to operate. That is not a point that arises in this case and so I express no view on it. But I would see any such rights as being in addition to, not the basis of, the recognition of USDT as property.
167. Finally, not least because concerns over money laundering and the funding of terrorism were central parts of Mr Moore's evidence, I need to address the arguments around the public policy issues associated with crypto-assets.
168. Broadly, the concern is that crypto-assets give rise to a range of considerations ranging from money laundering to climate change and courts lack the institutional competence to consider them. Accordingly, the question of whether to recognise property rights attaching to crypto-assets is better left to Parliament. See, for example, Professor Grower, "Better Left to the Legislature? Notes on a Nagging Doubt Over the Legal Recognition of Cryptoassets" in "Law at the Cutting Edge" page 301. Similar issues were raised by Professor Stevens. In the course of trial I was referred, for somewhat different reasons, to the Supreme Court's recent decision in Philipp v Barclays Bank plc [2023] UKSC 25, where the differing institutional capacities of the courts, legislators and regulators were recognised by Lord Leggatt.
169. Mr Connell submitted that adopting such an approach was the wrong way round. Typically, at least in private law, courts would determine the rights and obligations of parties and if Parliament disagreed it would step in. At least in this case that seems to me the right approach. In his piece, Professor Grower at page 306 refers to Professor Stapleton's "Three Essays on Torts" (Oxford University Press 2021). In the first of those essays, at pages 29-30, Professor Stapleton recognised the types of concerns that Professor Grower raises, but she concluded at page 30:

Given Parliament is typically silent across much of tort law and yet courts are required to decide the cases before them, courts proceed, even if sometimes tentatively, to identify and articulate the content of the developing common law. In doing so, they act as interpreters of society and its values. Parliament virtually always acquiesces in the judgments arrived at by courts, our democratically elected representatives accepting that courts have adequate, if not ideal, institutional competence to identify developments in tort law.

170. Courts decide the matters that come before them. If Parliament considers that there are broader concerns, it may be one of those cases where it does not acquiesce in the conclusion reached by the judge and acts. But the fact that it might do so is not a bar on the court determining the case at hand.
171. I am also conscious that leaving matters to the legislature is not necessarily as easy as it sounds. I have concluded that: as a matter of existing English case law an expectation can suffice for the foundation of property rights even in the absence of a legal relationship; that English law recognises that assets that are substantially identical to USDT are rivalrous; and that in respect of USDT the Ainsworth test is satisfied. If I were to conclude that, even so, USDT should not be considered to be property because there are public policy concerns that I am not well placed to consider, I would not be maintaining the status quo until Parliament acts. I would be making a positive finding that, for the purposes of Mr D'Aloia's claim, he had no property that I was prepared to recognise. And I would be doing so on the basis that there may be concerns of a type that, if they existed, Professor Grower argues I would lack the institutional competence to consider. That, it seems to me, would not be right.
172. Finally, even if Parliament were to act it might not address the issues that are said to be a concern. The Law Commission's draft Property (Digital Assets etc) Bill does not seek to say whether crypto-assets, or certain classes of them, are property. It simply clarifies that something can be property that is neither a chose in action nor a chose in possession. Assuming that Bill became law, it is not clear what the judge would be expected to do, given that Parliament would have spoken but would not have resolved the types of concerns that Professor Grower and Professor Stevens raise.
173. Accordingly, in my view USDT, while neither a chose in possession nor a chose in action, is capable of attracting property rights for the purposes of English law. Those rights attach to the USDT itself, rather than the right to control it, for example the right to use the private key.

Following and tracing

The distinction between following and tracing

174. Critical to Mr D'Aloia's claim is to bridge the gap between the 1dDA Wallet into which he paid his USDT and the 82e6 Wallet, from which it left the blockchain universe and re-entered the traditional banking system. For this he relies on Mr Moore's reports, but before turning to those reports it is important to be clear how the processes work legally because it goes to one of the pleading points raised by Bitkub.
175. Mr Connell submitted that the difference between following and tracing presented an insurmountable hurdle for Mr D'Aloia, at least in respect of his constructive trust claim, because that claim was advanced expressly on the basis of following and not tracing. Mr Bergin accepted, in rather qualified terms, that he was not advancing a claim on the basis of following, although as I come to address it remained an issue for determination. He further accepted that the statements of case were inelegant, but submitted that they sufficed to set out a tracing claim. He noted that Master Pester had obviously understood that because his order regarding expert evidence covered both tracing and following. He had a further point that neither tracing nor following were required for the claim in unjust enrichment; again, I address that separately later in this judgment.
176. I agree with Mr Connell that as a matter of law, tracing and following are different things. As Lord Millett explained in Foskett v McKeown [2001] 1 AC 102 at page 127B:

These are both exercises in locating assets which are or may be taken to represent an asset belonging to the plaintiffs and to which they assert ownership. The processes of following and tracing are, however, distinct. Following is the process of following the same asset as it moves from hand to hand. Tracing is the process of identifying a new asset as the substitute for the old. Where one asset is exchanged for another, a claimant can elect whether to follow the original asset in the hands of the new owner or to trace its value into the new asset in the hands of the same owner. In practice this choice is often dictated by the circumstances.

177. I will address the point on the choice being dictated by the circumstances when I come to consider following.
178. Mr Connell submitted that tracing was not open to the Claimant because the statements of case and the report of Mr Moore refer only to following. That, it seemed to me, was not correct. I agree that tracing is not referred to using that term, but the concept is part of the Claimant's case.

i) Paragraph 30 of the Re-Amended Reply asserts a claim over the "substitute(s) or proceeds" of Mr D'Aloia's USDT.

ii) In connection with the legal proprietary claim, paragraph 13 of the Re-Amended Reply provides that: "In so far as the Sixth Defendant has converted the 65,022 USDT into choses in action and/or substitute assets; the Claimant asserts its legal title in those choses in action and/or substitute assets."

179. The proprietary restitution claim was abandoned at trial, but it still informs the way that the statements of case and Mr Moore's report are to be read. Both the claims, in terms, apply to "substitutes" or "substitute assets". As Lord Millett in the passage I have quoted above makes clear, substitutes are the domain of tracing, not following. These claims are therefore premised, at least in part, on tracing. Since both those claims were based on the work of Mr Moore (Re-Amended Particulars of Claim paragraph 34(iii), Re-Amended Reply paragraph 33), work that was described as (and only as) "following", the Claimant and Mr Moore must have been using that term in a non-technical sense.
180. Moreover, while the concepts are distinct the law recognises that sometimes they are used collectively or interchangeably. As the Supreme Court recently observed in Byers v Saudi National Bank [2023] UKSC 51 at [68]:

Strictly tracing is the process whereby the claimant locates a substituted asset in which he claims a beneficial interest, whereas following is the process whereby the claimant locates the original asset in the hands of a stranger. But both are commonly referred to as tracing, and I have no doubt that Hoffmann LJ [in El Ajou v Dollar Land Holdings plc [1994] 2 All ER 685 at 700] was using tracing in that combined sense as including following in the passage under consideration.

181. It would seem to me odd if tracing could be used in a combined sense to include following but following had to be limited to its strict meaning.
182. Nor do I consider that Bitkub or its lawyers were prejudiced by the reference only to following. As Mr Bergin noted, Master Pester ordered expert evidence on tracing and following and it was obvious that Mr Connell was in a position to cross-examine Mr Moore on both. It may have a bearing on costs in due course, but I accept that Mr D'Aloia can advance claims on the basis of tracing.

The legal test for tracing

183. Again, the starting point is Foskett. As Lord Millett explained at 127H-128D:

We speak of money at the bank, and of money passing into and out of a bank account. But of course the account holder has no money at the bank.  Money paid into a bank account belongs legally and beneficially to the bank and not to the account holder. The bank gives value for it, and it is accordingly not usually possible to make the money itself the subject of an adverse claim. Instead a claimant normally sues the account holder rather than the bank and lays claim to the proceeds of the money in his hands. These consist of the debt or part of the debt due to him from the bank. We speak of tracing money into and out of the account, but there is no money in the account. There is merely a single debt of an amount equal to the final balance standing to the credit of the account holder. No money passes from paying bank to receiving bank or through the clearing system (where the money flows may be in the opposite direction). There is simply a series of debits and credits which are causally and transactionally linked. We also speak of tracing one asset into another, but this too is inaccurate. The original asset still exists in the hands of the new owner, or it may have become untraceable. The claimant claims the new asset because it was acquired in whole or in part with the original asset. What he traces, therefore, is not the physical asset itself but the value inherent in it.

Tracing is thus neither a claim nor a remedy. It is merely the process by which a claimant demonstrates what has happened to his property, identifies its proceeds and the persons who have handled or received them, and justifies his claim that the proceeds can properly be regarded as representing his property. Tracing is also distinct from claiming. It identifies the traceable proceeds of the claimant's property. It enables the claimant to substitute the traceable proceeds for the original asset as the subject matter of his claim. But it does not affect or establish his claim.

184. He went on to consider the distinction between the legal and equitable rules on tracing at 128G:

Given its nature, there is nothing inherently legal or equitable about the tracing exercise. There is thus no sense in maintaining different rules for tracing at law and in equity. The existence of two has never formed part of the law in the United States: see Scott on Trusts, 4th ed (1989), section 515, at pp 605-609. There is certainly no logical justification for allowing any distinction between them to produce capricious results in cases of mixed substitutions by insisting on the existence of a fiduciary relationship as a precondition for applying equity's tracing rules. The existence of such a relationship may be relevant to the nature of the claim which the plaintiff can maintain, whether personal or proprietary, but that is a different matter. I agree with the passages which my noble and learned friend, Lord Steyn, has cited from Professor Birks's essay "The Necessity of a Unitary Law of Tracing", and with Dr Lionel Smith's exposition in his comprehensive monograph The Law of Tracing (1997): see particularly pp 120-130, 277-279 and 342-347.

This is not, however, the occasion to explore these matters further, for the present is a straightforward case of a trustee who wrongfully misappropriated trust money, mixed it with his own, and used it to pay for an asset for the benefit of his children. Even on the traditional approach, the equitable tracing rules are available to the plaintiffs.

185. He drew a distinction between wrongdoers and innocent parties when tracing through mixed funds. As to wrongdoers he set out what he described as "the basic rule" at 131G:

Where a trustee wrongfully uses trust money to provide part of the cost of acquiring an asset, the beneficiary is entitled at his option either to claim a proportionate share of the asset or to enforce a lien upon it to secure his personal claim against the trustee for the amount of the misapplied money. It does not matter whether the trustee mixed the trust money with his own in a single fund before using it to acquire the asset, or made separate payments (whether simultaneously or sequentially) out of the differently owned funds to acquire a single asset.

186. In the case of funds mixed with those of other innocent victims the position is quite different (page 132D):

Innocent contributors, however, must be treated equally inter se. Where the beneficiary's claim is in competition with the claims of other innocent contributors, there is no basis upon which any of the claims can be subordinated to any of the others. Where the fund is deficient, the beneficiary is not entitled to enforce a lien for his contributions; all must share rateably in the fund.

187. Against that backdrop, a number of issues in dispute between the parties fall to be addressed.

Can the Claimant trace at common law through a mixed fund?

188. In support of the proposition that tracing at common law in this case was impossible, Mr Connell referred me to Tecnimont Arabia Ltd v National Westminster Bank Plc [2022] EWHC 1172 (Comm) at [150]:

The law in this area is settled. Tracing through mixed funds (included those created by international banking transfers of the type present in this case) is impermissible at common law. The correct approach is that set out in Agip (Africa) Limited v Jackson [1991] Ch 547.

189. The issue is dealt with very briefly, and appears to have been agreed between the parties. Ultimately, I agree with that conclusion but my reasons for doing so are somewhat different and it is worth setting out what they are, given that it may impact on other aspects of the following / tracing issues.
190. The idea that there should separate tracing regimes in equity and at common law was attacked in Foskett. Lord Millett at 128G-H argued there was "no sense to maintaining different rules", that "One set of tracing rules is enough." and that there was "no logical justification for allowing any distinction between them to produce capricious results". He also agreed at 128H with Lord Steyn. His starting point was at 113C:

In truth tracing is a process of identifying assets: it belongs to the realm of evidence. It tells us nothing about legal or equitable rights to the assets traced.

191. Lord Steyn then referred to an essay by Professor Birks, "The Necessity of a Unitary Law of Tracing" in Cranston (Ed), "Making Commercial Law, Essays in Honour of Roy Goode" (Clarendon 1997), an analysis his Lordship described at 113C as "crystalline". In that essay, in a passage cited by Lord Steyn, Professor Birks stressed at page 258: "The process of identification thus ceases to be either legal or equitable and becomes, as is fitting, genuinely neutral as to the rights exigible in respect of the assets into which the value in question is traced." Lord Steyn endorsed that view at 113E:

I regard this explanation as correct. It is consistent with orthodox principle. It clarifies the correct approach to so-called tracing claims. It explains what tracing is about without providing answers to controversies about legal or equitable rights to assets so traced.

192. As I read that, Lord Millett was therefore endorsing Lord Steyn's view that a single rule for tracing was "orthodox principle" and that Professor Birks was simply clarifying "what tracing is about".
193. Lord Millett also agreed with the views expressed by Professor Smith in "The Law of Tracing" (Oxford University Press, 1997). In one of the passages to which Lord Millett expressly referred Professor Smith observed, at page 123:

An examination of the history of this idea [separate rules of tracing in law and equity] shows that it must be regarded not only as illogical, but also as unsupported by authority. All of the cases commonly cited in support of it are not concerned to impose prerequisites to the exercise of tracing, but rather to the ability of a plaintiff to assert equitable proprietary rights in the traceable proceeds of the plaintiff's value.

194. Professor Smith's argument, with which Lord Millett apparently agreed at least in principle, was not simply that there should be no distinction between law and equity; it was that there was no such distinction.
195. The editors of "Goff & Jones" The Law of Unjust Enrichment" (10^th Ed, Sweet & Maxwell) endorse that approach at 7-18:

These objections to the traditional view are now of subsidiary importance, however, following Foskett v McKeown, where Lord Steyn and Lord Millett both said that there is now only one set of tracing rules in English law, applicable to common law and equitable claims alike. Their comments on this point were obiter, but it seems likely that they will be followed in future cases.  Developing the law in this way would certainly be desirable in principle. In the past, the courts have discovered fiduciary relationships between the parties to litigation, not because their relationship was of the sort that would normally attract the imposition of fiduciary duties, but because the courts have wished to let the claimant take advantage of the "equitable" tracing rules. …Instrumental findings of this sort debase the currency of the fiduciary concept.

196. Given the passages of Foskett to which I have referred, I have considerable sympathy with that view. None of this appears to have been addressed before HHJ Bird, and for that reason I am cautious about relying on his clear statement of principle without more.
197. In my view there is more, however. Foskett was considered by Rimer J as he then was in Shalson v Russo [2003] EWHC 1637 (Ch) at [103]-[104]. He placed particular emphasis on Lord Millett's comment that Foskett itself was "not, however, the occasion to explore these matters further" and concluded at [104] that "it cannot be said that Foskett v McKeown [2001] 1 AC 102 has swept away the long recognised difference between common law and equitable tracing."
198. Importantly, in the recent Supreme Court decision in Byers Lord Burrows observed at [160]:

Lord Millett explained that tracing is neither a claim nor a remedy. Rather it is the process by which the law treats one asset as the substitute for another. The equitable tracing rules have traditionally been understood to be less restrictive than the common law tracing rules (e.g. in permitting tracing into a mixed fund) albeit that, not least because tracing is merely a process, drawing that distinction between common law and equitable tracing is hard to defend in principle (as was recognised in obiter dicta of Lord Millett and Lord Steyn in Foskett, pp 113, 128—129).

199. That, it seems to me, recognises an ongoing distinction between the legal and equitable rules for tracing. It also reflects conclusions that his Lordship had previously expressed academically; see, for example, Burrows, "The Law of Restitution" (3^rd Ed Oxford University Press 2011) page 124:

But, however unsound the historical basis for the difference between common law and equitable tracing may have been exposed to be, it does not follow that we now have fused tracing rules. Too much water has since passed under the bridge – including, relatively recently, the Court of Appeal in Agip (Africa) Ltd v Jackson and the House of Lords in Lipkin Gorman v Karpnale Ltd – for one to be able to assert that the most accurate interpretation of the law is that there is no difference between common law and equitable tracing.

200. In light of Shalson and the observations of Lord Burrows in Byers I am, with all respect to the editors of Goff & Jones, unable to accept that the obiter observations of Lord Millett and Lord Steyn have been followed in subsequent cases as Goff & Jones suggests. On the contrary, it seems to me that Mr Connell is right and that English law still recognises separate regimes for tracing in equity and at common law. It therefore follows that Agip (Africa) Ltd v Jackson is binding on me and tracing through a mixed fund is not possible at common law.

Was it possible to follow the USDT into the 82e6 wallet?

201. The reason why the common law will not permit following through a mixed fund was explained by Millett J as he then was in the first instance decision of Agip (Africa) Ltd v Jackson [1990] Ch 265 at 285D-F:

The common law has always been able to follow a physical asset from one recipient to another. Its ability to follow an asset in the same hands into a changed form was established in Taylor v. Plumer 3 M&S 562. In following the plaintiff's money into an asset purchased exclusively with it, no distinction is drawn between a chose in action such as the debt of a bank to its customer and any other asset: In re Diplock [1948] Ch 466, 519. But it can only follow a physical asset, such as a cheque or its proceeds, from one person to another. It can follow money but not a chose in action. Money can be followed at common law into and out of a bank account and into the hands of a subsequent transferee, provided that it does not cease to be identifiable by being mixed with other money in the bank account derived from some other source: Banque Belge pour l'Etranger v Hambrouck [1921] 1 KB 321.

202. His decision and reasoning were approved on appeal. In Trustee of the Property of F C Jones & Sons (Trustees) v Jones [1997] Ch 159 Millett LJ, as he then was, recognised at 169 that his reliance on Taylor had been misplaced, since although it was the decision of a common law court it had been decided applying the equitable rules. He confirmed that the broader point remained good law, however.
203. I have found that USDT is neither a chose in action nor a chose in possession but is, rather, a different class of asset to which property rights attach. As such, the fact that the common law does not allow a party to follow a chose in action is not, of itself, necessarily determinative in Mr Connell's favour. The question is how best to treat USDT for the purposes of following.
204. The Final Report at 6.28-6.29 noted the potential different characterisations of what happens to a crypto asset on transfer. The "extinction/creation" analysis posits that on transfer the existing token is destroyed and a new token, with a new output value, is created. The "persistent thing" analysis focusses, instead, on the token as a notional quantity unit that can be tracked as it passes through the system. As the Law Commission noted at 9.25-9.27, the extinction/creation analysis suggests that the asset could be traced but not followed; where the asset is a persistent thing, both are in principle possible.
205. As I understood it, the Claimant's case is that USDT is a persistent thing. Mr Bergin in closing referred me to the Tether White Paper, which notes that only Tether has the ability to destroy USDT. Moreover, in his evidence before me Mr Moore indicated that Tether had the ability to track each individual USDT.

Q. Just to be absolutely clear, once the funds are mixed in the 200,000 – so in this example, 200,000 is what you are following on to, but your original sum was 99,987, you are saying that 99,987 are captured within the 200,000 USDT.

A. Correct.

Q. You are not in a position to distinguish within the 200,000 where the 99-

A. No.

Q. - are located.

A. No. The only people who can do that, for example, is Tether themselves.

206. Mr Moore's answer was consistent with the Tether White Paper, which explains that it is possible to "Track and report the circulation of tethers" (page 6) and that the transactional history of USDT is "publicly auditable" (page 9).
207. In oral closing, Mr Connell resolved an apparent tension in Bitkub's position and confirmed that it supported the extinction/creation analysis. Bitkub did not consider that the USDT could be followed through a mixed fund. Mr Pinto's evidence was that USDT could not be individually identified, but he did not address what was said in the Tether White Paper. In his skeleton Mr Connell relied on Lipkin Gorman v Karpnale Ltd [1991] 2 AC 548 at 572 and Millett LJ's judgment in Trustee of the Property of FC Jones & Sons v Jones [1997] Ch 159 at 169 for the proposition that common law will not follow through a mixed fund. In Lipkin Gorman Lord Goff's point was premised on money being fungible. In Jones, Millett LJ referred to the observation of Lord Ellenborough CJ in Taylor v Plummer (1815) 3 M&S 562 at 575 that the right of ascertainment would fail "when the subject is turned into money, and mixed and confounded in a general mass of the same description".
208. Taking first the characterisation as USDT, I am conscious that the evidence before me is difficult to reconcile with the evidence that appears to have been before Trower J in Piroozzadeh, in which he noted the "possibly impossible" exercise of tracing USDT swept into a hot wallet. The matter was not explored with either expert and the evidence in support of both arguments is thin. On balance, however, the analysis of Mr Moore on this point seems to me to be in line with what is said by Tether itself. It therefore seems to me that USDT is better characterised as a persistent thing. That is also consistent with the approach I have adopted in respect of the proper characterisation of USDT as property. While aspects of the data strings change, acquiring a new output value, that is not what I have found to represent the relevant property. Rather, the property is both the data and the transactional functionalities associated with it. I do not understand those transactional functionalities to change on transfer – a USDT in the hands of the transferor has the same functionality as a USDT in the hands of the transferee.
209. That conclusion does not automatically mean that the USDT can be followed, but the questions are obviously somewhat linked. One of the reasons I consider USDT to be a persistent thing is that it maintains a distinct identity, even in a mixture. That makes it, for these purposes, more like a chose in possession than a chose in action. Moreover, while the tokens are fungible (Lipkin Gorman at 572) they are not mixed and confounded in a general mass of the same description (Jones at 169). As Goff & Jones notes at 7-23, the rules on following and fungible mixtures are designed to address an evidential uncertainty; where no such uncertainty arises they do not apply. Returning to Lord Millet's observation in Foskett at page 127B, in the context of USDT nothing in the circumstances dictates tracing over following.
210. The Final Report recognised at 9.27 that where a crypto-asset takes the form of a persistent thing, following might in principle be an option. I agree. The evidence before me suggests that the identity of the USDT was preserved despite mixing and could be evidenced. On that basis it seems to me that following should, in principle, be an option.
211. In saying that I keep in mind a point raised by Mr Connell from the Final Report at paragraph 6.92. That deals with the "innocent acquisition rule", addressing the question of when the defence of good faith purchase for value without notice will apply on transfers of crypto-assets. One possible basis for the defence is the extinction/creation analysis, since that gives rise to new property, not a transfer of existing, tainted property. It is not the only basis, however, as the Law Commission makes clear in that section of the Final Report. For reasons I go on to address I do not need to consider the degree of knowledge required for a good faith purchaser defence, and as such do not address that question in this judgment. Nothing I say here changes that; the knowledge aspects of good faith are simply not an issue before me. Moreover, and in any event, the proper characterisation of USDT is a factual question and one that I have had to decide on the basis of limited evidence.
212. I accept that in principle the USDT in this case could have been followed, including through different wallets used in the various Hops, even where those wallets contained or subsequently received USDT from other sources. The issue is a practical one. There was simply no evidence before me, from Tether Ltd or any other source, that would allow the exercise to be undertaken. Indeed, Mr Moore, in the passage of his cross-examination I have quoted above, recognised as much: he was not in a position to say with certainty how much, if anything, of any given sum was Mr D'Aloia's USDT.

Methods of tracing

213. Both parties agreed that in principle one approach to a case such as this was the rule in Clayton's case of FIFO. The question was a practical one – how realistic was it to apply FIFO, given the complexity of the fund flows through the various wallets involved in the Hops? The necessary corollary of that is that this is a case where Mr D'Aloia's funds were mingled with those of other innocent victims, because FIFO does not apply as between victim and wrongdoer ("Snell's Equity" (34^th Ed, Sweet & Maxwell) paragraph 30-058; Goff & Jones paragraph 7-53). That reflected Mr Moore's evidence that the wallets involved in the various Hops would contain the funds of other victims.
214. In terms of how one goes about tracing, Mr Connell referred me to Charity Commission for England and Wales v Framjee. A charitable trust suffered a shortfall between the sums held and the sums due but unpaid to designated charities. The Commission sought directions on the legal basis on which it should proceed. Henderson J, as he then was, addressed the options at [47]:

In principle, there are three techniques which could be applied in order to determine how the shortfall in the notional blended fund should be borne by the ultimate recipients, all of whom are equally blameless for the mismanagement of the Dove Trust which has led to the shortfall. The first technique is to apply the rule in Devaynes v Noble; Clayton's Case (1816) 1 Mer 572 whereby payments out of an account are attributed to payments into the account in the order in which the payments in were made, or in other words on a "first in, first out" basis. The second technique is to divide the remaining money between the recipients in proportion to the amounts which they are owed. This solution, where distribution is made on a rateable, or pari passu, basis, has frequently been adopted in recent years where the claimants on the fund are all the victims of a common misfortune. It also has the great advantage of being simple and inexpensive to implement. The third technique, which has been considered in a number of English authorities but never yet applied in practice in this jurisdiction, is to apply the "rolling charge" or "North American" methodology, which combines the pari passu approach with the lowest intermediate balance principle. Its effect is that the position has to be analysed whenever a payment is made out of the fund, and no contributor can be paid more than his rateable share of the lowest intermediate balance while his money remained in the fund.

215. He went on to state at [63]: "In short, I am satisfied that the court must in all normal circumstances make a choice between pari passu distribution on the one hand or the rolling charge method on the other hand, always assuming that it is appropriate to depart from the rule in Clayton's Case 1 Mer 572."
216. Mr Connell submitted that Henderson J's options were therefore the only routes open to Mr Moore and that Mr Moore had followed none of them, such that his evidence should have no weight.
217. Mr Bergin acknowledged that Mr Moore had not applied "strict FIFO". As I have noted, it seems to me better to avoid such a term (along with "customer FIFO") as having the potential to cause confusion. The fact is, Mr Moore did not apply what English law calls FIFO; Mr Bergin's point was that he was not required to. He referred me to Russell-Cooke Trust Company v Prentis (No 1) [2002] EWHC 2227 (Ch) at [55] and El Ajou v Dollar Land Holdings Plc (No.2) [1995] 2 All ER 213 at 222, noting that the rule in Clayton's Case was easy to displace. He submitted that Mr Moore had undertaken a somewhat similar exercise modified on the basis of his own experience and the training he received from Crystal Blockchain. He noted that Mr Pinto acknowledged that he would have used a similar, transactionally focussed approach.
218. I agree with Mr Bergin both that the rule in Clayton's Case can be displaced where it is appropriate to do so and that where it is displaced the parties are not limited to pari passu distribution or the rolling charge. That much is clear from Federal Republic of Brazil v Durant International Corpn [2015] UKPC 35. Mr Maluf senior was the mayor of Sao Paulo. He received bribes totalling US$10,500,055.35, which he paid into an account under the control of his son, the Channani account, over a four-week period from 9 January to 6 February 1998. In the period 14 to 23 January 1998 payments were made from the Channani account to an account held by Durant, and in the period 22 January to 23 February 1993 payments were made from the Durant account to an account held by Kildare. The Federal Republic sought to trace the c. US$10.5m to the Durant account and, from there, to the Kildare account. It faced difficulties in doing so in that (i) certain of the payments into the Channani account happened only after the final payment had been made to the Durant account; and (ii) payments were made from the Channani account to the Durant account that must, mathematically, have included money other than the bribes.
219. The Privy Council emphasised at [38]:

The development of increasingly sophisticated and elaborate methods of money laundering, often involving a web of credits and debits between intermediaries, makes it particularly important that a court should not allow a camouflage of interconnected transactions to obscure its vision of their true overall purpose and effect. If the court is satisfied that the various steps are part of a co-ordinated scheme, it should not matter that, either as a deliberate part of the choreography or possibly because of the incidents of the banking system, a debit appears in the bank account of an intermediary before a reciprocal credit entry. The Board agrees with Sir Richard Scott VC's observation in Foskett v McKeown [1998] Ch 265, 283 that the availability of equitable remedies ought to depend on the substance of the transaction in question and not on the strict order in which associated events occur.

220. A similar approach was adopted in Relfo v Varsani [2014] EWCA Civ 360. I will address the decision more fully in due course, but at this stage it suffices to note what was said at [57] on the relevance of intention:

I accept Mr Salter's submission that the intention of Mr Gorecia would not be enough in itself to make the Intertrade payment substituted property for the purposes of the tracing rules. However, intention can be relevant as a factor in the basket of factors from which the judge may draw an inference that it is in fact a substitution.

221. In my view it therefore is open to the Claimant, at least in the case of a claim involving fraud such as this one, to trace on a basis other than FIFO, pari passu and the rolling charge provided that it treated all innocent claimants and potential claimants comparably and was properly evidenced. I also recognise the conceptual clarity identified by Professor Cutts ("Tracing, value and transactions" (2016) 79 MLR 381) that might be achieved through a more transaction focussed approach.
222. In support of his tracing claim, Mr D'Aloia relies on Mr Moore's reports. Mr Moore has produced multiple reports in connection with this dispute. Two are relevant to this trial: the first was produced on 22 June 2022 at a time when he was working at Mitmark (the Mitmark Report); the second was the Arrowsgate Report produced for use at the trial at a time when he had started his own firm. There are a number of fundamental differences between those reports:

i) The Mitmark Report was part of an investigation, carried out by Mr Moore, to identify those behind td-finan and to determine where Mr D'Aloia's funds appeared to have gone. The Arrowsgate Report was a report prepared for trial in support of claims Mr D'Aloia wished to advance against the defendants, including Bitkub, and purported to trace exact sums to individual parties.

ii) While at Mitmark, Mr Moore principally used blockchain analysis software called TRM Labs. However, he was not permitted to use the TRM Labs' output in court for reasons connected to the licensing agreement, so he also used other systems including Crystal Blockchain, Etherscan and Ethplorer; at Arrowsgate he only used Crystal Blockchain. Although both TRM Labs and Crystal Blockchain are aimed at the same end, they obviously work in different ways because when it was put to Mr Moore that the amount he claimed to trace to the 82e6 wallet had fallen significantly between the Mitmark and Arrowsgate Reports, he identified the initial use of TRM Labs as a key factor behind the need to change his conclusions.

iii) The Mitmark Report was not intended to be (and was not) compliant with CPR 35; the Arrowsgate Report was intended to be CPR compliant.

223. Central to the criticism of Mr Moore is whether the methodology he used was recognised as a means of tracing in English law. As I have also noted, there is a question of whether Bitkub's case was properly put to Mr Moore. Given the way the case developed, and how much turns on his evidence, it is important to address this in some detail.
224. Mr Moore's evidence at trial on his methodology can, I think, fairly be said to be summarised by the following answer:

So as I have stated to you, I'm not a forensic accountant and my understanding of the FIFO methodology is – you know, in terms, accountancy terms, is incorrect. My – I'm understanding of the FIFO (inaudible) when I wrote the report is the first in were the client's funds and the first out of the client's funds is what I have not put in the report and I have described the FIFO side of things. I have then, before and after, in section 11 of my report, laid out my methodology, the examples that you have just gone through.

225. Mr Moore's position was that he had applied the right approach but used the wrong label for it. He was never applying FIFO, he was doing something more nuanced.
226. The starting point is what Mr Moore said he was doing. That was described by Giambrone & Partners in a letter dated 16 November 2023, around a month before the service of experts' reports, in the following terms:

3. The Claimant relies on the evidence of Mr Robert Moore who used the industry recognised methodology of First In First Out (FIFO). The FIFO methodology makes certain that Mr Robert Moore maintained visibility of the Claimant's funds throughout the tracing exercise. The methods of movement of the Claimant's stolen USDT was via a criminal network of laundering, using addresses to attempt to obfuscate the origins and destinations.

4. Mr Robert Moore has already previously addressed the issue of whether any pre-existing balances in the intermediate public addresses or intervening transfers of USDT into or out of the intermediate public address prior to the alleged transfer out of the Claimant's USDT. [sic] Irrespective of the starting/finishing balances of the intermediary addresses, they are all directly linked to stolen funds from the Claimant.

227. I read that as saying Mr Moore was using FIFO. The second point, I am obliged to say, I found unclear. It becomes relevant later because it appeared to change.
228. In the Arrowsgate Report Mr Moore set out a diagrammatic overview of his approach. This described the process he had used to identify Mr D'Aloia's USDT as being "Followed using FIFO". It further noted "Common links of received criminal funds confirms FIFO methodology."
229. This was repeated in the methodology section of the Arrowsgate Report. There, Mr Moore emphasised:

The challenge of unmasking individuals behind anonymous cryptocurrency transactions, especially when mixing services are involved, is a critical aspect of financial investigations related to organised crime groups (OCGs). The First-In-First-Out (FIFO) methodology plays a pivotal role in this process, particularly in identifying 'last hops' where cryptocurrencies are converted to cash.

230. Mr Moore referred to an article that was said to expand on how FIFO was instrumental but no citation was provided. He went on:

Legal and Forensic Strength: FIFO is not only an established accounting principle but also holds forensic value in financial investigations. Courts and regulatory bodies often recognise FIFO-based findings due to its logical and methodical approach.

231. Pausing for a moment, the reference to courts recognising FIFO can, I think, only sensibly be to the rule in Clayton's Case. Mr Moore continued:

The FIFO methodology is crucial in tracing cryptocurrency transactions through mixing services to last hops, where the conversion to cash or other assets occurs. This approach not only simplifies the complex tracing process but also provides a legally and forensically sound basis for identifying individuals behind anonymous crypto addresses. As the digital financial landscape evolves, the application of FIFO in conjunction with other investigative methods remains an essential tool in the fight against cryptocurrency-based money laundering by OCGs.

232. He then referred to a number of articles. Several of these related to US tax on crypto-asset based capital gains. That is somewhat different to the situation faced by Mr D'Aloia. There, all the assets are held by the same person and the question is simply how to identify the base price of the asset when calculating the gain – is it the cost of the last asset purchased, the first asset purchased, etc. There is no question of mixing in the sense that it arises here, nor is there the need to allocate losses between equally innocent victims. In contrasting FIFO with LIFO (last in first out) and HIFO (highest in first out) the articles were relevant in showing that Mr Moore's reference to FIFO was to that term as it is used in Clayton's Case, but otherwise did not add a great deal.
233. One reference was much more on-point, however, an article from wired.com from 5 April 2018 titled "A 200-Year-Old Idea Offers a New Way to Trace Stolen Bitcoins", which dealt with research by Professor Anderson, a computer scientist at Cambridge University. Since this forms the basis of Mr Moore's methodology, it is worth quoting the salient parts of the article:

But when Anderson mentioned this problem in January to David Fox, a professor of law at Edinburgh Law School, Fox pointed out that British law already provides a solution: An 1816 precedent known as Clayton's Case, which dealt with who should be paid back from the remaining funds of a bankrupted financial firm. The answer, according to the presiding judge, was that whoever put their money in first should take it out first. The resulting first-in-first-out—or FIFO—rule became the standard way under British law to identify whose money is whose in mixed-up assets, whether to resolve debts or reclaim stolen property.

So Anderson and his team of researchers started to consider what that rule would look like applied to Bitcoin's blockchain. Mix up a dirty coin and nine clean ones in a laundry address or exchange, and all 10 coins that came out would be defined by the same order they went in—even if that order was just a millisecond's difference in which transaction was written to the blockchain's record first. If the first bitcoin to go into the mix were stolen, the first to come out of the mix would be considered that same coin, and thus still stolen. "It allows us to see through the great majority of the algorithms people use to try and mix and obscure the origins of bitcoin transactions," says Anderson.

And doesn't that essentially make bitcoin laundries into reverse lottery systems, where an arbitrarily chosen person ends up holding a stolen coin that might be claimed back by a theft victim? Anderson argues that the principle has worked for centuries as part of British law. And if innocent users end up having their coins claimed as stolen property, they'll quickly learn to stay away from Bitcoin laundries and shady exchanges. "One unlucky person is going to end up holding the stolen bitcoin," Anderson says. "If you're not the person who went in with the stolen bitcoin in the first place, you're never going to play that game."

… The legal basis for FIFO, particularly in the US, also isn't quite as simple as the Cambridge researchers describe, says University of Texas law professor Andrew Kull. In some cases, judges instead use pro rata tracing – the haircut approach in which all the mixed accounts hold a proportional amount of the tainted assets – or a technique called "Jessel's Bag," which takes money from guilty parties before innocent ones.

And how ownership tracing works in practice can depend on myriad factors like the statutes of a particular state, the decisions of a judge, and whether the asset is defined as money or as a commodity, which is hardly a simple question in the case of Bitcoin. FIFO is "just a convention. It doesn't have any inner logic to it at all," Kull points out. "It's arbitrary, but it's as good as anything else between two people who are innocent."

Arbitrary as it may be, FIFO does have hundreds of years of legal history behind it, the Cambridge researchers argue. And given how powerful it may be as a mechanism for sorting out mixed-up bitcoins, it could be only a matter of time until someone applies that precedent to try to claim their stolen stash.

234. Mr Moore also provided a link to the research paper of Professor Anderson, Dr Shumailov and Dr Ahmed-Rengers referred to in the article.
235. It seems to me clear that the basis stated in the Arrowsgate Report for tracing Mr D'Aloia's funds was the rule in Clayton's Case. That is obvious from the wired.com article and the research paper to which it refers. While Mr Moore made reference to his use of Crystal Blockchain, he did not suggest that it applied a different approach to FIFO. On the contrary, he suggested they were the same. For example, at paragraph 22.4 of his report Mr Moore stated: "An overview of the movement of misappropriated funds, using FIFO methodology (See section 11 of this report), is shown below, from left to right." There followed a diagram that is said to be derived from Crystal Blockchain. Mr Moore then continued to expand on the use of FIFO.
236. Mr Bergin submitted that it could be seen from the methodology section of Mr Moore's report that he was not using FIFO. He referred, in particular, to two paragraphs.
237. The first was 11.3. Having given a simple example showing 9.4 Ethereum being paid into and then out of a wallet, Mr Moore stated:

The next transaction out is identified as the highly probable route the misappropriated funds take. Once I have identified an inbound payment, such as that in green, I have assessed that the following outbound transaction I see, in chronological order, is that cryptocurrency which was paid in.

238. The difficulty with that reference is that the example is so simple (one payment in, one payment out) that it is both obvious what you would trace and is, in any event, an example of FIFO.
239. The second is 11.7 (my emphasis):

Quite often, there will be a delay by the mixing service before funds are sent to the following address in the chain. Funds will then stack up, from other unknown sources, before the next outbound transaction. In this scenario, the next outbound transaction that is the same or more is followed. Examples of these follows will be shown on the coming pages in this report. These delays maybe by design when run automatically (pre scripted), or due to the mixing addresses being controlled manually.

240. The highlighted text plainly is not consistent with FIFO. That is, however, one line in the methodology section; the broader methodology section refers explicitly to FIFO and, by reference, to the use of the rule in Clayton's Case. References to FIFO feature throughout the Arrowsgate Report.
241. While Mr Moore said he was using FIFO, I accept it was never the approach that he in fact attempted to apply. That is apparent on a number of levels.
242. The first, and most obvious one, is the flow of funds itself. Mr Connell took me, in opening, and Mr Moore, in cross examination, through Hops 6 and 7 at some length. The starting balance in the 6E52 wallet was slightly over USDT 781,000. On 17 February at 9:18am, USDT 183,000 said to contain the funds of Mr D'Aloia were received into the wallet (Hop 6). At 9:52am USDT 18,731 was paid out, followed by a receipt of USDT 5,433 at 10:00am. There was a further payment out of USDT 31,000 at 10:04am. Finally, at 11:01am a further USDT 500,000 was received into the wallet. On a FIFO basis approximately USDT 730,000 of the starting balance therefore remained in the wallet at this point. At 4:58am on 18 February USDT 400,000 was transferred out (Hop 7), and that amount is said by Mr Moore to include Mr D'Aloia's funds. On a FIFO basis that is obviously wrong; the USDT 400,000 would be attributable to the starting balance, not the USDT 183,000 receipt the previous day.
243. Secondly, in response to a question asked by Binance Mr Moore explained on 5 July 2022 (my emphasis): "MITMARK chose to trace the 195,649 USDC in Serial 8 due to it being the closest match to the amount lost by the client (which is 229,400 USDC – See Annex A, Serial 8)." FIFO is not about choice – it is a mechanical exercise. That answer predated the Arrowsgate report by around 18 months.
244. Thirdly, following the meeting of experts a "joint statement" was prepared on 6 March 2024. As I have noted, it was really two statements, one from each expert, but in his section Mr Moore at 2.6, 2.14 and 2.17 made clear that he had not used the FIFO methodology as understood by Mr Pinto (whose understanding of FIFO was correct). He further explained (at 2.6) that the methodology he adopted was "taught and followed by Crystal Blockchain and other tooling I have used, including TRM Labs", although he did not expand on what that methodology or methodologies was or were.
245. Finally, in the Claimant's Responses to the Sixth Defendant's Questions to Mr Robert Moore on 19 April 2024, the Claimant confirmed (my emphasis):

Upon meetings between Mr Moore and Mr Pinto, before drafting the Arrowsgate Report, the FIFO methodology was refined, hence the difference between the Mitmark Report and the Arrowsgate Report in the amount of USDT followed to the Bitkub wallet ending 82e6.

After the exchange of the Expert Reports in December 2023, there was additional correspondence and meetings between the Experts, whereby the application of the FIFO methodology was further refined.

246. It remained unclear what the "refinement" was but since FIFO is a mechanical process, it was obviously not consistent with the rule in Clayton's Case.
247. While it was by this stage clear that Mr Moore had not used FIFO, it was not clear what he had done. Giambrone & Partners wrote to Quillon Law on 31 May 2024 attempting to explain Mr Moore's methodology. As I have noted, this was a matter of days before trial. No revised report was served; Mr Moore agreed only in the course of his cross-examination that the letter accurately reflected the approach he adopted. In their letter Giambrone & Partners stated:

8. Mr Moore has explained on several occasions that a "strict FIFO" approach is not possible in this case. He usually traces the funds by applying the following procedure, as demonstrated in the Joint Rubin/Moore statement:

i. He does not take account of opening balances.

ii. He does not take account of intermediate incoming transactions.

iii. He ignores outgoing transactions of 1,000 USDT or less.

iv. He looks for the largest outgoing transaction next in time rather than the next in time transaction.

9. This is the procedure taught by Crystal in the use of its software. There is, we understand, no commercial tracing software that applies a strict FIFO approach. Mr Rubin [Binance's expert in these proceedings] did his work manually and he was able to complete the task as the wallets concerned had few transactions. In most cases involving fraudulent cryptocurrency transactions, as in the case of Bitkub, the wallets have had many months of transactions, and in some cases years, and the transactions can run to thousands. It is not feasible, in such circumstances, to obtain or work from opening balances and intermediate incoming and outgoing transactions.

248. There are a number of issues with this.
249. First, while I accept that Mr Moore had by this stage made clear that he did not use FIFO, as I have noted, the Arrowsgate Report advanced as its rationale the rule in Clayton's Case. The article in wired.com and Professor Anderson's research to which Mr Moore refers in support of his approach could not be any clearer. Leaving aside the confusion that was bound to be caused in purporting to use FIFO if Mr Moore was always intending to use a different approach, it means that the arguments he advanced in the Arrowsgate Report as to the strength of FIFO do not offer any support for his actual approach.
250. Secondly, Giambrone & Partners purported to describe how Mr Moore "usually traces the funds". That suggests that Mr Moore has other methodologies; nothing is said about how he selects between them, yet where there is a range of opinions PD 35 paragraph 3.2(6) requires the expert to say what they are and to give reasons for his opinion.
251. Thirdly, the only justifications he now offers for the approach he adopted are that it is taught by TRM Labs and Crystal Blockchain and in his experience it better reflects the practices of organised crime groups. As I have noted, TRM Labs' approach produces a significantly different figure to that produced using Crystal Blockchain, so it is not clear how two different approaches are both likely to reflect the approach of those behind td-finan. The issue is compounded because, as Mr Moore recognised himself at paragraphs 2.2 and 2.4 of the joint statement of the experts, the methods of organised crime groups are unknown and unknowable save in the rare cases where arrests are made. It is therefore difficult to understand the basis on which he selected between Crystal Blockchain and TRM Labs (or, indeed, any other system), given that evidential gap.
252. Fourthly, and relatedly, in closing Mr Bergin submitted that the experts work in broadly the same way but use different systems. Accepting that, there is obviously a range of opinion as to which system is best, which may depend on the particular circumstances of the individual case. As I have noted, Mr Moore himself has used two different systems in this case. Yet nowhere does he explain how he selected between them, or how he came to prefer those systems, and ultimately Crystal Blockchain, over any other system. Again, it seems to me that he was required to explain this under PD 35 paragraph 3.2(6).
253. Fifthly, and again somewhat relatedly, there is a question as to how far the process is driven by the system as opposed to the expert. The thrust of Mr Moore's evidence was that much of the work was done by the software; Mr Pinto said there was a significant subjective element to his work. In my view Mr Pinto's evidence was significantly stronger on this point and reflects what Mr Moore has previously said. As I have noted, in his answer to Binance on 5 July 2022 he stated that he "chose to trace the 195,649 USDC"; that is consistent with Mr Pinto's description of the expert's role. At that time Mr Moore would have been using TRM Labs, or a combination of TRM Labs and Crystal Blockchain, but he gave a similar answer on 19 April 2024 – "the FIFO methodology was refined" – at a time when he was solely using Crystal Blockchain. Finally, in his cross-examination Mr Moore explained that one of the changes made to the amount claimed in these proceedings resulted from him changing his approach to the use of the system. Crystal Blockchain has a function that allows the user to switch between seeing the next transaction in time or, alternatively, the closest outbound transaction to the inbound transaction. The outcome, therefore, is not determined by the system, it is determined at least in this respect by the operator's choice. I do not know, because Mr Moore has not explained, what other choices he must make, how he makes them or why.
254. Sixthly, the Giambrone & Partners letter stated that at stage (iv) one looks for the largest outgoing transaction next in time. That was not the answer given to Binance in July 2022 – there Mr Moore said that he looked for "the closest match to the amount lost by the client". Again, I recognise that at the time Mr Moore was using TRM Labs, but if that is the justification for the different approach it simply ties back to my point above that I do not know, because Mr Moore has not explained, why he shifted from TRM Labs to Crystal Blockchain. At paragraph 11.7 of the Arrowsgate Report, when he was using Crystal Blockchain, he stated that "the next outbound transaction that is the same or more is followed." Patently, those are not different ways of phrasing the same concept, as I will address by reference to the figures in this case in a moment. Yet all three versions were given pursuant to some form of statement of truth or adopted by Mr Moore during his cross examination.
255. Seventhly, it is unclear how Mr Moore, using this methodology, could have traced funds in the way that he did for Hop 2. Mr Connell submitted, and I accept, that this is fundamental to Mr D'Aloia's case against Bitkub: given the way that he puts his case, if he cannot show that his funds were part of the USDT 326,868 then what happens thereafter is irrelevant because Mr Moore would be tracing somebody else's funds. Applying Mr Moore's methodology in its various iterations:

i) The 1dDA wallet is treated as having a zero balance prior to Hop 1. I note at the outset that this is a somewhat odd assumption to my mind, in that the bulk of the funds in that wallet seem to have come from Mr D'Aloia's Coinbase account, or at least from the same Coinbase counterparty address as was used to transfer the USDT 999,987.1. The fact that other funds in that wallet came from Mr D'Aloia seemed to be the rationale advanced for Mr Moore's approach in Giambrone & Partners' 16 November 2023 letter, albeit if that was the case they were wrong, in that some funds come from other sources. In any event, whatever the rationale was, on 10 January 2022 the 1dDA wallet received USDT 999,987.1 from Mr D'Aloia which, for the purposes of Mr Moore's methodology, became the wallet balance.

ii) You ignore incoming transfers (and again, I note that some but not all of these seem to have come from the Coinbase account associated with Mr D'Aloia).

iii) You also ignore outgoing transfers of less than USDT 1,000 (of which there were none).

iv) The next stage is unclear because, as I have said, there are different, contradictory iterations of it. None of them work:

a) The largest outgoing transaction next in time is the USDT 510,000 on 22 January 2022. Giambrone & Partners' letter (and so in turn Mr Moore's evidence in cross-examination) is not clear about what happens to the remaining funds still sitting in the 1dDA wallet.

b) The closest single match to the amounts lost by Mr D'Aloia is also USDT 510,000. A combination of the three payments on 21 and 22 January 2022 (totalling USDT 920,000) is significantly closer and the process of combining payments out is consistent with the Arrowsgate Report at 22.5, which states that "The next 5 transactions out were followed to get closely [sic] as possible to the total combined amount of these serials." It is not wholly clear whether Mr Moore's reference to "these serials" is to just the USDT 999,987.1 or to that amount and the further payments of USDT 100,714.46 and USDT 99,945.03 (a total of USDT 1,200,646.49), but nor does it matter. The next four transactions out total more than the USDT 999,987.1 paid in and the next five total 1,258,121. The USDT 326,868 that was traced was the sixth payment out so should not have been traced, at least for these purposes, in any event.

c) No outbound transaction is the same as or more than Mr D'Aloia's payment in (and very obviously, USDT 326,868 is not the same as or more than USDT 999,987.1).

256. In saying all this I appreciate, as I have noted, that the USDT 999,987.1 was not the only sum paid by Mr D'Aloia into the 1dDA wallet. On the contrary, the bulk of the funds paid into that wallet seem to have come from the same Coinbase account, which I understand means they came from Mr D'Aloia. That is not the point. The question is how Mr Moore traced the USDT 999,987.1 into the USDT 326,868 at Hop 2. It does not appear to be through any of his stated methodologies; the numbers do not add up.
257. One sees further difficulty applying the methodology to later Hops. As I have noted, Hop 6 was a payment into wallet 6E52 of USDT 183,000 on 17 February at 9:18am. There then followed a further receipt of (non-Claimant) USDT 500,000 the same day at 11:01am. Hop 7, which Mr Moore traced, was a payment out of the wallet of USDT 400,000 at 4:58am on 18 February. Applying stage (iv) of Mr Moore's methodology, the USDT 400,000 is (a) the largest outgoing transaction next in time in respect of both the USDT 183,000 and the USDT 500,000; (b) a closer match to the USDT 500,000 than the USDT 183,000; but (c) even though it is significantly closer in value, the USDT 400,000 is not the same as or more than USDT 500,000 but it is more than USDT 183,000.
258. Mr Moore ultimately made clear that he ignores incoming transfers. That rule presumably takes precedence over stage (iv) of his methodology, since otherwise he would have tied the USDT 400,000 outbound payment to the USDT 500,000 receipt. His reasons for that are not stated, which is an issue in itself, but it also produces an odd result in practice. Because (and only because) he is acting for the party tracing the USDT 183,000, the USDT 500,000 is ignored (as in intermediate receipt) and the USDT 400,000 paid out relates to the USDT 183,000 receipt; whereas if he were acting for a party tracing the USDT 500,000, his methodology would tell him that that the USDT 183,000 had to be ignored (as an opening balance) and the payment out of USDT 400,000 related to the USDT 500,000 receipt. It is not clear how that approach could reflect the methodology of the organised crime group behind the td-finan fraud; whoever controlled that wallet had one methodology, and its identification should not depend purely on whose case Mr Moore is advancing. As the point was put in Durant International at [38]: "the availability of equitable remedies ought to depend on the substance of the transaction in question and not on the strict order in which associated events occur."
259. These issues were not directly put to Mr Moore in these terms but nor, on balance, do I consider that they needed to be. On the question of fairness, Mr Moore's ultimate methodology was first set out a week before trial and was only formally adopted as his evidence in the course of his cross-examination. From Giambrone & Partners' letter there appears to be a range of methodologies that Mr Moore uses but, in apparent breach of PD 35, no explanation of how he settled on his current approach for this case. In further apparent breach of PD 35, the material upon which he claims to have relied from Crystal Blockchain has not, so far as I am aware, been disclosed. There is no explanation of how Mr Moore chooses between systems, nor is there any explanation of how he chooses which options to employ within Crystal Blockchain (or even what those options are), again in breach of PD 35. Finally, and again as I have noted, his methodology was described in three different places and in three different, contradictory ways. In such circumstances, I think the somewhat more general terms in which Mr Moore was challenged – to the effect that his methodology lacked coherence or a principled basis – gave him ample opportunity to expand upon and explain his analysis. In fact, when he was challenged on the figures he referred to his broader mission to identify those behind the td-finan fraud. I have no reason to think he would have engaged with the figures I have worked through above had they been put to him.
260. More to the point, the question appears to be largely a mathematical one. Simply as a matter of arithmetic, USDT 920,000 is much closer to USDT 999,987.1 than is USDT 326,868 and USDT 326,868 is not the same as or more than USDT 999,987.1. Likewise, USDT 400,000 is closer to USDT 500,000 than it is to USDT 183,000, and the outcome at Hop 7 depends on whether Mr Moore is acting for the party tracing the USDT 183,000 or the party tracing the USDT 500,000. It is hard to see how Mr Moore could have contradicted that had the point been put to him.
261. Eighthly, there is a question of how appropriate that methodology is as a means of tracing by reference to the concern referenced in Foskett, and indeed repeatedly elsewhere, that there is no good reason why one innocent victim should be favoured over others. FIFO is considered acceptable because while it is arbitrary, it is equally arbitrary to all parties. Similarly, pari passu distribution does not favour one party over another. Mr Moore's approach seeks to ignore the funds of other innocent victims, both in terms of pre-existing balances and incoming funds. It then seeks to trace into the largest sums, which improves the prospects of recovery by minimising leakage at each stage. But it seems to do so by favouring Mr D'Aloia over other victims of fraud.
262. Finally, there is a question about how reliable the approach and its application have been. As I noted at the outset of this judgment, the claim against Aux Cayes Fintech has been struck out. That was a result of shifts in Mr Moore's conclusions that meant that the wallet into which he had traced Mr D'Aloia's funds in fact contained none of Mr D'Aloia's USDT. Similarly, in this claim, the amount sought is now less than half the original amount, again a result of shifts in Mr Moore's conclusions. Mr Connell submitted that in the circumstances this, in itself, casts doubt on the reliability of Mr Moore's conclusions. In light of the lack of transparency of Mr Moore's methodology, I agree that it does.
263. I accept, and indeed Mr Connell I think accepted, that FIFO can be disapplied. That does not give Mr Moore a free hand, however. It was important to understand his methodology and why, in his view, it was reliable. Instead, he explained why FIFO was reliable in circumstances where he had employed a different approach, the details of which were not really set out until immediately before trial and even then in only broad and contradictory terms that are impossible to apply to the transfers in issue in this case. Mr Bergin noted that Mr Rubin had carried out a FIFO approach in his report and that "strict FIFO" and "customer FIFO" produced similar results in relation to the Binance wallets. For the reasons I have set out, they do not produce similar results here. I needed to understand why I could rely on Mr Moore's approach. I was never able to do so. Mr Moore did not even attempt to explain the basis for his methodology, or how he made the various choices that he obviously had to make.
264. I therefore do not accept that Mr Moore's evidence reliably demonstrates any flow of Mr D'Aloia's funds to the 82e6 wallet. That is fatal to Mr D'Aloia's claims against Bitkub so far as they rely on tracing. Even though I accept that Ms Hlangpan was involved in, or fronted for those involved in, fraudulent or illegal activity, I cannot properly conclude that the fraudulent activity in which she was involved included the fraud perpetrated on Mr D'Aloia.

Unjust Enrichment

265. The parties agreed that there are four questions that I need to answer in addressing the unjust enrichment claim, and both referred me to the speech of Lord Steyn in Banque Financière de la Cité v Parc (Battersea) Ltd [1999] 1 AC 221 at 227A-B:

i) Has the defendant been benefitted, in the sense of being enriched?

ii) Was the enrichment at the expense of the claimant?

iii) Was the retention of the enrichment unjust?

iv) Are there any defences?

266. Mr Bergin highlighted the observations of the Supreme Court in Investment Trust Companies v HMRC [2017] UKSC 29 at [41]-[42]:

41. …Lord Steyn's four questions are no more than broad headings for ease of exposition. They are intended to ensure a structured approach to the analysis of unjust enrichment, by identifying the essential elements in broad terms. If they are not separately considered and answered, there is a risk that courts will resort to an unstructured approach driven by perceptions of fairness, with consequent uncertainty and unpredictability. At the same time, the questions are not themselves legal tests, but are signposts towards areas of inquiry involving a number of distinct legal requirements. In particular, the words "at the expense of" do not express a legal test; and a test cannot be derived by exegesis of those words, as if they were the words of a statute.

42 The structured approach provided by the four questions does not, therefore, dispense with the necessity for a careful legal analysis of individual cases. In carrying out that analysis, it is important to have at the forefront of one's mind the purpose of the law of unjust enrichment. As was recognised in [Menelaou v Bank of Cyprus [2015] UKSC 66] (para 23), it is designed to correct normatively defective transfers of value, usually by restoring the parties to their pre-transfer positions. It reflects an Aristotelian conception of justice as the restoration of a balance or equilibrium which has been disrupted. That is why restitution is usually the appropriate remedy.

Enrichment

267. After the close of the trial I was directed to the decision of HHJ Paul Matthews sitting as a judge of this Court in Terna Energy Trading v Revolut Ltd [2024] EWHC 1419 (Comm), which was handed down during the course of this trial. I received no submissions on it, but I found the learned Judge's analysis of the question of enrichment clear and insightful, and I was grateful for it. In the context of principal-agent cases he there makes the logical, and in my view correct, link between the question of enrichment and the defence of ministerial receipt: one can only say the agent has been enriched if he or she has a legal excuse for ignoring an instruction from the principal as to payment elsewhere (paragraph [66]). For reasons I go on to address, I consider that the mere crediting of Ms Hlangpan's account was not sufficient to establish the defence of ministerial receipt because the credit was provisional and could have been reversed; only payment away was sufficient. That, in turn, means that I accept that Bitkub was enriched by the payment at the point of receipt.
268. The approach to ascertaining whether the defendant's enrichment was at the expense of the claimant is driven by the decision of the Supreme Court in Investment Trust Companies. Lord Reed explained at [46]-[51]:

46. Situations in which the defendant has received a benefit from the claimant, and the claimant has incurred a loss through the provision of that benefit, usually arise where the parties have dealt directly with one another, or with one another's property. Common examples are the gratuitous payment of money, or provision of goods or services, by the claimant to the defendant, where there was no intention of donation. In such a situation, if the enrichment of the defendant is unjust – if, in other words, the transfer of value is defective in a sense recognised by the law of unjust enrichment – then the claimant is prima facie entitled to have the enrichment reversed.

47. There are, however, situations in which the parties have not dealt directly with one another, or with one another's property, but in which the defendant has nevertheless received a benefit from the claimant, and the claimant has incurred a loss through the provision of that benefit. These are generally situations in which the difference from the direct provision of a benefit by the claimant to the defendant is more apparent than real.

48. One such situation is where the agent of one of the parties is interposed between them. In that situation, the agent is the proxy of his principal, by virtue of the law of agency. The series of transactions between the claimant and the agent, and between the agent and the defendant, is therefore legally equivalent to a transaction directly between the claimant and the defendant. Similarly, where the right to restitution is assigned, as in Equuscorp Pty Ltd v Haxton [2012] HCA 7; 246 CLR 498; 86 AJLR 296, the claimant stands in the shoes of the assignor, and is therefore treated as if he had been a party to the relevant transaction, and the defendant's enrichment had been directly at his expense. Another situation is where, as in [Relfo v Varsani], an intervening transaction is found to be a sham (para 121). Since the sham is created precisely in order to conceal the connection between the claimant and the defendant, it is disregarded when deciding whether the latter was enriched at the former's expense. So, in Relfo, Gloster and Floyd LJJ described the arrangements in question as being "equivalent to a direct payment" (paras 103 and 115). There have also been cases, discussed below, in which a set of co-ordinated transactions has been treated as forming a single scheme or transaction for the purpose of the "at the expense of" inquiry, on the basis that to consider each individual transaction separately would be unrealistic. There are also situations where the defendant receives property from a third party into which the claimant can trace an interest. Since the property is, in law, the equivalent of the claimant's property, the defendant is therefore treated as if he had received the claimant's property.

269. He concluded at [51]: "Where, on the other hand, the defendant has not received a benefit directly from the claimant, no question of agency arises, and the benefit does not consist of property in which the claimant has or can trace an interest, it is generally difficult to maintain that the defendant has been enriched at the claimant's expense."
270. For the reasons I have already given, as a matter of law Mr D'Aloia cannot trace through a mixed fund in support of his unjust enrichment claim. Even were tracing possible in principle, I have also found that Mr D'Aloia has not demonstrated that his funds can be traced to the 82e6 wallet as a matter of fact.
271. That is not the end of the enrichment analysis, however. Mr D'Aloia's case is that the 14 Hops were not true transactions but, rather, simply attempts to conceal the flow of funds. Mr Bergin referred me to Relfo and invited me to find that they were a sham, such that this was a case of a direct payment from Mr D'Aloia to Ms Hlangpan and, once the USDT were swept into the hot wallet, on to Bitkub.
272. Mr Connell cautioned against drawing such an analogy. Relfo was, he submitted, a very different case. Relfo was a company controlled and owned by Mr and Mrs Gorecia. Mr Gorecia had close links with the Varsani family; he made and managed investments on the family's behalf, and the family was a source of funding and loans for Mr Gorecia's business projects. In May 2004 Relfo owed £1.4 million to HMRC. On 5 May Mr Gorecia wrongfully caused Relfo to pay £500,000 to the account of Mirren at Rietumu Banka in Latvia. The payment left Relfo insolvent and it subsequently entered creditor's voluntary liquidation. Later the same day, Intertrade Group LLC transferred US$878,479.35 from its account with Ukio Bankas in Lithuania to Mr Varsani's account with Citibank in Singapore. This equated to £500,000 less a 1.3% charge. The Intertrade payment was, in turn, funded by two payments received by it, also on 5 May. On 13 May Mr and Mrs Gorecia received US$100,000 from Mr Varsani's Citibank account. However, Relfo was unable to show how the Relfo/Mirren payment was translated into the Intertrade payment. Nevertheless, Sales J as he then was found that Mr Gorecia had caused the Relfo/Mirren payment to be made intending that this would result in a payment to Mr Varsani. The Court of Appeal found that this amounted to a direct enrichment of Mr Varsani at Relfo's expense, even though there was no direct transfer from Relfo to Mr Varsani and the precise mechanism by which the transfers were made could not be shown. Floyd LJ noted at 115: "provided one focusses on substance and not on form, or as it is put in some of the cases, on economic reality, the facts of the present case showed that the arrangement by which Mr Gorecia benefitted and enriched Bhimji Varsani using Relfo's money were equivalent to a direct payment." He went on to emphasise at [121]:

The intermediate arrangements were therefore an elaborate façade to conceal what was in truth intended and arranged to be a payment for the benefit of Bhimji Varsani. There was however more than mere intention involved. The structure put in place by Mr Gorecia made it inevitable that the payment would be effected to Bhimji Varsani. There was no other purpose in the interim arrangements other than to conceal the true nature of the transaction. Mr Gorecia and the Varsanis were closely connected. There was no question of any intervening act of free will. There was no question of any of the intervening entities doing anything other than the bidding of Mr Gorecia.

273. Mr Connell focussed in particular on the similarities of the amounts of the Relfo/Mirren payment and the Intertrade payment, the prior dealings between Mr Varsani and Mr Gorecia and their association with individuals who had access to money-laundering vehicles. No such factors, he submitted, were present here.
274. In his novel Anna Karenina, Tolstoy made the now famous observation: "All happy families are alike; each unhappy family is unhappy in its own way." It has become known as the Anna Karenina principle, and applied by analogy in a number of fields. This, I think, is one of them. Legitimate transactions of course follow legal rules, notably those of the law of contract, and so inevitably have many features in common. Shams are often idiosyncratic because of the different ways that those who perpetrate them ignore or break the legal rules. The fact that one sham is dissimilar to another does not change the fact that it is a sham.
275. There certainly are differences between the current case and Relfo, but that does not in itself seem to me to be critical. In particular, Mr Moore's evidence as to the nature of crypto-currency frauds and the use of multiple hops to conceal the flow of funds was unchallenged. Indeed, Mr Pinto largely agreed with it. That is reflected in the facts. Bitkub accepts that td-finan was a fraud. As I have set out in the table at paragraph 80 above, once money started to move it did so quickly, passing through some wallets in a matter of seconds. All of Hops 2-13 completed in under 24 hours. No honest explanation for this was suggested. The fact that the amounts involved in many of the Hops changed is consistent with what Mr Moore said about the attempt to disguise the flow of funds.
276. Mr Connell further submitted that the only thing linking the First Defendant to Ms Hlangpan was Mr Moore's tracing analysis, and Mr Moore's tracing analysis was flawed. That, I think, takes the point too far. For the reasons I have given I consider that the Claimant has established a link between the First Defendants and Ms Hlangpan in terms of a flow of funds and that Ms Hlangpan was either actively involved in laundering funds or, possibly, was a money mule for the First Defendants.
277. What I do not accept is that the Claimant has shown that Ms Hlangpan was the off-ramp for his funds. This was a far more complex fraud than was Relfo, where there was one payment in and one payment out. Mr Moore recognised that it involved the funds of multiple victims being mixed at multiple stages, it obviously involved multiple sham transactions and the funds re-entered the fiat banking system through multiple off-ramps.
278. I recognise that sham and tracing are different ways of showing enrichment and there will be cases where one cannot trace but can show a sham and vice versa. On the facts of this case, however, there are common factors that are relevant to both exercises. Indeed, as I understand the Claimant's case, Mr Moore's reports support both his case on tracing and his case that there was, in truth, a direct payment from Mr D'Aloia to the 82e6 wallet once the sham transactions are ignored. That means that many of the issues I have identified with the tracing exercise resurface here:

i) Mr Moore says that his approach better reflects the practices of organised crime gangs, but as he acknowledges that those practices are unknown and unknowable.

ii) As I have noted, because Mr Moore's approach ignores "intermediate" incoming transfers, his answer depends on the party for whom he is acting. In this case, between Hop 6 and Hop 7 he ignored a receipt of USDT 500,000 and concluded that Mr D'Aloia's funds were captured in Hop 7. If he had been acting for the victim seeking to recover the USDT 500,000, he would have ignored Mr D'Aloia's funds (as part of the opening balance) and concluded that Hop 7 comprised somebody else's money. At the risk of stating the obvious, the modus operandi of organised crime groups is not, in reality, affected by the party for whom Mr Moore is acting.

iii) As I have also noted, step (iv) of Mr Moore's methodology has been framed in multiple different ways and produces multiple different outcomes.

iv) Mr Moore's methodology is said to be based on techniques taught by Crystal Blockchain and TRM Labs. For the reasons I have given, it is hard to see how it can be both, given that they gave different results.

279. In a complex fraud such as this, in order to demonstrate that Bitkub was enriched with Mr D'Aloia's USDT it is not enough simply to show that the Hops were shams. It must be shown why the sham transaction, for instance the payment from 1dDA to dcEO at Hop 2, was said to contain Mr D'Aloia's funds and not those of another victim. Indeed, one sees this with the changes in Mr Moore's evidence in respect of Bitkub. Mr D'Aloia's losses have not changed, nor have the 14 Hops, but the amount that Mr Moore now says ended up with Bitkub is less than half the amount he started with. The way the shams are penetrated is critical. For the reasons I have given, I do not accept that Mr Moore's evidence shows that any of Mr D'Aloia's funds reached the 82e6 wallet.

Unjust factor

280. Very little time indeed was devoted to this. The Amended Particulars of Claim put the basis for that claim in the following terms:

(iii) the enrichment was unjust as the USDT and USDC/Identifiable Cryptocurrency was misappropriated by the Persons Unknown without the Claimant's knowledge or consent; and

(iv) the Defendants' enrichment was at the expense of the Claimant who has been deprived of possession and enjoyment of his USDT and USDC, and at the expense of his legal title, making the enrichment unjust.

281. That plea was against all Defendants. A more specific plea against Bitkub was advanced in the Re-Amended Reply:

The Sixth Defendant was enriched as it received legal title to the 65,022 USDT at the expense of the Claimant's lost title, making the enrichment unjust in all the circumstances.

282. In the Claimant's skeleton argument for trial at paragraph 91 two unjust factors were advanced:

i) The payment was unauthorised, relying on High Commissioner for Pakistan v Prince Muffakham Jah [2019] EWHC 2551 (Ch) at [271].

ii) It is unjust for the recipient to retain money where the payer would not have paid had they known the true position, relying on Kleinwort Benson Ltd v Lincoln CC [1999] 2 AC 349 at 399C-D.

283. In High Commissioner for Pakistan, the unauthorised transfer was made by the former finance minister of Hyderabad ostensibly on behalf of the ruler of Hyderabad, the seventh Nizam. In fact, the Nizam had not authorised the payment to be made (paragraph [132] of Marcus Smith J's judgment). That was the basis for finding an unjust factor (paragraph [271]). I did not understand Bitkub to challenge that aspect of Marcus Smith J's judgment.
284. Here, there is no question of the payment by Mr D'Aloia being unauthorised; it was Mr D'Aloia's USDT and he made the transfer to td-finan. There is a suggestion in the skeleton that it is intended to refer to the payment away by Bitkub. It was not clear to me how an unauthorised payment by Bitkub could make Bitkub's receipt unjust, and the point was not developed in submissions.
285. What seems to me significant is the allegation, at paragraphs 19(iv) and 23 of the Re-Amended Particulars of Claim, to the effect that the transfer by td-finan through the Hops, was unauthorised. Those paragraphs were neither admitted nor denied (Re-Amended Defence paragraph 19). As I have noted, the evidence of Mr D'Aloia was not seriously challenged, however, and I consider that those paragraphs of the Re-Amended Particulars of Claim have been established.
286. I appreciate that the allegation was made in connection with the fraudulent misrepresentation claim against the First and Seventh Defendants. However, the reference to the USDT being "misappropriated" in the unjust enrichment claim can only, it seems to me, be to this. As Mr Bergin emphasised to me, statements of case plead facts, not law. It does not seem to me right, and if right it is a technical point that risks the just disposal of the case (UK Learning Academy at [47]), to say that the allegation of unauthorised conduct at paragraphs 19(iv) and 23, which is essentially not contested, cannot apply equally to the unjust enrichment claim. In my view, this factor was both pleaded and established.
287. A claimant need only establish one unjust factor, of course, such that it is not strictly necessary to consider the point on mistake. In case I am wrong in what I say above, however, I should address it.
288. Kleinwort Benson obviously is authority for the proposition that money paid under a mistake (in that case of law) can in principle be recovered in unjust enrichment. Again, the facts of that case are rather different to this one but, as is apparent from what is said by Lord Hoffmann at page 399, he was stating a general proposition not tied to the facts of the case.
289. There is no reference to mistake in the unjust enrichment sections of either the Re-Amended Particulars or the Re-Amended Reply. Mr D'Aloia does assert, at paragraph 27 of the Re-Amended Particulars of Claim, that he made the transfers he did because he was misled by td-finan. Again, his evidence on that point was not seriously challenged and Bitkub now accepts that Mr D'Aloia was a victim of fraud, such that the claim has been made out.
290. In my view that factual allegation is enough to allow Mr D'Aloia to assert mistake. Doubtless it could have been made much clearer, and I do not consider this point to be as clear as the point on unauthorised payment. However, the legal characterisation of a point is not a matter for statements of case, it is a matter for submissions. In my view Mr D'Aloia has done enough to allege that the payment was made under a mistake and to establish that unjust factor.

Defences

291. The second area of disagreement was the application of defences. Bitkub relies on good faith change of position, ministerial receipt and the alleged impossibility of counter-restitution.

Good faith change of position

292. In the course of his closing Mr Bergin noted that there was a question as to whether good faith change of position applied in the context of crypto-assets as a matter of law. I was not addressed on the point in any detail, but in recognising change of position as a defence to claims in unjust enrichment in Lipkin Gorman v Karpnale Ltd Lord Goff offered a broadly framed justification at page 579F: "where an innocent defendant's position is so changed that he will suffer an injustice if called upon to repay or to repay in full, the injustice of requiring him so to repay outweighs the injustice of denying the plaintiff restitution." The focus was not on the nature of the asset that comprised the enrichment but, rather, to the relative injustice as between the parties. That logic to my mind applies equally to crypto-assets, and accordingly in principle I do not see why the defence should not be available where claims are asserted in respect of them.
293. Lord Goff framed the defence in broad terms at page 580F: "…the defence is available to a person whose position has so changed that it would be inequitable in all the circumstances to require him to make restitution, or alternatively to make restitution in full."
294. In Niru Battery Manufacturing Co v Milestone Trading Ltd [2003] EWCA Civ 1446 the Court of Appeal considered the good faith element of the defence. Clarke LJ, as he then was, at paragraph [164] of his judgment approved the approach adopted by Moore-Bick J, as he then was, at first instance ([2003] EWHC 1032 (Comm) at [135]):

I do not think that it is desirable to attempt to define the limits of good faith; it is a broad concept, the definition of which, insofar as it is capable of definition at all, will have to be worked out through the cases. In my view it is capable of embracing a failure to act in a commercially acceptable way and sharp practice of a kind that falls short of outright dishonesty as well as dishonesty itself. The factors which will determine whether it is inequitable to allow the claimant to obtain restitution in a case of mistaken payment will vary from case to case, but where the payee has voluntarily parted with the money much is likely to depend on the circumstances in which he did so and the extent of his knowledge about how the payment came to be made. Where he knows that the payment he has received was made by mistake, the position is quite straightforward: he must return it. This applies as much to a banker who receives a payment for the account of his customer as to any other person: see, for example, the comment of Lord Mersey in Kerrison v Glyn, Mills, Currie & Co (1912) 81 LJKB 465 (HL) at page 472. Greater difficulty may arise, however, in cases where the payee has grounds for believing that the payment may have been made by mistake, but cannot be sure. In such cases good faith may well dictate that an enquiry be made of the payer. The nature and extent of the enquiry called for will, of course, depend on the circumstances of the case, but I do not think that a person who has, or thinks he has, good reason to believe that the payment was made by mistake will often be found to have acted in good faith if he pays the money away without first making enquiries of the person from whom he received it.

295. The position is the same in the case of alleged wrongdoing. Papadimitriou v Crèdit Agricole Corpn [2015] UKPC 13 concerned the attempt to recover proceeds of sale of a collection of furniture. The sale had been organised by Mr Symes, who had no title to the furniture and no right to sell it. He then laundered the proceeds through a series of offshore accounts before they arrived in an account with the bank. In considering the bank's duty to inquire Lord Sumption summarised at [33]:

The hypothesis is that the claimant has established a proprietary interest in the asset, and the question is whether the defendant has established such absence of notice as entitles him to assume that there are no adverse interests. The mere possibility that such interests exist cannot be enough to warrant inquiries. There must be something which the defendant actually knows (or would actually know if he had a reasonable appreciation of the meaning of the information in his hands) which calls for inquiry. The rule is that the defendant in this position cannot say that there might well have been an honest explanation, if he has not made the inquiries suggested by the facts at his disposal with a view to ascertaining whether there really is. I would eschew words like "possible", which set the bar too low, or "probable" which suggest something that would justify a forensic finding of fact. If even without inquiry or explanation the transaction appears to be a proper one, then there is no justification for requiring the defendant to make inquiries. He is without notice. But if there are features of the transaction such that if left unexplained they are indicative of wrongdoing, then an explanation must be sought before it can be assumed that there is none.

296. Because of the way that it was pleaded and presented, applying the law to the facts in this case is best taken in stages.
297. In the Re-Amended Particulars of Claim, the Claimant launched something of a pre-emptive strike on the good faith change of position defence at paragraph 37(v):

The Defendants do not benefit from the common law defence of change of position as (a) cryptoassets do not benefit from this defence and/or (b) the Defendants unconscionably received the USDT and/or USDC and/or the respective positions [sic] of the Identifiable Cryptocurrency, including the Exchange Defendants for the reason that they did not act in a commercially acceptable way.

298. Mr Bergin put some stress on Bitkub's conduct in allowing Ms Hlangpan to set up an account with what he characterised as minimal due diligence; this, he suggested, amounted to acting in a commercially unacceptable way. I had a number of issues with that submission.
299. First, it is not consistent with the Claimant's pleaded case. The Claimant in his Re-Amended Reply specified that:

it was imperative for [Bitkub] to seek an explanation as to the deposit of the 65,022 USDT, including by obtaining Know Your Client ("KYC") documentation from [Ms Hlangpan]. It did not seek these [sic] explanation and, as such, it was obvious by the absence of these explanation [sic] and documents that there was a possibility of impropriety and/or [sic] of the Claimant's interest.

300. The allegation was not that Bitkub failed to seek adequate KYC; it was that Bitkub did not seek any KYC. Bitkub addressed that allegation in its disclosure by producing the KYC material provided to it.
301. Secondly, if the Claimant had wanted to criticise the due diligence that Bitkub had carried out it needed to do so by reference to a standard. The starting point, at least in the written opening, was that English law rules on money laundering would apply unless foreign law were specifically pleaded, which it was not. That was not developed at all in the course of trial, nor were the English standards put to any of the witnesses. For the avoidance of doubt, I reject the argument. It seems to be founded on the Court of Appeal's decision in R v Rogers [2014] EWCA Crim 1680. That case involved alleged offences under the Proceeds of Crime Act 2003 and at least part of the defendant's alleged conduct took place in the United Kingdom. Bitkub's actions were carried out exclusively in Thailand. Nor does it work to point purely to the jurisdictional nexus that has resulted in Bitkub being before me. Bitkub could be subject to the jurisdiction of the English courts without being subject to English law, less still UK commercial practice.
302. There was no evidence as to what that standard was in the Thai market, and as I have noted a late application to adduce such evidence was opposed by Bitkub and was rejected by Master Pester.
303. Given the lack of such expert evidence all I have to rely on is Miss Vijitpinyo's evidence that she considered the local regulations to have been satisfied, which I accept she did. That does not equate to saying that Bitkub did, in fact, comply with local laws and regulations; Miss Vijitpinyo was not involved at the time and was not, in any event, called as an expert on Thai KYC. It does show that Bitkub believes it was compliant, and the Claimant has adduced no evidence that would allow it to challenge that belief. The pre-emptive strike based on KYC failed.
304. One then moves to the next stage, which arises in two places in the statements of case:

i) As I noted when addressing the question of pleading more generally, Bitkub asserts positively in the Re-Amended Defence that it "was at all material times wholly ignorant of any facts alleged to affect its conscience" (Re-Amended Defence paragraph 7.6) "acted in good faith at all material times" (paragraph 8.6) and "relies on the defence of ministerial receipt" (paragraph 8.7).

ii) As set out above, there is the separate allegation in the Re-Amended Reply as to Bitkub's failure to make enquiries. The pleaded case relates to USDT 65,022, which was, at that time, the amount that Mr Moore had traced from Mr D'Aloia into the 82e6 wallet; for whatever reason that amount was not amended when Mr Moore's evidence changed. It seems to me, however, that the proper figure is the amount received by Bitkub – USDT 400,000. Bitkub had no way of knowing what part of that might belong to Mr D'Aloia; indeed, it had no way of knowing about Mr D'Aloia individually at all.

305. It was for Bitkub to show the former and for Mr D'Aloia to show the latter.
306. Mr Dhanasarnsilp repeatedly recognised in his evidence before me that Ms Hlangpan's withdrawals on the morning of 21 February 2022, less than two hours before the receipt of the USDT in issue in this case, breached her account limits and should have caused her account to be blocked pending further inquiry and an alarm to be raised on Bitkub's systems requiring someone at Bitkub to look into what Bitkub considered to be suspicious account activity. The receipt of USDT 400,000 shortly thereafter would not have caused a block on the account in itself, but would have caused a further alarm to be raised, again because Bitkub considered a transaction of that size to be suspicious for someone with Ms Hlangpan's declared income. To paraphrase the language of Niru Battery, Bitkub had, or at least thought that it had, multiple good reasons to look into these transactions. Or in the language of Lord Sumption, there were features of the transactions that, if left unexplained, were indicative of wrongdoing.
307. Mr Connell referred me to the Tecnimont decision. There, HHJ Bird at [166] drew a contrast:

The factual circumstances in which money might be paid away after a defendant has actual notice of a restitutionary claim fall across a wide spectrum. On the one hand a bank might acquire actual knowledge a matter of seconds before a wrongdoer pays away money and on the other actual knowledge might be acquired months before money is paid away.

308. This, in my view, was the latter type of case. Although the gap in time between Ms Hlangpan receiving the funds and her paying them away was hours rather than months, Mr Dhanasarnsilp's evidence was that Bitkub's systems automatically stopped withdrawals when the THB 2 million daily limit was reached. Under clause 2.3(9.3) of the User Agreement, Bitkub had the right, at its sole discretion, to block any transactions, expressly including withdrawal transactions, that involved a Prohibited Use of the account. Under Appendix 1, Prohibited Use included "Fraud: Activities that defraud companies other users using the website of the Company or any other person…". Under clause 2.3(10.1(2)) it had the further right, again at its sole discretion, to suspend the account where it suspected the customer was using the account for a Prohibited Use. Under clause 8.8 Bitkub had the right to "suspend suspicious transactions of the Client at its sole discretion in order to investigate and report to relevant government agencies or suspend use of the customer's account for such suspicious reasons." The Customer agreed to waive any claim for damages in such circumstances.
309. Put simply, Ms Hlangpan could only act because Bitkub permitted her to do so. Until Bitkub did so her account was blocked and Bitkub was fully within its rights to keep that block in place pending an investigation. I recognise that the User Agreement is governed by Thai law, but it was not suggested that Thai law would produce a different outcome to English law in interpreting what I consider to be clear terms. There is nothing to suggest that Bitkub was under any time pressure when it came to investigating these transactions.
310. In his written closing Mr Connell suggested that Ms Hlangpan might have been able to pay away the USDT 400,000 because there was an internal approval to exceed the daily limit or, alternatively, a system malfunction. The evidence needed to support such a submission, which one would expect Bitkub to have if it existed, was not before me, however. In any event, both explanations seem to me improbable. Ms Hlangpan's freedom to continue using her account following breach of the withdrawal limits does not appear to have been the result of any considered approval, given that the gap between the first and second transactions breaching the limit was a little over a minute. It also seems unlikely to have been a system failure, given that Ms Hlangpan was repeatedly able to breach the daily limit over a period of some time, which one would not expect if Bitkub properly monitored and tested its systems.
311. Mr Connell further submitted that I had no evidence as to what systems and controls were required by Thai law; it might be that Bitkub's systems were unusually stringent, and a failure to measure up to its potentially higher standards should not be held against a party. I cannot accept that submission:

i) The burden of proof in establishing the defence is on Bitkub. While Bitkub accepted that in principle, in its written closing, Bitkub essentially attempted to argue that the Claimant needed to show an absence of good faith either (a) to establish his constructive trust claims or (b) to show Bitkub was unable to rely on the change of position defence for reasons of commercially unacceptable conduct; he had failed to do so. To my mind that is wrong. The unjust enrichment claim in issue here does not require any showing of bad faith by Bitkub. If, as part of its defence to that claim, Bitkub wanted to show that its account monitoring practices were unusually stringent and so generated false positives, such that it was legitimate to ignore at least some of them, it needed to call evidence to show what was required and/or typical for a cryptoexchange in the Thai market. It did not do so.

ii) The relevant question is what a party knew, not how they came to know it. In Niru Battery it was stressed: "I do not think that a person who has, or thinks he has, good reason to believe that the payment was made by mistake will often be found to have acted in good faith if he pays the money away without first making enquiries of the person from whom he received it." Similarly, in Papadimitriou Lord Sumption referred to "a reasonable appreciation of the meaning of the information in his hands". The defendant may have come upon the information through pure chance – provided the source was reliable they would have, or would think they had, good reason to believe it. Here, the source was absolutely reliable; it was Bitkub's own systems telling Bitkub that rules put in place to address money laundering concerns were being repeatedly breached. Once it became aware of that Bitkub could not simply ignore suspicious account activity that it thought was linked to a risk of money laundering even if it had discovered that activity through unusual diligence.

iii) Nor do I accept that I am unable to form a view on whether, objectively, Ms Hlangpan's account use was suspicious without expert evidence. First, in my view it was unusual and called for explanation that someone with an income of less than THB 30,000 per month in a single day had transaction volumes in excess of THB 13 million. It would have taken her around 36 years to earn that amount. Secondly, Miss Vijitpinyo's witness statement made clear that Bitkub was concerned to address the risk of money laundering, and I have found that the withdrawal limits that Ms Hlangpan breached were part of that AML policy, such that any breaches of the limits represented an AML concern from Bitkub's perspective.

312. Finally, there was at least some argument by Bitkub that it was impossible for Bitkub to know of the fraud in February 2021 when Mr D'Aloia himself did not realise he had been a victim of fraud until June. To the extent that point was being advanced it seems to me wrong. Bitkub did not need to know the specifics of the fraud being perpetrated on Mr D'Aloia; it needed to have, or to think it had, good reason to believe that the sums received into the 82e6 wallet were tainted. On the evidence before me, plainly it did.
313. In my view, the burden of showing good faith for the purpose of the change of position defence was on Bitkub, and Bitkub has failed to discharge it.
314. Mr Bergin submitted that Bitkub's failure to adduce evidence explaining why Ms Hlangpan had been able to continue using her account despite the suspicious transactions and the resulting block gave rise to an obvious inference – that Bitkub could not explain what had happened. He referred me to the following passage of "Lewin on Trusts" (20^th Ed, Sweer & Maxwell):

42-072. In particular, "Inferences of knowledge are of particular importance where at trial the defendant elects to call no evidence (...). Indeed the court may infer actual knowledge if the claimant establishes the circumstances set out in types (4) or (5) of the Baden classification and the defendant does not give evidence or offer any explanation of his conduct. Thus proof of knowledge within types (4) or (5) of the Baden classification may shift the evidential burden to the defendant, and so, if that burden is not discharged, suffice to establish actual knowledge." [emphasis added], and see Eagle Trust Plc v S.B.C. Securities Ltd [1993] 1 W.L.R. 484 at 493.

315. My only reservation with that submission is that, on the evidence, I am not sure why actual knowledge needs to be inferred. Senior Bitkub employees have explained that there would have been blocks placed on Ms Hlangpan's account and alarms raised requiring an investigation due to concerns over money laundering; those blocks were apparently lifted, permitting Ms Hlagnpan to deal with the USDT 400,000, with full knowledge of that account activity. In the circumstances, the evidence seems to me to establish that Bitkub did know of at least the serious risk of money laundering in allowing Ms Hlangpan to continue to use her account and was willing to take that risk. If, however, a further inference based on Bitkub's failure to offer an explanation supported by evidence is needed to establish actual knowledge, on the basis of Eagle Trust I would draw it.

Ministerial receipt

316. The second defence is ministerial receipt. An agent who receives a benefit on behalf of their principal and pays over to the principal the value of that benefit or applies it in accordance with the principal's instructions has a defence to a claim for restitution provided that they acted in good faith and without notice of the claim. Bitkub's case is that the receipt of the USDT was balanced by an immediate credit to Ms Hlangpan's account, a credit that she converted to Thai baht and withdrew long before Bitkub was informed of Mr D'Aloia's claim.
317. Again, Mr Bergin noted there was an open question as to whether the defence is available in the context of crypto-assets. Given the similarities between this defence and the defence of good faith change of position, which I touch on below, it seems to me they should approach the same issue in the same way, such that the defence of ministerial recipe should also be available, in principle, to receipts of crypto-assets.
318. There are, it seems to me, two issues in the application of the defence here: the question of enrichment and the question of good faith.
319. Much time was spent on the enrichment issue: could Bitkub assert ministerial receipt simply by showing that it had credited the relevant sum of USDT to Ms Hlangpan's account or did it also need to show that those sums had been paid to Ms Hlangpan? The point was fiercely contested, in part because there is a clash of authority but also, I think, because Bitkub only disclosed documents relevant to this issue as part of its supplemental disclosure.
320. The chronology of Ms Hlangpan's account as set out in her account statements is, it seems to me, decisive on the enrichment issue:

i) Prior to the receipt of the USDT 400,000 said to contain Mr D'Aloia's traced funds, the balance of Ms Hlangpan's account was THB 612,442.35.

ii) Following conversion of the USDT 400,000 to Thai baht, the balance of the account was THB 13,684,438.26.

iii) Over the course of 22 February 2022 Ms Hlangpan withdrew THB 13 million.

iv) On 24 February 2022 there was a further deposit of USDT 300,000, which again was converted to Thai baht taking the balance of the account to THB 10,544,095.28.

v) Almost immediately thereafter, Ms Hlangpan withdrew THB 9.7 million in a series of transactions.

321. I have found that Ms Hlangpan's Bitkub account was being used to launder the proceeds of fraud and that the transaction volumes could not be sustained by her legitimate income. It follows that the subsequent transactions were likely to involve the funds of other victims. On a FIFO basis those transactions resulted in all of what is said to be Mr D'Aloia's USDT being converted to Thai baht and withdrawn; on a pro rata basis around 95% of the original USDT 400,000 received into the account on 21 February 2022 had been paid away by 24 February. There was then a pause in the transactions until late March, when the account became active again. I do not have full details of the later transactions, but it seems to me likely that even on a pro rata basis the overwhelming majority of the USDT received on 21 February 2022 had gone by the time that Bitkub was notified of Mr D'Aloia's claim in June 2022.
322. In those circumstances, the enrichment issue does not seem to me a significant one. The debate in those cases is whether an agent can rely on the defence of ministerial receipt where it had no notice of the claim when it credited the principal's account or whether, instead, it also needed to be unaware of the claim when it paid the money to the principal. Here, Bitkub's state of knowledge was the same at both points in time: it knew before Ms Hlangpan received the USDT 400,000 that she was receiving sums into her account well in excess of her stated income and that she was breaching her daily withdrawal limits; it did not know about Mr D'Aloia's individual position until after the money was paid away.
323. To the extent that I need to decide the point, I would prefer the approach of Marcus Smith J in High Commissioner for Pakistan v Prince Muffakham Jah (to the effect that payment is required) to that of Sales J in Jeremy D Stone Consultants Ltd v National Westminster Bank plc [2013] EWHC 208 (Ch) (that simply crediting the account is sufficient) for the reasons that Marcus Smith J gives at [290] and that are developed by HHJ Paul Matthews in Terna Energy at [30]-[66]. In particular, I agree that the crediting would only be provisional and could be reversed. That is particularly clear in this case, given the evidence that Ms Hlangpan's account activity was considered suspicious by Bitkub and would have triggered both blocks on her account and alerts to Bitkub personnel and given Bitkub's clear rights to suspend Ms Hlangpan's use of her account pending an investigation.
324. That moves the analysis to what seems to me to be the more important question here. Bitkub can only rely on the defence of ministerial receipt if it was in good faith when it acted (in my view by paying away the funds). The position was summarised by Millett LJ as he then was in Portman Building Society v Hamlyn Taylor Neck [1998] 4 All ER 207h-j:

The true rule is that where the plaintiff has paid money under (for example) a mistake to the agent of a third party, he may sue the principal whether or not the agent has accounted to him, for in contemplation of law the payment is made to the principal and not to his agent. If the agent still retains the money, however, the plaintiff may elect to sue either the principal or the agent, and the agent remains liable if he pays the money over to his principal after notice of the claim. If he wishes to protect himself, he should interplead. But once the agent has paid the money to his principal or to his order without notice of the claim, the plaintiff must sue the principal.

325. When will an agent have "notice of the claim" in cases such as this? Mr Connell suggested that the first notice that Bitkub had of Mr D'Aloia's actual claim was in June 2022. That seems to me irrelevant; nothing in the cases suggests that proceedings need to have been issued or contemplated. The reference to "claim" is shorthand for a somewhat earlier stage.
326. In Jeremy Stone, Sales J addressed the requisite knowledge at [145]:

In my view, [ministerial receipt] is clearly established even in the period after 22 February 2010, when Mr Aplin first became aware that Martin was mistaken about the account into which Mr Saunders had arranged for the hotel receipts to be paid. At that stage, Mr Aplin still had no idea that Mr Saunders was committing a fraud against the Claimants, and NatWest had no good grounds to refuse to honour its contractual obligations to SEWL to pay out the money in the No. 1 and No. 2 accounts according to SEWL's instructions. In such circumstances, it would be unjust to impose any liability on NatWest in relation to its receipt of sums which it was then obliged to pay out again on SEWL's instructions.

327. As I read that, had Mr Aplin had grounds for believing that a fraud was being committed, such that he had good grounds to refuse to follow SEWL's instructions, the defence of ministerial receipt would no longer have been open to the bank. That is in line with the requirements for showing good faith change of position, a defence with obvious similarities to ministerial receipt (indeed, as noted in Goff & Jones at paragraph 28-02, there are arguments for saying that the latter has been or should be subsumed into the former).
328. The factors that I have addressed above therefore apply equally here. Bitkub knew that Ms Hlangpan was exceeding her withdrawal limits, limits which were imposed to address the risk of money laundering; it had the contractual right to suspend further use of the account and the benefit of a waiver of damages from Ms Hlangpan; yet it chose to let her go ahead anyway and has offered no explanation for doing so. It took a risk by allowing Ms Hlangpan to breach policies put in place to counter money-laundering. There is nothing unjust in holding Bitkub liable in such circumstances if Ms Halngpan was, in fact, involved in laundering funds. The defence of ministerial receipt is not available.

Counter-restitution impossible

329. Very little time was devoted to the defence of counter-restitution being impossible. The rule is summarised in Goff & Jones at 31-01:

A claimant who seeks restitution of an unjust enrichment must make counter-restitution of benefits received from the defendant in exchange. If counter-restitution is impossible then the claim is barred.

330. It was not at all clear to me what benefit Bitkub suggested Mr D'Aloia had received, whether from Bitkub or anyone else. He is a victim of fraud who has lost money as a consequence. There are no benefits for him to restore.
331. In the section of his written closing dealing with constructive trust, Mr Connell noted that restiutio in integrum is impossible because Ms Hlangpan has withdrawn the relevant funds from her account. I accept that she has, but to the extent that is also relied on for the purposes of this defence it seems to me to be focussed on the wrong relationship.

Equitable Proprietary Claim

332. In opening, Mr Bergin put the constructive trust claim in four ways, submitting that it did not much matter which was adopted. I disagree with the latter point because the different routes give rise to different trusts with different trustees that come into existence at different points in time. The four routes are:

i) Applying Westdeutsche Landesbank Girozentrale v Islington Borough Council, where property is obtained by fraud equity imposes a constructive trust on the fraudulent recipient, such that the fraudulent recipient holds the legal title on constructive trust. Here, the alleged fraud was perpetrated by the First Defendants, so the First Defendants would be the constructive trustees and the trust arose if at all on the dates when Mr D'Aloia paid money over to the First Defendants.

ii) Applying Angove's Pty Ltd v Bailey [2016] UKSC 47, where the intention that led to the transfer was vitiated, a constructive trust could arise. Mr Bergin submitted that here the vitiating factor was that Mr D'Aloia transferred the assets as a result of a fundamental mistake – he thought he was dealing with a reputable US financial institution when in fact he was dealing with a fraudster. The constructive trust must also be against the First Defendants and presumably again arose at the point of transfer of the assets.

iii) Commencement of proceedings rescinded the contract with td-finan and gave rise to a retrospective imposition of a constructive trust, again presumably as against the First Defendants. The Claimant's position is, I think, that the trust takes effect as if it had been back-dated to the point of transfer on the basis of Shalson v Russo at [127].

iv) Bitkub's failure to act in a commercially reasonable manner in failing to implement adequate KYC and anti-money laundering and failing to monitor Ms Hlangpan's account and to freeze it in light of the suspicious transaction volumes gives rise to a constructive trust. The constructive trustee here is said to be Bitkub; the trust cannot have arisen at any time before Bitkub received the USDT 400,000 on 21 February 2022.

The Westdeutsche trust

333. This basis is said to arise from the speech of Lord Browne-Wilkinson. His Lordship started by identifying certain general principles of trust law at page 705C-E:

(i) Equity operates on the conscience of the owner of the legal interest. In the case of a trust, the conscience of the legal owner requires him to carry out the purposes for which the property was vested in him (express or implied trust) or which the law imposes on him by reason of his unconscionable conduct (constructive trust).

(ii) Since the equitable jurisdiction to enforce trusts depends upon the conscience of the holder of the legal interest being affected, he cannot be a trustee of the property if and so long as he is ignorant of the facts alleged to affect his conscience, i.e. until he is aware that he is intended to hold the property for the benefit of others in the case of an express or implied trust, or, in the case of a constructive trust, of the factors which are alleged to affect his conscience.

(iii) In order to establish a trust there must be identifiable trust property. The only apparent exception to this rule is a constructive trust imposed on a person who dishonestly assists in a breach of trust who may come under fiduciary duties even if he does not receive identifiable trust property.

(iv) Once a trust is established, as from the date of its establishment the beneficiary has, in equity, a proprietary interest in the trust property, which proprietary interest will be enforceable in equity against any subsequent holder of the property (whether the original property or substituted property into which it can be traced) other than a purchaser for value of the legal interest without notice.

334. He then addressed the position of the recipient of trust property at page 707B-D:

The bank contended that where, under a pre-existing trust, B is entitled to an equitable interest in trust property, if the trust property comes into the hands of a third party, X (not being a purchaser for value of the legal interest without notice), B is entitled to enforce his equitable interest against the property in the hands of X because X is a trustee for B. In my view the third party, X, is not necessarily a trustee for B: B's equitable right is enforceable against the property in just the same way as any other specifically enforceable equitable right can be enforced against a third party. Even if the third party, X, is not aware that what he has received is trust property B is entitled to assert his title in that property. If X has the necessary degree of knowledge, X may himself become a constructive trustee for B on the basis of knowing receipt. But unless he has the requisite degree of knowledge he is not personally liable to account as trustee: In re Diplock; Diplock v. Wintle [1948] Ch. 465, 478; In re Montagu's Settlement Trusts [1987] Ch. 264.

335. Finally, Lord Browne-Wilkinson specifically addressed fraud at page 716C-D:

Although it is difficult to find clear authority for the proposition, when property is obtained by fraud equity imposes a constructive trust on the fraudulent recipient: the property is recoverable and traceable in equity. Thus, an infant who has obtained property by fraud is bound in equity to restore it: Stocks v Wilson [1913] 2 KB 235, 244; R Leslie Ltd v Sheill [1914] 3 KB 607.

336. That latter passage was considered by Ferris J in Box v Barclays Bank [1998] Lloyd's Rep Bank 185, who concluded at page 200:

The observation of Lord Browne-Wilkinson in the Westdeutsche case only assists the plaintiffs if it is to be treated as a general statement of the law applicable to all cases of fraud. In my view it would be wrong so to treat it. It was a general statement of certain underlying principles instanced by examples two of which concerned transactions which are void, not voidable, and the third of which comes from the field of secret trusts where "fraud" is referred to in a special sense. I do not think that Lord Browne-Wilkinson can be taken to have been laying down a principle applicable to all cases of fraud when he did not deal with the reasoning in the other cases which I have mentioned.

337. Rimer J in Shalson v Russo endorsed Ferris J's approach and conclusion at [115]. Mr Connell also referred me to the judgment of Millett LJ in Bristol & West Building Society v Mothew at pages 22-23:

Misrepresentation makes a transaction voidable not void. It gives the representee the right to elect whether to rescind or affirm the transaction. The representor cannot anticipate his decision. Unless and until the representee elects to rescind the representor remains fully bound. The defendant's misrepresentations merely gave the society the right to elect to withdraw from the transaction on discovering the truth. Since its instructions to the defendant were revocable in any case, this did not materially alter the position so far as he was concerned, though it may have strengthened the society's position in relation to the purchasers.

The right to rescind for misrepresentation is an equity. Until it is exercised the beneficial interest in any property transferred in reliance on the representation remains vested in the transferee.

338. Since he shortly after referred to what Lord Browne-Wilkinson said in Westdeutsche (see page 23) I accept that he must have had that decision well in mind. Evidently, Mr Connell submitted, Millett LJ also did not read Lord Browne-Wilkinson's speech as setting down a general principle that a fraudulent representation inducing a contract makes the representor, without more, a constructive trustee; otherwise, he would not have concluded that beneficial interest vested in the transferee.
339. In terms of Westdeutsche not laying down a general rule applicable in all cases of fraud I accept the submission. I do not understand Mr D'Aloia's case to be so ambitious, however; he relies on a particular type of fraud addressed by the Court of Appeal in Martin J Halley v The Law Society. At paragraphs [45]-[48] Carnwath LJ, as he then was, distinguished between a contract induced by fraud and a contract that was, itself, the instrument of the fraud:

45. The submission, as I understand it, is that this is not simply a case of a valid contract being induced by fraud; but that the fraud so infected the whole transaction that it had no legal effect at all. The "contracts" were in reality no more than devices to extract money by fraud; in Mr Dutton's words -

The "agreements" were fictitious contracts. They were as the judge found merely part of an elaborate charade (or mechanism) by which the loser was persuaded to part with his money."

The position, accordingly, is said to be "akin to theft". Where property is stolen, no beneficial interest passes to the thief. Mr Dutton submits that the same applies where money is extracted by fraud, otherwise than under a legally enforceable contract. He relies on Westdeutsche Bank v. Islington LBC [1996] AC 669 at 705C-D, 715H-716D (per Lord Browne-Wilkinson).

…

47. … In this case, the contract has been held to be the instrument of fraud, and nothing else. The elaborate documentation was, in the words of the judge, "no more than a vehicle for obtaining money by false pretences" (para 119). Furthermore, the legal interest in the money passed to the escrow agent, but the beneficial interest remained with Toro, unless and until it passed to Tidal under the contract. In my view, the court is entitled to disregard the apparent effect of that fraudulent contract, and hold that the beneficial interest remained throughout with Toro.

48. In such a case, it is meaningless to impose a requirement for the fraudster to be notified of "rescission". From the fraudster's point of view there is nothing to rescind; for practical purposes, he has parted with nothing of value and incurred no obligations; the victim is left with some documents which, from the outset, were known and intended by the other party to be worthless. The "election" to which Potter LJ [in Twinsectra v Yardley] referred is not a real option. Although the case does not fit neatly into Potter LJ's binary classification, he was not dealing with these facts. Subject to any direct authority, I see no reason why it should not be regarded as a simple case of "property obtained by fraud", in Lord Browne-Wilkinson's terms.

340. In respect of the constructive trust claim, the same allegation is advanced here. I have found that the parties behind td-finan never intended to provide Mr D'Aloia with anything – the whole thing was a scam. It was, to use the language of the learned Judge in Halley, "no more than a vehicle for obtaining money by false pretences".
341. In the circumstances this seems to me a different type of case to Box, Shalson or Mothew. The facts of Halley seem to me largely indistinguishable, such that it is binding on me. I therefore accept that a constructive trust against the First Defendants arose over the funds they received from Mr D'Aloia at the point of transfer.
342. The difficulty for Mr D'Aloia is part legal, part factual. As a factual matter I have found he has not evidenced, whether by way of tracing or otherwise, that his funds flowed to Bitkub. That is obviously fatal to the claim.
343. Legally, there is the question of how the First Defendants' breach of trust in paying away Mr D'Aloia's USDT gives rise to a claim against Bitkub. In Byers, Lord Burrows summarised the position at paragraph [157]:

Once one recognises that knowing receipt is an equitable proprietary wrong that depends on the claimant having a continuing equitable proprietary interest in the asset received, or retained, by the defendant, it becomes clear that the personal knowing receipt claim has the same essential proprietary basis as the equitable proprietary claim to the asset. So, if the defendant still retains the asset, in which the claimant has a continuing equitable proprietary interest, the claimant is entitled to an equitable proprietary remedy for the return of that asset. But if the defendant no longer retains the asset, the claimant still has a personal claim for knowing receipt provided the claimant had a continuing equitable proprietary interest, and the defendant had the requisite knowledge, at the time of the defendant's receipt or retention.

344. Lord Briggs made similar points at paragraph [42]:

Knowing receipt is sometimes also called a form of ancillary liability, but it is not in my view ancillary to the liability of the trustee. Rather it is ancillary to the proprietary claim which will generally enable the continuing equitable beneficial owner to recover the trust property where it has passed into the hands of someone other than the trustee, without the equitable interest having been overreached or overridden. The personal remedy in knowing receipt comes to the rescue if the transferee then transfers, dissipates or destroys the property after learning of the breach of trust, so as to prevent the pursuit of a proprietary claim. In such a case the claimant's equitable interest still subsisted at the time when the transferee learned of the breach of trust, so that the later transfer, dissipation or destruction of the property was a breach of the restorative and custodial duty which then bound him.

345. I have found that Ms Hlangpan withdrew the proceeds of the USDT 400,000 well before the commencement of proceedings or service of the freezing order on Bitkub. Mr D'Aloia has not pursued a claim in knowing receipt (or, for completeness, dishonest assistance) and accepts that he is unable to do so. On the face of it, the property has been dissipated or destroyed and there is no knowing receipt claim to come to the rescue.
346. In the Claimant's written opening it was submitted that the equitable proprietary remedy depended on there being property subject to a trust that was transferred in breach of trust and received by the defendant; it was not necessary to show that the defendant knew of the breach of trust. Reference was made to Byers at paragraph [18]. It seemed to me that this was being advanced as some sort of alternative to the proprietary claim and the claim in knowing receipt. If that was the case, it seemed to me not to be right.
347. As Lord Briggs noted at paragraphs [16]-[17], the issue for the Supreme Court related to a claim in knowing receipt. Lord Briggs made his observations at paragraph [18] by reference to what was said by Lord Browne-Wilkinson in Westdeutsche, and as I have noted I consider that passage to be a reference to knowing receipt. That conclusion is reinforced by Lord Briggs' multiple references to the claimant vindicating his or her title through a claim in knowing receipt (see paragraphs [24], [26] and [27]). His Lordship then addressed three further arguable uncertainties about the equitable principles relating to knowing receipt (paragraph [29]) before returning to "the central issue" (paragraph [36]), which again focussed on knowing receipt. The written submissions also referenced Lewin on Trusts paragraph 42-025. That is also a passage concerning knowing receipt.
348. No other basis was suggested by which Mr D'Aloia's breach of trust claim against the First Defendants translated into a claim against Bitkub and it seems to me that it would be somewhat odd if there were to be one. As the judgments of Lord Burrows and Lord Briggs make clear, there is no gap in the law: if the recipient retains the trust property there is the proprietary claim; otherwise there is the knowing receipt claim. To the extent a gap arises on the facts of this case, it is from the way in which Mr D'Aloia has elected to pursue his claim.

The Angove trust

349. In Angove Lord Sumption stated at [30]:

For present purposes it is enough to point out that where money is paid with the intention of transferring the entire beneficial interest to the payee, the least that must be shown in order to establish a constructive trust is (i) that that intention was vitiated, for example because the money was paid as a result of a fundamental mistake or pursuant to a contract which has been rescinded, or (ii) that irrespective of the intentions of the payer, in the eyes of equity the money has come into the wrong hands, as where it represents the fruits of a fraud, theft or breach of trust or fiduciary duty against a third party.

350. I do not understand this to be more than a summary of general principles. I accept it, of course, but what matters is the detail.
351. Here, for the reasons I have given it seems to me that a constructive trust arises in accordance with the principles set out in Halley and Westdeutsche. If I am wrong on that, I consider that a somewhat different constructive trust could in principle arise on rescission applying the principles in cases such as Mothew, albeit on the facts I do not accept that has been alleged by Mr D'Aloia in this case. All of that is consistent with what is said in Angove, but I do not regard that decision as giving rise to a separate, free-standing ground for finding a constructive trust.

The rescission trust

352. It seems to me that this only arises if I am wrong in what I say above in connection with Halley and the Westdeutsche constructive trust. Halley contemplates that the beneficial interest never passes and that rescission is pointless because there is nothing to set aside. As such, that type of constructive trust effectively pre-empts a rescission based trust.
353. Applying the paragraphs of Mothew that I cite above, I agree that in principle if there was a contract induced by fraud, the victim of that fraud has a right to rescind it and that on doing so a constructive trust arises against the fraudster. I do not understand that point to be contested by Mr Connell. He objects to the imposition of such a trust in this case both on the ground that no such trust is pleaded and on the basis that the trust could only arise prospectively from the point of rescission.
354. Mr Connell submitted that PD 16 paragraph 8.2 requires all breaches of trust to be pleaded, which logically means that the trust that is said to have been breached must also be pleaded. Here, the pleaded case was tied to the agreement with td-finan being void rather than voidable. There was no reference to rescission at all.
355. Mr Bergin accepted that the statements of case could have been framed more elegantly, but submitted that it was clear that they were intended to catch both an immediately incepting, Halley type trust and a rescission based trust. He directed me to paragraphs 13 and 14 of the Re-Amended Reply and, in particular, to paragraph 30. This, he submitted, was made clear that there was a fallback argument for what was to happen if the legal title passed, which was a rescission based trust.
356. The pleading as to constructive trust starts at paragraph 39 of the Re-Amended Particulars of Claim, which provides:

…should the Claimant's legal title to the Identifiable Cryptocurrency be deemed to have passed, the Defendants are liable to the Claimant as a [sic] constructive trustee in Equity in relation to the USDC and/or USDT and/or the respective portions of the Identifiable Cryptocurrency to which the Claimant has a beneficial interest.

357. Paragraph 40(iii) then specifies part of the reason why a constructive trust has arisen by operation of law:

The Claimant maintaining a beneficial interest in the Identifiable Cryptocurrency at all times for the reason that the contract between the Claimant and [td-finan] was not induced by fraud but was itself an instrument of fraud such that the contract was void ab initio meaning that the Claimant's beneficial title did not pass.

358. The Claimant then asserted at paragraph 41:

It follows that when the Exchange Defendants came into possession and/or control of the respective portions of the Identifiable Cryptocurrency, it was already subject to a constructive trust (by virtue of the contract being void and the wrongdoing / unconscionable conduct of the Persons Unknown Category A and Persons Unknown Category B) such that (a) the Exchange Defendants could not acquire beneficial title in it following the nemo dat principle and/or (b) it would be unconscionable for the Exchange Defendants to continue to hold the beneficial interest and/or (c) equity treats the Exchange Defendants as trustees holding the respective portions of the Identifiable Cryptocurrency for the Claimant's benefit.

359. Paragraph 30 of the Re-Amended Reply states:

Should the Claimant's legal title to the USDT and USDC be deemed to have passed, the Claimant seeks a declaration that the Sixth Defendant holds the 65,022 USDT, or the substitute(s) or proceeds for him on constructive trust.

360. In my view, the trust pleaded in the Re-Amended Particulars is expressly premised on a void contract, not a voidable one. Moreover, it is not alleged that the trust needs to be or is backdated to the time of the fraud; it is said that beneficial title never passed. There is no mention of the trust being dependent on rescission of the agreement between Mr D'Aloia and td-finan.
361. Nor do I accept Mr Bergin's submission that anything changes with the Re-Amended Reply. The language in paragraph 30, for instance, tracks very closely the language of paragraph 39 of the Re-Amended Particulars. The contrast that is being drawn, in both cases, is with the proprietary restitution claim, which was abandoned on the first day of trial, not between different inceptions of a constructive trust.
362. If I am wrong on that the question arises as to when the trust incepted. Mr Bergin referred to Shalson at [106]-[120], [122] and [127] and to the commentary on that portion of the decision in Goff & Jones at 40-24. The starting point in Shalson is [122]:

122. Rescission is an act of the parties which, when validly effected, entitles the party rescinding to be put in the position he would have been in if no contract had been entered into in the first place. It involves a giving and taking back on both sides. If it is necessary to have recourse to an action in order to implement the rescission, the court will make such orders as are necessary to put both contracting parties into the position they were in before the contract was made. There is, however, also a line of authority supporting the proposition that, upon rescission of a contract for fraudulent misrepresentation, the beneficial title which passed to the representor under the contract revests in the representee. The representee then enjoys a sufficient proprietary title to enable him to trace, follow and recover what, by virtue of such revesting, can be regarded as having always been in equity his own property. This may be an essential means of achieving a proper restoration of the original position if the representor has in the meantime parted with the property and is ostensibly a man of straw unable to satisfy the court's orders for restoration of the original position.

363. At [123] Rimer J quoted Millet LJ in Mothew at page 23, in which he had referred to his earlier first instance judgment in El Ajou. Millet LJ explained that in El Ajou he was:

concerned to circumvent the supposed rule that there must be a fiduciary relationship or retained beneficial interest before resort may be had to the equitable tracing rules. Until the equitable tracing rules are made available in support of the ordinary common law claim for money had and received some problems will remain incapable of sensible resolution.

364. Millet LJ in Mothew immediately went on to emphasise:

But all that is by the way. Whether or not there is a retrospective vesting for tracing purposes it is clear that on rescission the equitable title does not revest retrospectively so as to cause an application of trust money which was properly authorised when made to be afterwards treated as a breach of trust.

365. Rimer J did not quote that part of Millett LJ's judgment, but he did not in any way suggest that he disagreed with it. He concluded at [124]: "These authorities support the view that, upon the implied rescission of the loan contracts, Mr Mimran became entitled to assert a proprietary interest in the money he advanced to Westland, being an interest which would then entitle him to trace the money further."
366. At [126] he stated that he was not excluding the possibility of a wider right, but he made clear at [127] that he was not finding such a right in the case before him; what revested was "the property in the money he advanced to Westland entitling him at least to trace it into assets into which it was subsequently applied." That is wholly consistent with what Millett LJ said about the equity of rescission arising at the time of the misrepresentation; such an equity would be sufficient in and of itself to permit tracing. It is reflected in the observation in Snell's Equity at [26-013] that:

On rescission by the claimant, the defendant holds his legal interest in the property on resulting trust. Since the trust arises only at that stage, the defendant cannot be taken to have owed duties qua trustee before then. Nor can any misapplication of money by the defendant be treated as a breach of trust until after rescission.

367. Were it pleaded I agree that, following rescission, a constructive trust could arise, subject to there being identifiable trust property. I do not accept that it could in some way be back-dated to the point when Mr D'Aloia paid money to td-finan. Since the basis of the trust is the rescission of the fraudulently induced agreement, the trustees would be the First Defendants. As with the Westdeutsche constructive trust, there would therefore be an issue with how, if at all, this could affect Bitkub. In my view, for the reasons given above, it could not on Mr D'Aloia's case as advanced before me.

The Bitkub constructive trust

368. This is very different to the other iterations of the constructive trust. There, Mr D'Aloia is arguing that the First Defendants are the constructive trustees from the point when they received Mr D'Aloia's funds on 10 January 2022, such that Bitkub takes subject to Mr D'Aloia's beneficial interest unless Bitkub is a bona fide purchaser for value without notice. Here, the argument is that a constructive trust is imposed on the USDT in the hands of Bitkub itself; Bitkub is the trustee, and the trust arose at the point Bitkub received the funds on 21 February 2022, not before.
369. What Mr Bergin therefore seeks is a constructive trust premised on the fact that Bitkub failed to implement its own procedures aimed at combatting money laundering when Ms Hlangpan opened her account. When she received the USDT 400,000, converted it to Thai baht and paid it away it was against the backdrop of her suspicious account usage, of which Bitkub was aware; that is the foundation of the constructive trust advanced at trial.
370. That argument faces immediate, and to my mind insurmountable, hurdles.
371. The first is that it is not pleaded. For the reasons I set out in respect of the rescission constructive trust, the allegation is that a constructive trust is imposed on the First Defendants by virtue of their wrongdoing in committing the fraud. Bitkub is said to take subject to that interest. Indeed, here the case is stronger because the pleaded trust is against the First and Seventh Defendants, which would be correct for the rescission trust but not the Bitkub trust.
372. Moreover, the pleaded claim is not that Bitkub's conscience is impacted by its lack of proper diligence; it is not specific to Bitkub at all. The claim is that because a constructive trust arose against other parties, Bitkub (and the other Exchange Defendants) take subject to that trust. That is reinforced by the pleading as to breach at paragraph 43 of the Re-Amended Particulars:

In transferring the USDT and USDC from the TD Finan Wallets, the Persons Unknown Category A have breached the constructive trust imposed by operation of law.

373. No breach of trust is alleged against Bitkub, as would be required under PD 16 paragraph 8.2 if that were to be advanced against Bitkub.
374. I do not accept that the Claimant's allegations of commercially unacceptable conduct or unconscionable receipt extend to found any claim. Those allegations were made only in respect of the defence of good faith change of position. It seems to me that that is more than a mere technicality. Had Bitkub faced a positive claim premised on the acceptability, or otherwise, of its conduct it may have taken a different view as to the evidence it wished to adduce. In particular, as I have noted, Bitkub opposed the Claimant's application to adduce expert evidence as to compliance and AML in the Thai market. This is a classic instance, it seems to me, of the point made in Boake Allen that the definition of the issues is fundamental to the evidence necessary at trial.
375. The position is further compounded because in the amendment application before Bacon J, the Claimant sought permission to amend his claim to assert unjust enrichment and knowing receipt on the basis that the defendants "behaved in a 'commercially unacceptable way' by virtue of failings of corporate governance and due diligence in relation to the activities of the exchanges" (see paragraph [10] of Bacon J's judgment). Essentially, that was an attempt to plead a constructive trust claim, in that if knowing receipt can be established the recipient may become a constructive trustee (Westdeutsche at page 707D). Bacon J refused to grant permission on the grounds that the claim raised questions of foreign law and the defendants should have the opportunity to call expert evidence in response (paragraph [25]) and there was no good reason why the arguments could not have been advanced sooner (paragraph [27]).
376. What has changed? The claim is now advanced explicitly on the basis of a constructive trust rather than unjust enrichment or knowing receipt; it is not pleaded at all; and it is advanced only at trial. The alleged basis is still the same, however – that Bitkub's failure to follow its own systems and controls was commercially unacceptable and attached it with sufficient notice that a constructive trust should arise. Had the Claimant sought to amend expressly to plead a constructive trust on that basis as part of his application before Bacon J I believe she would have rejected that application for the same reasons she rejected his application in respect of knowing receipt and unjust enrichment. It cannot be the case that Mr D'Aloia's position is improved by waiting, not least because Bacon J in part rejected his application because he had delayed.
377. There was some suggestion by Mr Bergin that if Bitkub had objected to this element of Mr D'Aloia's claim it could have applied to strike it out, and should not be allowed a back door strike out through a restrictive reading of the statements of case. As I noted to Mr Bergin during closing, I find that argument hard to follow on the facts of this case. Bitkub is not seeking to remove anything from the statements of case; it is simply saying that the case the Claimant seeks to advance at trial is not pleaded. There would be nothing to strike out. The better analysis, it seems to me, is that by taking an expansive reading of the statements of case the Claimant is seeking a back-door amendment to allow it to advance an unpleaded case, and indeed a case for which it sought permission to amend but for which that permission was refused. That simply takes me back to the points I have made in respect of the scope of the pleaded case and Bacon J's judgment on the amendment application.
378. The second, very obvious, difficulty is that I have found that the Claimant has failed to show that Bitkub received any of its funds. Accordingly, even if a trust could have been established, it would not be in favour of Mr D'Aloia.

Defences

379. Bitkub asserts that it is equity's darling – a good faith purchaser for value without notice. For reasons I have already given, I do not accept that Bitkub has shown that it can avail itself of this defence. Bitkub's witness confirmed that the flow of funds through Ms Hlangpan's account would have caused a block to be placed on Ms Hlangpan's account and raised alarms on Bitkub's systems, putting Bitkub on notice before the receipt of USDT 400,000 said to contain Mr D'Aloia's funds, yet Bitkub allowed Ms Hlangpan to pay those funds away.
380. Bitkub's documentary and witness evidence before me did nothing to address why steps were not taken. I have therefore concluded that Bitkub had more than simple constructive notice of the risk that Ms Hlangpan's account was being used for money laundering; it had actual notice.
381. Both parties suggested that it would be useful for me to express a view on the requisite level of knowledge for a party to be deprived of the defence of bona fide purchaser for value without notice in the context of crypto-assets. Given that I have found that Bitkub had actual knowledge that is, in my view, neither necessary nor desirable.

Conclusion

382. This is a lengthy judgment because the legal points to which it gives rise are novel, contentious or both. Ultimately, they are of secondary importance, in that Mr D'Aloia has failed to show on the balance of probabilities that any of his USDT ever arrived at the 82e6 wallet. In the circumstances, Mr D'Aloia has no claim against Bitkub because it did not receive anything from him. It holds no trust funds; there is no normatively defective transaction as between Bitkub and Mr D'Aloia to undo.
383. In any event, while I accept, for the purposes of these proceedings, that a constructive trust arose over Mr D'Aloia's funds in the hands of the First Defendants, the USDT 400,000 received by Bitkub has been paid away and no claim is asserted against Bitkub in knowing receipt. I noted, much earlier in this judgment, that one of the purposes of the statements of case, as is explained in the Chancery Guide, is as a legal audit, to ensure that a complete claim is asserted. That did not happen here, such that the legal link connecting Mr D'Aloia with Bitkub is simply missing from his claim. For this reason, too, he cannot succeed in his breach of trust claim.

Note 1    I understand that both the concept and the network are considered proper nouns, so are capitalised, whereas the crypto-currency itself is not.    [Back]