In its previous decision (made ex parte) the Commercial Court also permitted the applicant to serve its claim on the hackers out of the jurisdiction by alternative methods, including by service on a Croatian cryptocurrency exchange, to which the respondents transferred the stolen tokens. The Court also issued a letter of request to the Croatian authorities seeking assistance in obtaining evidence from the exchange that should identify the hackers.

At the ex parte hearing the proceedings were sealed to preserve confidentiality until such a time as the freezing order had been served on the respondents. The seal was discharged at the return date, having become obsolete.

The applicant is a BVI company that created cross-chain bridges which allow digital tokens to be transferred between blockchains. Hackers were able to exploit the open-source code on which the cross-chain bridge operates and used the hijacked software to (i) steal tokens from private user wallets that were authorised to interact with the bridge and (ii) mint new tokens from projects that operated on the bridge.

The hackers exchanged large quantities of the stolen tokens for stablecoins, some of which were transferred through a mixer fund designed to conceal the origin of tokens that pass through it. Stablecoins were then sent to a centralised exchange located in Croatia, which has likely been used as an ‘off-ramp’ to convert the proceeds into fiat currency.

The applicant, with the assistance of expert forensic advice obtained in the BVI, was able to trace the flow of assets from the wallets that directly received the stolen tokens through to the Croatian exchange, including through the mixer fund. This allowed the applicant to seek disclosure from the exchange, which is expected to hold KYC information that will assist in identifying the hackers. It also provided an avenue by which court documents could be served on the hackers, which was necessary to enable the Court to assume jurisdiction over the respondents and grant the freezing order.

The hacks caused loss to the applicant, in part because it compensated the affected users and projects. It has filed a claim to recover its loss from the persons unknown who carried out the hacks and who own certain digital wallets. That claim is ongoing.

More will follow on this landmark decision, which is believed to be the first of its kind in the BVI.

Harneys acts for the applicant, ChainSwap.