Fiduciary duties in the context of digital assets | Katherine Harper

The Tulip Trading case should provide welcome clarification on the rights of digital-asset owners and dev…

The Tulip Trading case should provide welcome clarification on the rights of digital-asset owners and developers’ duty of care. Katherine Harper of Goodwin provides analysis.

On 8 February 2020, Dr Craig Wright, CEO of Tulip Trading Limited (TTL), discovered that a few days earlier, the personal computers located at his Surrey home had been hacked and the private keys to Bitcoin of very significant value owned by TTL had been lost. Private keys are complex passkeys which not only allow the holder to make crypto transactions but also act as proof of ownership of digital assets, and it is understood these keys were copied and then deleted. Other confidential information and documents in Wright’s computer and network had also been taken. The result of the hack and the loss of the private keys meant that TTL no longer had possession of or access to the Bitcoin it says it owns. What makes the story even more compelling is that Wright alleges that he is Satoshi Nakamoto, the inventor of Bitcoin and the person who wrote the original Bitcoin code, and the author of Bitcoin: A Peer-to-Peer Electronic Cash System. If true (a matter which the courts are expected to consider in due course in other cases involving Wright), it demonstrates that even the most sophisticated of digital-asset users may be the subject of successful hacks. 

Bitcoin is one of thousands of different cryptocurrencies (or, to use the Financial Conduct Authority’s terminology, ‘exchange tokens’). As a research briefing on cryptocurrencies published by the House of Commons library last month helpfully explains, all cryptocurrencies “use distributed ledger technology (DLT) to verify transactions… In DLT, transactions are confirmed by a wide range of participants [miners] before being added to a permanent record. The most familiar version of that record is the blockchain, as used by Bitcoin. The number of confirmations and public records in the blockchain should, in theory, make retrospective changes to the record virtually impossible”. The briefing also points out that, unlike traditional ‘fiat’ currencies such as sterling or euros, whose “value and reliability are guaranteed by governments and central banks”, cryptocurrencies such as Bitcoin essentially “rely on trust in algorithms and technology”. A key feature of DLT is that the public ledger will show that a transaction has taken place and record the location of the asset on the network but it does not reveal the identity of the parties to the transaction: assets will simply be shown as being held at a digital address. 

The decentralised and anonymous nature of DLT is, for many, why it is so attractive. Yet, at least at present, these are precisely the characteristics that are problematic when it comes to ‘stolen’ keys or fraudulently acquired digital assets. Identifying the person or entity who is in possession or control of particular digital assets can be very difficult, particularly when cryptocurrencies have been put through ‘mixers’ or ‘tumblers’, processes designed to muddle cryptocurrencies from different sources to further embed the anonymity of the parties to transactions. In some instances, interim relief in the form of freezing orders or proprietary injunctions on ‘persons unknown’ who are in possession or control of digital assets can be obtained in order to try to preserve and protect those assets. However, depending on the circumstances of the case, such relief may not become effective until the assets surface in a place or environment where any such orders are more likely to be complied with. For example, if some stolen cryptocurrencies were to surface on a centralised exchange (exchanges which, similar to a bank, become the owner of the cryptocurrency with the customer having the right to call on it), it may be possible to secure control over it.  

TTL did not have – and still does not have – knowledge of who hacked, copied and deleted the keys to its Bitcoin. In response to the hack, TTL launched proceedings in London against those it considered to be the core developers or otherwise in control of the software used on four relevant digital-asset networks, referring to them as ‘developers’. TTL’s position is that, in controlling the software for the relevant networks, the developers have – and exercise – control over property held by others. As such, TTL alleges it is owed fiduciary obligations by each of the developers and (or alternatively) that the developers owe a tortious duty of care. A key part of the relief that TTL is seeking is for the developers transfer the Bitcoin held in the addresses which TTL cannot access (having had the private keys removed from its control) to a new address to which TTL holds the private keys. This, says TTL, would be in accordance with the duties it alleges the developers owe and would be affected by the developers creating a software patch, something which it says is not technically difficult. However, in summary, the developers deny that they owe such duties. In addition, they argue that producing a software patch is not realistic because the miners (those who validate transactions) would refuse to run such a patch leading to a ‘fork’ in the network and, in turn, this would create a new network rather than solve the problem. 

As none of the developer defendants were in the jurisdiction, TTL had to seek permission to serve the defendants out of the jurisdiction, requiring it to satisfy the court of three matters: first, that there is a serious issue to be tried on the merits of the claim; second, that there is a good arguable case that the claim falls within one or more of the ‘jurisdictional gateways’ under the Civil Procedure Rules for which permission for service out of the jurisdiction may be granted; and third that, weighing up all the circumstances, England is clearly or distinctly the appropriate forum for the trial of the dispute and that the court ought to exercise its discretion to permit service of the proceedings out of the jurisdiction. Initially, TTL was granted permission to serve the defendants out of the jurisdiction but fourteen of the defendants challenged jurisdiction and applied to set aside service. In March 2022, Mrs Justice Falk concluded that service should be set aside because she considered that while the second and third elements had been met, she did not consider that TTL had demonstrated there was a serious issue to be tried and concluded that there was no realistic prospect of establishing that the facts pleaded amounted to a breach of fiduciary or tortious duty owed by the defendant to TTL.

By contrast, the Court of Appeal concluded in February this year that there was a realistic argument that developers owe fiduciary duties to owners of digital assets and therefore there was a serious issue to be tried. In drawing all the threads together, Lord Justice Birss, giving the leading judgment, said: “…there is, it seems to me, a realistic argument along the following lines. The developers of a given network are a sufficiently well-defined group to be capable of being subject to fiduciary duties. Viewed objectively the developers have undertaken a role which involves making discretionary decisions and exercising power for and on behalf of other people, in relation to property owned by those other people. That property has been entrusted into the care of the developers. The developers therefore are fiduciaries. The essence of that duty is single-minded loyalty to the users of bitcoin software. The content of the duties includes a duty not to act in their own self-interest and also involves a duty to act in positive ways in certain circumstances. It may also, realistically, include a duty to act to introduce code so that an owner’s bitcoin can be transferred to safety in the circumstances alleged by Tulip.”

Lord Justice Birss rounded off his judgment commenting that if the “decentralised governance of Bitcoin is really a myth, then in my judgment there is much to be said for the submission that Bitcoin developers, while acting as developers, owe fiduciary duties to the true owners of that property”. 

Whether or not developers do owe fiduciary duties to the owners of digital assets and whether or not that duty extends to developing software patches to enable the return of stolen digital assets to their rightful owners is a matter which will be decided by the court in due course. The case is currently at an early stage but if it is ultimately found at trial that there is no such duty owed or such a duty does not extend to software patches in the way that TTL contends, then in some circumstances users of digital assets may potentially be left with very little in the way of effective remedies – a thought which chimes with the criticism from some quarters that the digital-asset industry is the ‘wild west’. However, a finding that fiduciary duties are owed in the manner contended by Tulip Trading would have significant implications for the notion of decentralisation as the governing principle of DLT and may call into question the basis for faith in the algorithm.

More generally, the Tulip Trading case will be decided at a time when the UK government is working towards its declared ambition to make the UK “a global crypto-assets hub”. Various consultations and initiatives on the law and the regulation of digital assets have been launched, indicating that the direction of travel is to ensure that English law and regulation is fit to manage and support the growth of digital-asset usage. As observed by Sir Geoffrey Vos, Master of the Rolls, in a speech given last July at the Bank of England, the law “underpins all banking, trade and financial services” and “provides the glue that gives investors, traders and even governments the confidence to take economic risks nationally and internationally”. It follows that if the government’s vision is to be realised, then the law and regulation concerning digital assets must be capable of fostering the confidence the Master of the Rolls refers to. Logically, this must include the protection and enforcement of ownership rights – something which the case of Tulip Trading brings into sharp relief. 

Katherine Harper is a knowledge management lawyer at Goodwin in London