Hackers stole cryptocurrency but the insurance company did not have to pay

hackers cryptocurrency insurance

Insurance and loss

Plaintiffs had a homeowners insurance policy with defendant insurance company. The policy covered personal property owned or used by the plaintiffs with a maximum limit of $359,500 for direct physical loss due to certain perils, including theft. In June 2021, hackers accessed plaintiffs’ computer and stole crypto tokens from their crypto wallets on two blockchain networks, amounting to approximately $750,000. Plaintiffs reported the incident and filed an insurance claim with defendant. Defendant only paid $200 on the claim because of a special limit of liability found in the policy.

Thinking that to be a pretty insufficient payment for such a dramatic loss, plaintiffs sued, alleging breach of contract and unreasonable denial of coverage under a Minnesota statute. Defendant moved for judgment on the pleadings. (“Judgment on the pleadings” in US federal court refers to a ruling made by the court based solely on the parties’ written pleadings and documents, without the need for a trial, when there are no genuine issues of material fact in dispute.) The court granted the motion.

Not direct and physical

Defendant had argued that the theft of digital assets (crypto tokens) did not constitute a “direct physical loss” under the policy, and thus, the claim was not covered. The court analyzed the language of the insurance policy, stating that “direct physical loss” required a distinct, demonstrable, and physical alteration to the covered property. Since crypto tokens are purely digital and lack physicality, according to the court, they do not meet the requirements for “direct physical loss” under Minnesota law.

Plaintiffs claimed that the policy’s language was ambiguous, but the court rejected this argument, applying the ordinary meaning of “direct physical loss” as required by Minnesota law.

The court also addressed plaintiffs’ statutory claim for bad-faith denial of coverage under Minnesota Statute § 604.18. To succeed in this claim, plaintiffs needed to prove that defendant lacked a reasonable basis for denying coverage and acted in reckless disregard of this fact. But since defendant did not breach the policy, the court found that the bad-faith claim failed as well.

Rosenberg v. Homesite Insurance Agency, Inc., 2023 WL 4686412 (D. Minn., July 21, 2023)

From the archives: 

Exploiting blockchain software defect supports unjust enrichment claim

Exploiting blockchain software defect supports unjust enrichment claim

blockchain unjust enrichment
Most court cases involving blockchain have to do with securities regulation or some other business aspect of what the parties are doing. The case of Shin v. ICON Foundation, however, deals with the technology side of blockchain. The U.S. District Court for the Northern District of California recently issued an opinion having to do with how the law should handle a person who exploits a software flaw to quickly (and, as other members of the community claim, unfairly) generate tokens.

Exploiting software flaw to generate tokens

Mark Shin was a member of the ICON Community – a group that includes users who create and transact in the ICX cryptocurrency. The ICON Network hosts the delegated proof of stake blockchain protocol. The process by which delegates are selected for the environment’s governance involves ICX users “staking” tokens. As an incentive to participate in the process, ICX holders receive rewards that can be redeemed for more ICX. The system does not give rewards, however, when a user “unstakes” his or her tokens.

When a new version of the ICON Network software was released, Shin discovered that he was immediately awarded one ICX token each time he would unstake a token. Exploiting this software defect, he staked and unstaked tokens until he generated new ICX valued at the time at approximately $9 million.

Bring in the lawyers

Other members of the community did not take kindly to Shin’s conduct, and took steps to mitigate the effect. Shin filed suit for conversion and trespass to chattel. And the members of the cryptocurrency community filed a counterclaim, asserting a number of theories against Shin, including a claim for unjust enrichment. Shin moved to dismiss the unjust enrichment claim, arguing that the community’s claim failed to state a claim upon which relief could be granted. In general, unjust enrichment occurs when a person has been unjustly conferred a benefit, including through fraud or mistake. Under California law (which applied in this case), the elements of unjust enrichment are (1) receipt of a benefit, and (2) unjust retention of the benefit at the expense of another.

Moving toward trial

In this case, the court disagreed with Shin’s arguments. It held that the members of the community had sufficiently pled a claim for unjust enrichment. It’s important to note that this opinion does not mean that Shin is liable for unjust enrichment – it only means that the facts as alleged, if they are proven true, support a viable legal claim. In other words, the opinion confirms that the law recognizes that Shin’s alleged conduct would be unjust enrichment. We will have to see whether Shin is actually found liable for unjust enrichment, either at the summary judgment stage or at trial.

Examining the elements of unjust enrichment, the court found that the alleged benefit to Shin was clear, and that the community members had adequately pled that Shin unjustly retained this benefit. The allegations supported the theory that Shin materially diluted the value of the tokens held by other members of the community, and that he “arrogated value to himself from the other members.” According to the members of the community, if Shin had not engaged in the alleged conduct, the present-day value of ICX would be even higher. (It will be interesting to see how that will be proven – perhaps one more knowledgeable than this author in crypto can weigh in.)

Shin v. ICON Foundation, 2021 WL 6117508 (N.D. Cal., December 27, 2021)

Scroll to top