BUSINESS AND PROPERTY COURTS IN WALES
CIRCUIT COMMERCIAL COURT (KBD)
2 Park Street, Cardiff, CF10 1ET |
||
B e f o r e :
sitting as a Judge of the High Court
____________________
ZI WANG |
Claimant |
|
- and - |
||
GRAHAM DARBY |
Defendant |
____________________
The Defendant was neither present nor represented.
Hearing date: 4 June 2024
____________________
Crown Copyright ©
Judge Keyser KC :
Introduction
The Substantive Proceedings
100 Bitcoin: how the issue unfolded
"13. My conclusions can be simply summarised as follows:
…
(4) A fairly basic review of the BTC blockchain identifies the existence of BTC (i.e. bitcoin) wallets that are very likely to belong to Mr Darby, and these wallets appear to have holdings that exceed the amount in dispute, amounting to at least 100 BTC currently residing in self-custodial wallets owned by Mr Darby.
…
14. Mr Darby could try to dispute these conclusions by obtaining records that only he has access to (namely self-custodial wallet records), including records of any and all services Mr Darby utilized, and thereby substantiate all of his blockchain transactions, providing a clear description and purpose of each transaction (such as who the funds were sent to and why).
15. However, on the information I have managed to obtain based upon data from the blockchain, which is an immutable ledger of fact, it is my opinion that it is highly probable that Mr Darby:
(1) Holds accounts on varied digital asset exchanges/platforms which may have balances (if they do not, the most likely circumstance is that assets were liquidated for cash or withdrawn to other exchanges and/or self-custodial wallets) and he will have relevant transaction records.
(2) Holds at least 100.0102132 BTC and is likely to hold other digital assets."
In the main body of the report, at paragraph 23, Mr Sanders said that it was "not presently possible to provide a complete inventory of Mr Darby's digital asset holdings"; such an inventory would be possible only "with Mr Darby's cooperation in such a process or via court-ordered disclosure." He gave a lengthy discussion of his methodology including the following overview:
"36. I have carried out a proportionate assessment of the relevant blockchain data. The nature of blockchain analysis, particularly in a case of this nature where (initially) the other party is not able to be questioned, results in a requirement to apply sound judgement in, for example, assessing which wallet addresses and/or transactions to scrutinise.
37. At this stage, the appropriate balance was to identify, at a high level, where Mr Darby might be storing digital assets, whether in self-custodial wallets and/or exchanges/services. The nature of blockchain technology means that I cannot confirm with undeniable certainty that a given wallet address definitely belongs to Mr Darby; only Mr Darby can provide a complete inventory of wallet addresses and services that he owns/utilizes. However, I am able to identify a list of highly likely or even practically certain wallet addresses as being owned by Mr Darby and services used by him.
38. I set out below some remarks on the material that I have relied upon in forming my opinions in this Section:
(1) The nature of blockchain transactions means that all of this information is in the public domain and can be accessed via free tools known as block explorers. For example, to review a Bitcoin transaction, one only needs to visit a website such as Blockchain.info and paste in the Bitcoin transaction.
(2) The tool I utilize to perform blockchain analysis in this report (for the supported blockchains) is Chainalysis Reactor. Chainalysis Reactor provides a visualization of blockchains; put more plainly, this is providing visualizations of the same data that would be viewable on a block explorer. The core difference between Chainalysis Reactor and a block explorer, insofar as is relevant for the purposes of this Report, is that Chainalysis Reactor has what is known as attribution (labelling of wallet addresses), which will not exist for most addresses in free block exporters."
At paragraphs 59ff Mr Sanders set out in considerable detail his analysis regarding Bitcoin. By identifying known Bitcoin transactions by Mr Darby (paragraphs 60 and 61) he identified other addresses likely to be controlled by him (what he called the "Darby cluster"). He continued:
"68. The Darby cluster interacts with an extensive amount of counterparties; it is not possible to identify the nature of these transactions (such as 'this is Mr Darby depositing to his account on Binance' or 'this is Mr Darby sending/receiving funds from a P2P/OTC deal') without Mr Darby providing this information.
69. It is, however, possible to provide, in degrees of likelihood, insight about where Mr Darby likely holds cryptocurrency accounts of relevance (particularly, exchanges) based upon this information. As just one example, it is likely that Mr Darby holds an account on Gate.io based upon the quantity of transactions to and from that service. (It is also observed via public records that Mr Darby discussed Gate.io on a number of occasions).
70. The most time-efficient way to quickly determine likely accounts based upon a wallet address or cluster of wallet addresses is via 'exposure (Appendices D and E)' of where digital assets are received from or sent to. In summary:
(1) I can be more or less certain that Mr Darby holds an account on: i. LocalBitcoins; ii. BitBargain; iii. Paxful; iv. Gate.io; v. Coinbase; vi. Kraken.
(2) It is extremely likely Mr Darby holds accounts on: [two locations specified].
(3) It is very likely Mr Darby holds accounts on: [two locations specified].
(4) It is likely that Mr Darby holds accounts on: [four locations specified].
(5) It is possible that Mr Darby holds accounts on: i. Bitflyer; ii. Other exchanges/services not yet identified due to a minimal amount of data available for analysis at this time.
…
75. It is critical to reiterate that the present BTC analysis (which identified hundreds of BTC wallet addresses either confirmed or extremely likely to belong to Mr Darby, as well as an extensive list of cryptocurrency services with directly relevant records) was made possible with only a small quantity of BTC transactions (from the agreements discussed, as per Telegram records) as the springboard. In essence, I have worked with a 'slice of a slice' of the data that would be relevant to conduct a full review for this case, and this data has enabled me to uncover extensive and directly relevant information. This analysis has, therefore, only just begun, and it can only be deemed adequately completed once exchange records and wallet address inventory have been received."
At paragraphs 77 to 81 of the report Mr Sanders explained his conclusion that Mr Darby had a present balance of in excess of 100 Bitcoins in self-custodial wallets.
"13. (1) Unless paragraph (2) applies, the Respondent must within 5 working days of service of this order and to the best of his ability inform the Applicant's solicitors of all his assets worldwide exceeding £5,000 in value whether his own name or not and whether solely or jointly owned, giving the value, location and details of all such assets. Such information shall include but is not limited to, a complete inventory of all cryptocurrency holdings and precisely where they are located.
(2) If the provision of any of this information is likely to incriminate the Respondent, he may be entitled to refuse to provide it, but is recommended to take legal advice before refusing to provide the information. Wrongful refusal to provide the information is contempt of Court and may render the Respondent liable to be imprisoned, fined or have his assets seized.
14. Within 7 working days after being served with this order, the Respondent must serve on the Applicant's solicitors a witness statement supported by a statement of truth (the wording of which is set out in Schedule C at the end of this Order) setting out the information required to be disclosed pursuant to paragraph 13(1) above."
"2.3 Before setting out our client's responses to paragraph 6 of the Order [part of the proprietary injunction], our client has asked us to inform you that he has been suffering severe mental health issues over a number of year, which although not yet formally diagnosed appears to be early onset dementia. Whatever his illness, he has suffered memory loss and whilst his short term memory is good (as long as he is not distracted or under stress), his long term memory is not. The result of his illness is that he finds it difficult to follow instructions.
2.4 It was our client's illness which was the determinative factor which led to our client making the decision to reduce his cryptoasset and then to cease trading. In short our client was forgetting passwords, wallet details, location of files and it was at this point that our client made the decision to stop trading for good. Our client is in the process of collating his medical records to evidence this, but in the meantime, we enclose copies of letters concerning a memory assessment and an appointment for an MRI scan.
…
2.6 When our client decided to stop trading, he saved all information and documentation relating to his various wallets, exchange accounts and cryptoassets he had control over to an external hard drive which he then encrypted (the 'Hard Drive'). The Hard Drive will be preserved by our client in accordance with the Preservation Order.
2.7 Since our client did this, he has forgotten the password to access the external hard drive. Therefore the information concerning the 'Applicant's Tezos' [required by the proprietary injunction] is limited, not only because our client is unable to access the various cryptoasset wallets and exchanges, but due to his failing memory, which is getting worse. Furthermore, our client had his own Tezos independent of your client's Tezos.
2.8 With that said, our client is able to provide the following information and documentation in relation to his general dealing with the Tezos (whether they be the Applicant's Tezos or our client's own Tezos):
(a) Our client recalls to the best of his ability that he used his account with gate.io to exchange the Tezos he held generally for Bitcoin. Our client no longer has access to his Gate.io account as the information required to access the account is on the Hard Drive.
(b) Our client recalls that once he had exchanged the Tezos for Bitcoin, he then sent them to his account with Kraken. We enclose a copy of our client's 'Kraken ledgers' and 'Kraken trades'. It appears that a total of 58.74088 Bitcoin was deposited into this account, with 58.73498 Bitcoin being sold between August 2020 and January 2021 for a total of £1,087,010.00. These monies were then transferred to his Barclays bank account. We enclose copies of his Barclays statements from September 2020 to January 2021, where the inbound payments from the sale of the 58.73498 Bitcoin are detailed.
(c) We also enclose a copy of our client's Coinbase account summary between 29 April 2015 and 21 November 2020, which details our client Coinbase account transaction history. Our client closed this account in November 2020 which is why the history stops at that point in time.
2.9 As our client is unable to access his gate.io account, he is unable to determine the amount of Bitcoin he received in exchange for the Tezos (whether the Tezos were your client's Tezos or his own)."
The Disclosure Letter said that Mr Darby had liquidated practically all his cryptocurrency holdings in the period August 2020 to January 2021. Section 3 of the Disclosure Letter set out a list of assets with a value in excess of £5,000. That list did not identify any cryptocurrency holdings. The Disclosure Letter continued:
"3.6 Our client believes that he may still have negligible cryptoasset holdings in various self-custodial or third-party wallets, and two Trezor hard wallets (which again will be preserved pursuant to the Order); however, he is unable to access the accounts, wallets, or Trezor hard wallet due to the reasons set out above relating to access to the Hard Drive."
The Disclosure Bundle contained historic cryptocurrency trading records to which Mr Darby had access. These included records from the cryptocurrency exchange known as Coinbase (cf. paragraph 2.8(c) of the Disclosure Letter).
"8. I make this witness statement pursuant to paragraph 7 and 14 of the Order.
9. The Provision of Tezos Information [i.e. as required by paragraph 6 of the order, in support of the proprietary injunction] and the Provision of Asset Information [i.e. as required by paragraph 13 of the order] was provided to the legal representatives of the named Claimant/Applicant under cover of a letter dated 11 August 2021 (the 'Letter') [i.e. the Disclosure Letter] with an exhibit bundle [i.e. the Disclosure Bundle] providing evidence concerning the Provision of Tezos Information and the Provision of Asset Information. The letter and exhibit bundle are exhibited hereto marked 'GDl'. For the purpose of this statement I repeat the information referred to in the letter produced at GD 1 and can confirm that the information is true and accurate to the best of my knowledge and belief."
"39. I do not own or control any corporate entity in the UK or abroad and I do not have any off-shore accounts. After selling my Bitcoin and paying the relevant tax on the disposals of my Bitcoin, the proceeds have remained in the UK either as cash in my bank account (which I have used for my day to day living expenses) or property assets that I have brought [sic]."
"16. As stated in paragraph 8 above and further to the First Order I instructed Mackrell to write to Curzon Green, setting out a description of my assets and providing disclosure. Accordingly, on 11 August 2021, Mackrell wrote to Curzon Green listing my various assets and disclosing relevant documentation, including around 3 years' worth of bank statements. My First Witness Statement verifies the information and disclosures contained within the letter dated 11 August 2021.
…
18. As far as I can recall, I believe that it was at the end of 2019 that I stopped trading over the counter with third parties as I felt I had to take a step away from cryptoasset trading due to my deteriorating mental health and memory loss. After 2019 I would occasionally buy, sell and exchange my own cryptoassets using a cryptoasset exchange.
19. As my memory was fading, in order to keep a record of my cryptoasset wallets and trading accounts, but also to keep those details secure, I stored all relevant information pertaining to the majority of my accounts and how to access them on an encrypted hard drive (the 'Hard Drive'). I cannot access the contents of this hard drive as I cannot recall the password. The Hard Drive has however been preserved by me and as I explain below I have taken steps to engage a specialist firm of Wallet Recovery Services to unlock the Hard Drive.
20. As set out in Mackrell.'s letter dated 11 August 2021 and verified in my First Witness Statement, my total assets (including the static caravan) can be summarily described as the following: … [there followed a list of the assets previously disclosed].
…
22. I understand upon reading the expert report produced by the Claimant that the expert, Richard A. Sanders claims that I have control over at least 100 Bitcoin (which would have the approximate value at the time of this witness statements of £4,000,000) and that I have control over various cryptoasset wallet and exchange accounts containing those Bitcoin (and possibly other cryptoassets).
23. As far as I can recall there is not a material amount of cryptoassets that can be accessed and dealt with by using the information contained within the Hard Drive except for maybe a very small amount which may equate to a couple of hundred pounds.
24. I accept that I have access to a Coinbase account and a Kraken account. However, I do not have access to any material amount of cryptoassets now, except for perhaps some fractions which do not have any material value on those accounts. I understand that Mackrell disclosed these accounts and statements under cover of the 11 August 2021 letter.
25. I believe that the only way to determine what of my assets are derived from the sale of the 400k is to undertake a review of all of my cryptoasset account statements in conjunction with a blockchain analysis similar to the one conducted by Richard A. Saunder [sic].
26. I believe the only way to determine if any of the various cryptoasset wallets or exchange accounts that could be accessed using the information on the Hard Drive, contain any material amount of cryptoassets, in particular the asserted 100 Bitcoin, is to access those wallets and accounts by using the information on the Hard Drive.
27. I do not recall the password to access the Hard Drive and therefore, I have instructed Mackrell to engage with an appropriate person who may be able to decrypt the Hard Drive and access the files contained within it.
28. I can confirm that the Hard Drive remains preserved pursuant to the First Order and I would agree to the parties carrying out a collective exercise in order to decrypt it."
"I carried out a neurological examination, which was normal. I repeated the mini-mental state examination. This time he scored 24/30, one less than previously. I also did a PHQ-9 depression score. He scored 11/27, suggesting mild to moderate depression.
We had a long discussion about his difficulties, what may be causing his problems. I explained that the tests did show evidence of cognitive impairment and that possibly he was depressed, although his manner throughout did not suggest someone who was markedly depressed.
At the end, he decided he would now try the antidepressant medication and I would review him after 3 weeks. We agreed that if the medication had no effect that I would refer him back to the memory clinic for further evaluation.
Throughout the consultation, Mr Darby was alert and appropriate. There was no suggestion that he lacked capacity."
"1. In paragraphs 13(4) and 77 to 81 of my First Report, I explained that, even on the basis of the limited information available to me, it was evident that Mr Darby has a present balance of in excess of 100 Bitcoins in self-custodial wallets (the '100 BTC'). My investigations using Mr Darby's very limited asset disclosure in the Disclosure Letter and the Disclosure Bundle strengthens and confirms this conclusion.
2. Mr Darby's Coinbase records show withdrawals from his Coinbase accounts leading to the 5 bech32 self-custodial wallets I identified in paragraph 77(2) of my First Report which hold all but a minute portion of the 100 BTC.
3. As a result of the forensic blockchain analysis carried out in my First Report and my further analysis using Mr Darby's Coinbase records I now assess the likelihood that Mr Darby is the owner of the 100 BTC as certain, and beyond any reasonable doubt.
4. As I set out in paragraph 80 of my First Report, there are a number of transactions which took place on 30 April 2021 (the '30 April 2021 Transactions') between self-custodial wallets which I assess as belonging to Mr Darby: the transactions total 55.47753121 Bitcoin (the '55 BTC') and the 55 BTC comprises over half of the 100 BTC that I assess as currently being owned by Mr Darby. My further analysis in this Second Report means I am certain that Mr Darby executed the 30 April 2021 Transactions and that he owns the 55 BTC. My conclusions in my First Report have been strengthened by Mr Darby's disclosure of the Bitcoin transfers from his account at Coinbase exchange.
5. The timing of the 30 April 2021 Transactions leads me to the conclusion that Mr Darby's narrative in the Disclosure Letter concerning his inability to access his cryptocurrency records and wallet credentials has to be false:
5.1. Mr Darby needed to use and in fact used the wallet credentials for both the sending and receiving wallets in order to carry out the 30 April 2021 Transactions.
5.2. There is no evidence that the 30 April 2021 Transactions involved a hack of Mr Darby's wallets, and Mr Darby has not claimed that these transactions were a hack of his wallets. Further, Mr Darby has not alleged that the 30 April 2021 Transactions involved an OTC trade.
5.3. In those circumstances, this can only lead to the conclusion that, as at 30 April 2021, Mr Darby possessed and utilised the relevant wallet credentials not only for the sending wallets but also for the receiving wallets in order to carry out the 30 April 2021 Transactions.
5.4. As at 30 April 2021, Mr Darby was therefore able to access and in fact utilised BTC wallet addresses which held a very significant amount of BTC belonging to him. This means that his narrative that all such credentials were stored on an encrypted hard drive the passwords of which have been forgotten cannot be factually accurate as at 30 April 2021.
6. The position remains that a complete assessment of Mr Darby's current cryptocurrency holdings is not possible until he provides disclosure of all of his wallet addresses and details of his trading history at various cryptocurrency exchanges. That does not mean, however, that my conclusions above, or those in my First Report, are only provisional in nature. The provision of further disclosure by Mr Darby may reveal other assets held by him: the nature of my blockchain analysis is that Mr Darby's further disclosure (if provided) would not be capable of disproving my existing analysis and conclusions.
7. Furthermore, from my substantial experience of blockchain analysis and exposure to cases involving allegations of wrongdoing, Mr Darby's explanation regarding transferring the data onto a hard drive and then forgetting the credentials, does not ring true to me. It is illogical, especially for someone apparently concerned with having memory loss. I have often come across defendants who seek to impede an investigation into their cryptocurrency dealings with the excuse that they have 'forgotten the password'."
"14. The extremely conservative automated clustering algorithms utilized by tools such as Chainalysis Reactor and WalletExplorer do not cluster all potential wallets, as such algorithms are intended to minimize the amount of work required from a user of those programmes. Additional clustering is indeed possible, and manual clustering is actually the norm in blockchain analysis. The heuristics utilized to determine manual clustering of wallets include the same heuristics that I have already described. In terms of manual clustering, I have never had a false positive in my entire career. I confirm that I have checked the results in my reports by manual clustering and on occasion I have taken the results produced by automatic clustering further by manual clustering."
"19.9. In my First Report, I identified 7 self-custodial wallets which currently hold the 100 BTC belonging to Mr Darby: [these were set out in a table that I do not reproduce here].
19.10. I reached this conclusion as follows … I grouped together the Darby Cluster and Presumed Darby Cluster … It was evident that there were transfers of a very large amount of Bitcoin – in excess of 110BTC – to a set of Bch32 wallet addresses. I had to assess the possibility that the Bch32 addresses could have been third party addresses pursuant to OTC trades with third parties. However, that possibility was extinguished when it became clear that the Bch32 addresses had transacted (by 10 transactions) with the same Binance wallet address as the Darby and Presumed Darby Clusters … Binance only uses one deposit address per account by default. This meant that there was a very great probability – effectively a certainty – that the Bch32 addresses belonged to Mr Darby. As described below, this has been confirmed by his Coinbase disclosure, which has proved my First Report to be correct.
19.11. From the Bch32 cluster …, I was able to identify the transactions whereby Mr Darby sent himself BTC under the transactions listed in paragraph 77(2) of my First Report … The fact that these wallet addresses still hold BTC and derive from the Darby Bch32 cluster allowed me to reach the clear conclusion that the 100 BTC are currently owned by Mr Darby. Even before the Coinbase disclosure, I was sure of this conclusion, but it is now beyond argument as I explain below.
19.12. Further, as set out at paragraph 80 of my First Report, as part of this process I was able to identify that between April and May 2019 Mr Darby appears to have transitioned from one kind of Bitcoin wallet address and software to another: this is illustrated by the fact that funds flow out of the Darby Cluster (which contained Segwit type addresses) into a cluster containing bech32 type addresses. It is these bech32 addresses that have transacted more recently and that took part in the 30 April 2021 Transactions. As I identified in my First Report, I assess these transactions to be evidence of Mr Darby transacting with himself rather than with third parties.
19.13. As noted above, given that Mr Darby has not claimed that his wallet was hacked and there is no evidence of a hack (a hacker would not have left the hacked Bitcoin in the receiving wallet but would have removed it to cover up and further his fraud), and Mr Darby has not claimed that the 30 April 2021 Transactions involved an OTC trade with a third party, my conclusion is that I am certain beyond any reasonable doubt that the 55 BTC the subject of the 30 April 2021 Transactions is owned and controlled by Mr Darby and that he holds the credentials for both sides of these transactions. It is possible that Mr Darby set up a new wallet (with a new seed phrase) or could even be utilizing the same seed phrase with a new passphrase, which would generate/provide access to an entirely 'different set' of public/private key pairs."
"24. This demonstrates by reference to paragraph 77(2) of my First Report and paragraph 19.9 above that 49BTC of the 50BTC, the 1.5735892BTC and the 36.87179917BTC which form part of Mr Darby's current BTC holdings, all derive directly from Mr Darby's Coinbase BTC holdings and the Coinbase Darby Cluster.
25. The fact that I can now tie the majority of the BTC involved in the 30 April 2021 Transactions to wallets which withdraw from Mr Darby's Coinbase account strengthens and reinforces the evidence in my First Report that these are all Mr Darby's wallet addresses. In essence therefore, the limited records provided by Mr Darby further confirm the accuracy of my analysis in my First Report concerning Mr Darby's undisclosed Bitcoin holdings.
…
36. The 30 April 2021 Transactions could only have taken place by Mr Darby having access to his wallet credentials which he must have utilised in order to carry out these transactions and show that he continued and continues to have significant cryptocurrency assets post-January 2021.
37. The 30 April 2021 Transactions are incontrovertible evidence of Mr Darby's activity and that he holds the 55 BTC from those transactions alone."
"42. Mr Darby's narrative regarding his storage of cryptocurrency records and credentials is unlike anything that I have ever observed holders of cryptocurrencies to do, such that in my opinion it lacks credibility. It would be a bizarre and illogical move for an experienced cryptocurrency trader to take all of their personal wallet credentials and store them in the manner that Mr Darby alleges, all the more so if they were concerned that they were suffering from memory loss problems.
43. I understand that this is ultimately a matter for the Court, but I have significant experience of how cryptocurrency users operate, and Mr Darby's explanation makes no sense to me. In my experience, when a party to cryptocurrency transactions alleges memory issues, provides lacklustre and non-responsive disclosure, and claims to have lost critical information for records only they can produce, these are strong indications that a party is trying to cover up unlawful activity.
44. Paragraph 2.6 of the Disclosure Letter alleges that Mr Darby 'saved all information and documentation relating to his various wallets, exchange accounts, and cryptoassets he had control over to an external hard drive which he then encrypted." I find this narrative to be extremely unlikely to be true for numerous reasons:
44.1. Cryptocurrency wallets typically prompt the user to write down a seed phrase. It seems very likely that Mr Darby would have followed such instructions when setting up his cryptocurrency hardware wallets, and there is no explanation of why such written down seed phrases are no longer available. It would make no sense, from a security perspective, to move a written seed phrase on to electronic storage, nor is that common practice for that very reason. Cryptocurrency users utilize hardware wallets as they are 'airgapped' devices (i.e., not connected to the internet), which precludes remote-based attackers from stealing cryptocurrency. Wallet setup instructions, even for non-hardware-wallets, will specify not to store wallet credentials anywhere remotely accessible: this has been and is an industry norm. A hard drive (as to which Mr Darby does not whether it was or was not connected to the internet) is a downgrade, both in terms of security and convenience, than simply following wallet setup instructions: keep a physical copy of your seed phrase, at which point, a user can safely delete wallet applications from their devices. Hard drives are not designed for high-value cryptocurrency credential management: hardware wallets are, and someone engaged in OTC would consider this to be extremely elementary knowledge. Further, a hardware wallet is quite likely to be less expensive than an external encrypted hard drive, depending upon the model (Mr Darby provides no specifics.)
44.2. An absolute and core tendency for cryptocurrency users is never to have a single point of failure. This norm is derived from wallet credential management. The very reason why hardware wallets include a bundled booklet to write down the seed phrase is because electronics can be destroyed, fail, etc. To put all credentials for all wallets (none of which are named or specified by Mr Darby in this production) in one place, an electronic storage no less, is not only extremely reckless from a security perspective, but would require such a degree of additional effort that it readily explains why I have never come across a cryptocurrency user that has executed such an alleged set of actions: it simply makes no sense.
44.3. It is extremely unlikely that Mr Darby took the initiative to export wallet records, such as xPubs and transaction records, to store on this hard drive for record-keeping purposes. If a user has the credentials for a cryptocurrency wallet (such as a seed phrase or a password), they can, at any time, export these records (such as transaction history/xPubs). Consequently, there would be no point of exporting such records if the credentials to generate them were also readily archived and to hand.
44.4. Mr Darby's alleged memory loss was resulting in 'forgetting passwords, wallet details, locations of files'. Mr Darby provides no examples or specifics regarding what wallet software/hardware he utilized, types of credentials, or anything of substance regarding what exactly was allegedly forgotten and/or backed up. In my opinion, which is influenced by my experience in similar circumstances, Mr Darby is attempting to make these issues appear far more involved and complicated than they really are.
…
45. If an individual were concerned that he might be suffering from memory loss, this would be a yet further reason not to act in the bizarre and illogical manner that Mr Darby claims he acted."
"7. As I explain later in this witness statement, although I cannot confirm or deny the statements made in the Expert Report concerning my ownership of a material amount of Bitcoin, if the Expert Report is right that there are cryptoasset wallets that contain 100 Bitcoin then there is a real risk that the information in this witness statement is viewed by a third party, they could use the information in this witness statement to access those wallets and dissipate any assets contained within them."
The main narrative, which included new material, was as follows:
"18. In or around the end of 2017, start of 2018, I felt concerned about my mental health and my fading memory and so I stopped OTC trading and only traded using exchanges by buying and selling my cryptoasset with the view of making a profit from the difference in price. I also carried out a small amount of OTC trading with the cryptoasset Tezos, but nowhere near the scale I had done before. Before I stopped OTC trading, I saved all information relating to those activities on a piece of software saved to the Hard Drive. That software is called Bitdefender Vault ('BVD') and it works as a password-protected file. I recall that I saved all information concerning my OTC trading to this file, and I believe that I wrote the password down on a piece of paper along with the pair or 24 'seed' words to access my Ledger Wallets (that I intend to describe later in this witness statement). I recall that the last time I accessed the BVD file was at the end of 2018. This can be verified by a screenshot I have taken from the properties of the file at page 3.
19. Before I saved the relevant information to the Hard Drive, I purchased two Ledger 2 Nano S hard wallets (the 'Ledger Wallet'). I understand that generally, a hard wallet is a piece of electronic hardware that connects to a computer via a universal serial bus port ('USB'). I believe that the Ledger Wallet is a USB hard drive with proprietary software installed onto it. I understand that the software acts as a user-friendly interface for the creation and subsequent access to a cryptoasset wallet. I configured the Ledger Wallets and as a consequence, I had two new cryptoasset wallets, one on each Ledger Wallet. When configuring and creating a new wallet, I recall that as part of the process, the software created and provided me with 24 'seed' words (the 'Seed Words'), for each of the two Ledger Wallets. I understand the Seed Words to be the only way to access these wallets in the event the Ledger Wallets break, are lost or are reset to factory settings. Upon being provided with the Seed Words, the Ledger Wallet prompted me to confirm that I had written down the Seed Words, and notified me that in the event the Ledger Wallet is lost, the only way to recover the profile containing the newly created wallets would be to use the Seed Words. I wrote the Seed Words down on a piece of paper and recorded them to a word processing document which was saved to the BVD. I believe that I also recorded the password to the BVD file on the same piece of paper, although I cannot be certain of this.
20. During the set-up of the Ledger Wallets, I was asked to enter a memorable pin, which is to be used to access the wallet via the medium of a computer on a day to day basis. I recall the pin for both of the Ledger Wallets to be [pin stated].
21. Once the Ledger Wallets are set up, it may be plugged into a personal computer and would interact with a proprietary piece of software on my personal computer called 'Ledger Live'. This is the visual interface I would utilise in order to receive and send cryptoassets to my Ledger Wallets.
22. Upon the complete set up of the Ledger Wallets, I believe that I would have sent any cryptoassets I wished to trade with on a day to day basis to the newly created Ledger Wallets; I think that I would have sent the vast majority of the cryptoassets I had control over to these Ledger Wallets. As a consequence, this meant that although I did not access the BVD since 2018, I was still able to deal with my self-custodial wallets in the form of the Ledger Wallets. I believe that I was using the Ledger Wallets to trade my cryptoassets generally, up until in or around April / May 2021.
23. In or around this time, the company Ledger, that created and supports the Ledger Wallets, circulated a firmware update to the Ledger Wallets. …
24. I do not recall the precise information that was shown to me at the time of the firmware update, however, upon reviewing the Ledger website, there is an article on how to do it at [address given].
25. It appears that I would have clicked on the notification to update the firmware which would take me to a screen giving me information about the update. It appears that there was a box I would have been required to tick before I could continue with the update. The tick box would have confirmed that 'I have my recovery phrase' (page 9). I ticked this box, recalling that I did in fact have the recovery phrase written down on a piece of paper, as well as it being saved on the BVD. I regret being so careless as to not to check that I did, in fact, have the piece of paper that records the 24 'seed' words for each Ledger Wallet and not checking that I could still access the BVD file. I didn't think anything of it at the time as I had been operating solely using the Ledger Wallets for around two years at that time.
26. Upon completion of the firmware update, it appeared that it had caused the Ledger Wallets to reset to their factory settings. This did not concern me at first as I believed I knew where the piece of paper was with the Seed Words. I began to search my flat and I became incredibly anxious and concerned that I couldn't find the piece of paper that not only records the Seed Words, but also, I believe, the password to access the BVD. Once I had realised what had occurred, I searched my flat from top to bottom over the following weeks, looking for the piece of paper that would have allowed me to recover the Ledger Wallets or hopefully access the BVD.
27. After a couple of weeks of constant searching, I accepted that I could not find the paper, and I accepted that any cryptoassets I had access to using the wallet were likely lost. I understand that this scenario is a common occurrence, and I believe it is why Ledger prompts its users to ensure they have their Seed Words securely recorded.
28. As a desperate attempt, I tried to manually hack the BVD file, by trying a variety of possible characters that it could have been, but this seemed to be an impossible task as I believe the password is 24 characters long. I still occasionally attempt to hack into the BVD file, but I have not had any success. …
…
35. I could not at the time and have not found the piece of paper. When I was served with the Order of HHJ Pelling QC made on 2 August 2021, I again searched my property top to bottom as I knew that in order to give full disclosure of my cryptoasset history and trading, I would need to access the BVD. I was unsuccessful in finding it, and I continue to look for it. At this point in time, I tried to hack into the BVD file once again.
36. It was (and is) at the time of the making of my first, second or third witness statements, of the honest belief that the self custodial wallets that could be accessed by way of the information held within the BVD did not hold any material amount of cryptoassets, this includes the Ledger Wallets.
37. I still cannot say one way or another if the self custodial wallets (or exchange accounts), including the Ledger Wallets, hold any amount of cryptoassets as I simply cannot recall. I cannot confirm or deny if the wallets that the Claimant's expert have identified that hold 100 Bitcoin (paragraph 77 of the Expert Report) are one of the wallets that can be accessed using the information on the BVD (or use of the Seed Words, which I believe are saved on the BVD file).
38. I have not mentioned the Ledger Wallets previous to this because they appear inconsequential to the Claimant's claim, due to the fact they have been reset to factory settings and I believe the wallets created as part of the set-up process can only be accessed using the Seed Words, which I believe are recorded on a word processing document, saved to the BVD file. I also cannot say one way or another how many, if any cryptoassets are on those wallets. I only raise it now, as I have been accused of lying about the matters relating to the Hard Drive and accused that my explanation of the Hard Drive and BVD could not be true."
"101. The key issue concerns the existence of a real risk of unjustified dissipation of assets by Mr Darby that might render enforcement of any future judgment against him more difficult or less effective. …
102. I conclude without serious hesitation that such risk of dissipation exists in the present case. The position before HHJ Pelling QC at the without notice hearing for injunctive relief on 2 August 2021 has become more difficult for Mr Darby as a result of (i) his own incomplete and inconsistent asset disclosure pursuant to the Injunction Order, (ii) his own evidence (including conspicuous omissions) contained in four witness statements served in the meantime, and (iii) the expert evidence of Mr Sanders on behalf of Mr Wang, including the second report served in support of the WFO Variation Application [see the next paragraph, below] and admitted for the purposes of the other applications at this hearing.
103. The available evidence shows that Mr Darby is an experienced and sophisticated cryptocurrency trader with current or potential means of control over many digital wallets and access to different trading exchanges or platforms. The two reports of Mr Sanders demonstrate that Mr Darby holds or held substantial quantities of Bitcoins worth, at current values, far in excess of his disclosed net worth. I make allowance for Mr Darby's mental state and memory impairment, said to have resulted in loss of passwords and inaccessibility of digital wallets or platforms. The inconsistencies, omissions and conspicuous obscurities in some of his explanations raise justifiable doubts about whether the correct or complete position has been disclosed or explained. No application has yet been made for contempt of court, but Mr Darby must know by now that this is in prospect."
"9. … Mr Sanders's reports proved in the view of Mr Housman and, for what it is worth, my view when making the orders originally that the defendant holds or held substantial quantities of Bitcoin worth at current values far in excess of his disclosed wealth. …"
Having summarised Mr Darby's original explanation of his cessation of trading and the conclusions of Sanders 2, Judge Pelling QC continued:
"18. The effect of this material is that as at 30 April 2021, that is after the defendant says he ceased all meaningful dealings and was unable to access his wallets, passwords, and so on, he entered into multiple transactions relating to 55-odd Bitcoin with a value of about, depending on what date is chosen, in excess of £1.5 million. In the result, Mr Darby has 100 Bitcoin, or had, or its traceable equivalent and thus funds well in excess of what is claimed in these proceedings.
19. By November 2021, the defendant's explanation for the points made by Mr Sanders was that the defendant had used to hard wallet to access his crypto wallets but that he was unable any longer to access these because the wallet reset to factory settings following a firmware update.
20 In the course of the hearing, in answer to the point that it was highly improbable that a reputable manufacturer would engineer an update that took effect in such a way, the explanation offered was that the defendant had been warned by the manufacturer that this might be the outcome of the update but that the relevant codes to access the material were available, he thought, to him. These explanations are, in my judgment, highly unsatisfactory and mutually contradictory. The opportunity to deploy technical evidence to answer Mr Sanders has not been taken, I infer because there is no answer to it. Instead, an inherently improbable explanation is offered in effect for the first time that contradicts what has gone before, is entirely self-serving, and is largely uncorroborated and put forward in answer to what is otherwise an almost incontestable case.
…
22. … Given the materially contradictory and self-serving nature of the explanations offered, I am not satisfied that the defendant has discharged the burden on him of showing that he does not have access to assets in excess of the value of the claim. To the contrary, the unchallenged evidence suggests that the contrary is the case. His initial disclosure is untrue on the basis of what Mr Sanders says and, as I have explained, Mr Sanders's evidence has gone entirely unchallenged, despite a more than adequate opportunity for doing so having been provided. The evidence shows that he executed very substantial transactions in April 2021, long after when he had said he had stopped trading in any material way and long after he had said he had lost access to the code which enabled him to access his various wallets. The transactions undertaken were for in excess of 50 Bitcoin which has a value, as I have said, of in excess of the claimant's claim."
The Contempt Application
Procedural history
1. The first ground of contempt is a breach of paragraph 13 (1) of the Order dated 2 August 2021.
The defendant was required to the best of his ability within 5 working days of service of the order to inform the claimant's solicitors of all his assets worldwide exceeding £5,000 in value. Such information was to include a complete inventory of all the defendant's cryptocurrency holdings and precisely where they were located. In breach of paragraph 13 (1) of the order, the defendant's disclosure letter dated 11 August 2021 failed to mention the existence or location of approximately 100 Bitcoin owned by him, which in early August 2021 had an approximate value of US$4million.
2. The second ground of contempt is a breach of paragraph 14 of the Order dated 2 August 2021.
By that paragraph, the defendant was required within 7 working days of service of the order to provide the Claimant's solicitors with a witness statement supported by a statement of truth setting out the information required to be disclosed pursuant to paragraph 13 (1) of the order. For the reasons set out in (1) above addressing the first ground of contempt, the defendant did not provide the information required to be disclosed pursuant to paragraph 13 (1) of the order. The witness statement that he provided dated 13 August 2021 was therefore in breach of paragraph 14 of the order, as it failed to disclose the existence or location of the 100 Bitcoin.
3. The third ground of contempt relates to the defendant knowingly making a false statement in his witness statement dated 13 August 2021 which was verified by a statement of truth.
At paragraph 9 of that witness statement, the defendant stated that the contents of the disclosure letter dated 11 August 2021 were true and accurate to the best of his knowledge and belief. That statement was false, and the Defendant knew that it was false because: (1) the defendant failed to disclose the existence or location of the 100 Bitcoin, which he knew existed; and (2) he affirmed as 'true and accurate' matters in the disclosure letter which he knew were false, including his inability to access his cryptocurrency holdings (which were allegedly on an encrypted hard drive to which he had forgotten the password) and his mental health (which had allegedly caused him to forget the password to the encrypted hard drive).
Sanders 4
"I note that Mr Darby says at paragraph 7 of Darby 4 that he cannot confirm or deny my conclusions. That comment is surprising, because in my experience an owner of such a large and valuable portfolio of cryptocurrency would know if they owned it or not and would have taken extremely rigorous steps to ensure that their wallet credentials were both secure and locatable. I accept, however, that it is not for me to comment on some of the reasons put forward for Mr Darby's stance (including for example, his mental health)."
Whether or not within the proper scope of expert evidence, those comments nevertheless reflect considerations that will fall to be taken into account when assessing the factual evidence.
Relevant law
"28. Although the standard of proof is the criminal standard, it is not, however, necessary that the Court should be sure of any conclusion on a disputed piece of evidence before it can be taken into account. The Court may reach conclusions on the balance of probabilities in relation to disputed pieces of evidence. Such conclusions may be sufficient, when taken together with each other, to satisfy the criminal standard in relation to the essential ingredients which have to be proved to that higher standard."
"150. In order to establish that someone is in contempt it is necessary to show that (i) that he knew of the terms of the order; (ii) that he acted (or failed to act) in a manner which involved a breach of the order; and (iii) that he knew of the facts which made his conduct a breach: Marketmaker Technology (Beijing) Co Ltd v Obair Group International Corporation & Ors [2009] EWHC 1445 (QB)."
"9. It is common ground that for the Claimants to establish each contempt alleged they must prove beyond reasonable doubt in respect of each statement:
(a) The falsity of the statement in question
(b) That the statement has, or if persisted in would be likely to have, interfered with the course of justice in some material respects;
(c) That at the time it was made, the maker of the statement had no honest belief in the truth of the statement and knew of its likelihood to interfere with the course of justice."
Allegation 1
Allegation 2
Allegation 3
Conclusion
Note 1 In a judgment, to which I shall refer further below, within the substantive proceedings, Mr Stephen Houseman QC, sitting as a deputy High Court judge, gave a more detailed summary of the cases being advanced by the parties. With respect to some of the unfamiliar terminology, he explained at [14]: “Tezos offers what is known as a ‘baking’ option whereby individual tokens are utilized so as to yield rewards in the form of additional tokens credited to the relevant account-holder by the global issuer. The underlying activity which constitutes baking involves the signing and publishing of a new block in the blockchain, thereby validating transactions and growing the digital system organically so as to increase its capital base. It is akin to ‘mining’ in other crypto contexts. Baking requires the relevant holder - known as the ‘baker’ - to run a blockchain node with appropriate software and to keep it online and current. There is, in effect, a minimum capital margin requirement for this activity which requires that the baker holds at least 8.74% of the currency being baked by them at any given time. This is known as a ‘bond’.” See [2021] EWHC 3054 (Comm). [Back] Note 2 The order as originally made included, in addition to a Worldwide Freezing Order, a proprietary injunction in paragraphs 4 to 8 of the order. The proprietary injunction was later set aside. It has no relevance to the contempt proceedings, but it is the referent of some passages in the disclosure letter mentioned in paragraph 16 below. [Back]