“Crypto winter” was a prolonged period of pricing weakness in the cryptocurrency market. It was triggered by U.S. inflation surging to multi-decade highs, prompting the Federal Reserve to aggressively raise interest rates. In response, investors began selling higher risk assets, such as cryptocurrencies and stocks. Falling crypto prices exposed over-leverage among crypto lenders, exchanges, and hedge funds.
The summer of 2022 marked the beginning of an extraordinary series of events in the cryptocurrency market—material withdrawals from platforms industrywide, bankruptcy filings and far-reaching decisions by bankruptcy courts about the future of companies and the disposition of their assets, substantial risks to consumers and investors, and threats to the privacy and security of their personal and financial data.
The January 3, 2023, Joint Statement on Crypto-Asset Risks to Banking Organizations published by the three major federal banking agencies observed that the “events of the past year have been marked by significant volatility and the exposure of vulnerabilities in the crypto-asset sector.” The statement identifies eight crypto-asset risks, many of which affected and may have harmed retail investors and consumers.
Recent events highlight these risks. Many of the largest crypto lenders declared bankruptcy following customer withdrawals, risky practices, and lack of regulation. In all the cases, a freeze on customer withdrawals preceded the bankruptcy filing.
May 8, 2023 Bittrex bankruptcy filing
January 19, 2023 Genesis Global Capital bankruptcy filing
December 21, 2022 Core Scientific bankruptcy filing
November 28, 2022 BlockFi bankruptcy filing
November 16, 2022 Genesis Global Capital, LLC paused withdrawals
November 11, 2022 FTX bankruptcy filing
November 10, 2022 BlockFi limits customer withdrawals
November 2, 2022 FTX/Alameda financial data leaked
October 27, 2022 Core Scientific announced default
July 14, 2022 Celsius Network bankruptcy filing
July 6, 2022 Voyager Digital bankruptcy filing, freezes platform
July 1, 2022 3AC bankruptcy filing
June 14, 2022 Three Arrows Capital (3AC) collapse
June 12, 2022 Celsius freezes platform
May 10, 2022 Terra (Luna) collapses
These bankruptcy filings have underscored how intertwined many of the industry players were. The collapse of cryptocurrencies Luna and TerraUSD in May 2022 brought down Three Arrows Capital (3AC) and wiped out $42 billion in investor value. Voyager Digital Holdings, Inc. filed for bankruptcy in July due to the “crypto winter” and exposure to the now-collapsed Terra. The FTX bankruptcy followed filings by other crypto platforms including Celsius Network, LLC and Voyager. FTX operated as a cryptocurrency exchange on which many other companies depended for, among other things, their asset deployment activities. FTX had also expressed an intent to buy the assets of other distressed cryptocurrency companies. As a result, its bankruptcy created systemic risk to the cryptocurrency industry.
As the crypto bankruptcy cases were filed, regulators issued warnings to consumers about the risks and stepped up their enforcement activities. The U.S. Securities and Exchange Commission (SEC) released the following statement on crypto assets:
You should know that those who are offering crypto asset investments or services may not be in compliance with applicable law, including federal securities laws. These investments also can be speculative, risky, and volatile. If you are considering an investment opportunity involving crypto assets, you may be wondering if it is legal, if it is right for you, or even whether it might be a scam. We urge you to be cautious in considering whether crypto asset investments are appropriate for you.
The Vermont Department of Financial Regulation published three Investor Alerts “to remind Vermont investors to exercise extreme caution when deciding to invest in cryptocurrency. Cryptocurrencies are not functional equivalents of traditional banking, securities, or insurance investment products. There is no lender of last resort, little to no financial disclosures, and usually no insurance protection for losses arising from market fluctuations, theft, or scams.” As decisions in the bankruptcy cases were made, Vermont and other state regulators observed that investors could lose some or all their investments, either due to the company’s insolvency or due to a court’s determination that the company or a third party owns the crypto assets.
Significant legal consequences have ensured for several crypto CEOs. On December 13, 2022, Samuel Bankman-Fried was charged in an eight-count indictment with fraud, money laundering, and campaign finance offenses. Concurrently, the SEC charged Bankman-Fried with orchestrating a scheme to defraud equity investors in FTX Trading Ltd. (FTX), the crypto trading platform of which he was the CEO and co-founder.
An indictment was unsealed on July 13, 2023, charging Alexander Mashinsky, the founder and former CEO of Celsius, with securities fraud, commodities fraud, and wire fraud for defrauding customers and misleading them about core aspects of the company he founded, including Celsius’s success, profitability, and the nature of the investments Celsius made using customer funds. Mashinsky and Roni Cohen-Pavon, Celsius’s former chief revenue officer, were further charged with conspiracy, securities fraud, market manipulation, and wire fraud for illicitly manipulating the price of CEL, Celsius’s proprietary crypto token, all while secretly selling their own CEL tokens at artificially inflated prices. The SEC and the Federal Trade Commission (FTC) filed companion lawsuits that said Mashinsky and Celsius “falsely promised investors a safe investment with high returns” but misled investors about the financial success of Celsius’ business and the price of Celsius’ own crypto asset security was fraudulently manipulated.
Amidst this major enforcement activity, an FTC official announced: “Today’s action banning Celsius from handling people’s money and holding its executives accountable should make clear that emerging technologies are not above the law.”
Ten years ago, many assumed that anyone could use bitcoin to buy or sell goods and services and never be tracked. Over this past decade, law enforcement and forensic scientists have partnered to developed investigative tools that allow them to track bitcoin transactions and bring down criminal enterprises. “The paradox of cryptocurrency is that its associated data create a forensic trail that can suddenly make your entire financial history public information.”
The U.S. Department of Justice prosecutes fraud and market manipulation involving cryptocurrency. Prosecutors use blockchain data analytics and traditional law enforcement techniques to identify and prosecute complex cryptocurrency investment schemes, price and market manipulation involving cryptocurrencies, unregistered cryptocurrency exchanges involved in fraud schemes, and insider trading schemes affecting cryptocurrency markets.
In several crypto cases, the courts were required to balance competing principles of bankruptcy: ensuring transparency of the proceedings versus protecting the privacy of consumer data collected by the companies that filed for bankruptcy. Personally identifiable information (PII) of Celsius investors and records of their recent cryptocurrency transactions were published online in bankruptcy court filings, subjecting them to harassment and phishing attacks. In other cases, the courts ordered that the identifying information of investors be redacted in the bankruptcy schedules.
Section 332 of the Bankruptcy Code makes the protection of consumer privacy an important focus of all bankruptcy proceedings in which personally identifiable consumer records are to be sold. For example, Celsius Network collected and maintained an enormous amount of sensitive personal and financial data about all 1.7 million individual account holders that needed to be protected. The U.S. Trustee took the position that consumers/investors are creditors and, therefore, in the interests of transparency, their names and the records of their recent cryptocurrency transactions must be included by the Debtors in their bankruptcy schedules filed with the court and published online. The Debtors and the Official Committee of Unsecured Creditors (UCC) argued forcefully that identifying information about investors’ personal and financial records should be redacted.
The court ruled in favor of disclosure. On October 5, 2022, the names of 603,497 individual retail customers, along with their recent Celsius account transactions, were published in the Statement of Financial Affairs (SOFA) and Schedules of Assets and Liabilities, Schedule F-1 Non-Priority Unsecured Retail Customer Claims [ECF No. 974, filed 10/5/22, beginning at page 92). The following information was published:
Significant fallout resulted. Someone created a searchable database of the investors’ names and personal and financial data. The most publicized website where the data was published was celsiusnetworth.com. Some Reddit sub-threads had links to the raw data of Celsius schedules/statements of financial affairs. Blog posts online included reports from individuals who were identified in the bankruptcy schedules and subjected to harassment, doxing, and threats.
This outcome should not have been unexpected. Cybersecurity researchers have published reports that it is possible to link personal information, available from the published bankruptcy schedules and from data brokers or web trackers, to a specific bitcoin address. Widespread phishing campaigns followed. Debtors’ counsel Kirkland & Ellis filed four reports with the court advising that account holders have been subject to phishing attacks from someone impersonating K&E employees and representing that they were writing to verify the details of investor claims and impersonating the claims agent Stretto to arrange for the settlement of claims.
Bankruptcy judges in other crypto cases have entered contrary rulings. In light of the harm experienced by the Celsius investors, the individual cryptocurrency creditors in the FTX and BlockFi cases, for example, asked the courts to protect the confidentiality of their personal data. The U.S. Trustee opposed their requests and argued that disclosure “is a basic premise of bankruptcy law. . . fundamental to the operation of the bankruptcy system and . . . the best means of avoiding any suggestion of impropriety that might or could be raised.” “The public has a right of access to judicial records.”
On June 9, 2023, the court ruled that FTX can permanently redact the names of individual customers from its bankruptcy filings, after hearing testimony that publishing customers’ names would place them at risk even if other identifying information such as their e-mail address was kept secret. “It is the customers who are the most important issue in this case,” Judge John Dorsey said. “We want to make sure that they are protected and they don’t fall victim to any types of scams.”
In its work focused on cybersecurity risks to financial institutions, the Carnegie Endowment for International Peace found that “[c]ybersecurity risks to the financial system have grown in recent years, in part because the cyber threat landscape is worsening; in particular, state-sponsored cyberattacks targeting financial institutions are becoming more frequent, sophisticated, and destructive.” The Carnegie Endowment published a timeline that chronicles approximately 200 cyber incidents targeting financial institutions since 2007. The timeline can be filtered by country, region, year, attribution, incident type, and actor type.
More than $2 billion in digital currency was stolen in hacks in 2021.” Further, over $1.9 billion was stolen in cross-chain hacks in the first half of 2022. Cyber criminals have exploited vulnerabilities in the digital assets infrastructure, as well as compromised individual accounts to steal cryptocurrency assets. Huge losses and disruption to investors and companies have resulted from the various types of attacks on cryptocurrency platforms and investor accounts. The hacker attacks are both profit-driven, as well as motivated by a desire to disrupt crypto exchanges. Additionally, crypto exchanges have been used to facilitate illegal activities.
Over the past three years, the FBI has issued numerous warnings to investors that cyber criminals are increasingly exploiting vulnerabilities in decentralized finance (DeFi) platforms to steal cryptocurrency, causing investors to lose large amounts of money. The FBI advised that “[c]yber criminals seek to take advantage of investors’ increased interest in cryptocurrencies, as well as the complexity of cross-chain functionality and the open source nature of DeFi platforms.”
In August 2022 the FBI warned that criminals are targeting smart contracts governing DeFi platforms to steal investors’ cryptocurrency. A smart contract is a self-executing contract with the terms of the agreement between the buyer and seller written directly into lines of code that exist across a distributed, decentralized blockchain network.
On November 4, 2021 the FBI warned that scams involving cryptocurrency ATMs and QR codes are on the rise. Cybercriminals have started to abuse QR codes to receive fraudulent cryptocurrency payments from their victims.
The FBI issued a Private Industry Notification (PIN) on July 9, 2021, focused on the multiple methods criminals have used to “ransack crypto-wallets.” Attackers are using several tactics to steal and launder cryptocurrency, including technical support fraud, SIM swapping (aka SIM hijacking), and taking control of their targets’ cryptocurrency exchange accounts via identity theft or account takeovers.
The FBI San Francisco Division warned: “The FBI has seen an increase in the use of SIM swapping by criminals to steal digital currency using information found on social media. This includes personally identifying information or details about the victim’s digital currency accounts.”
A federal indictment unsealed in February 2021 charged three North Korean computer programmers with participating in a wide-ranging criminal conspiracy to conduct a series of destructive cyberattacks, steal and extort more than $1.3 billion of money and cryptocurrency from financial institutions and companies, create and deploy multiple malicious cryptocurrency applications, and develop and fraudulently market a blockchain platform. More recently, criminal charges were brought against the Russian owner of a cryptocurrency exchange that is alleged to have facilitated a “darknet market” for ransomware proceeds, fraudulent ID documents, and money laundering.
Since 2019 the Department of Justice has charged cryptocurrency fraud cases involving over $2 billion in intended financial losses to investors from around the world. The SEC has focused enforcement on the rapidly evolving crypto asset securities space. It brought more than 30 cases in 2022 and 2023 against cryptocurrency companies and executives for potential violations of federal securities laws, and in some cases for defrauding investors.
Following numerous investor complaints to the court and a motion by the U.S. Trustee, the court appointed an examiner to investigate certain account management activities and fraud arising from the pre-bankruptcy business activities of Celsius companies. In her final report, the examiner found, among other things, that Celsius did not properly segregate or account for customer assets, incurred large losses on risky investments and loans made with customer assets, engaged in substantial market manipulation of the CEL token, and that its former CEO, Alex Mashinsky, made false and misleading statements to investors.
She found that while the Celsius marketing strategy advertised low risk and high returns, the company promoted its native CEL tokens—purportedly to provide rewards to CEL investors—even though employees said CEL was “worthless” because there was no market for them outside the Celsius platform.
In his First Interim Report to the FTX Independent Directors, newly appointed CEO John J. Ray III documented control failures at the FTC exchanges. These are his findings:
As a key part of the bankruptcy court process, companies (the debtor(s)) must develop and obtain court approval for a chapter 11 plan to emerge from bankruptcy. 11 U.S.C. § 1121(b), 1123. Thus, critical decisions about the future of the companies and the disposition of their assets are being made by the bankruptcy courts, as well as how the privacy of the data of many millions of customers/ investors collected by the companies prior to their bankruptcy filings will be protected.
Below are some of the highlights of the novel solutions crypto companies have proposed, while at the same time navigating significant legal challenges and enforcement actions by federal and state regulators.
Bittrex, Inc. U.S. Bankr. No. 23-10598-BLS, D. Del. (May 8, 2023)
Bittrex Inc., a U.S. crypto exchange, sought bankruptcy court permission to borrow as much as 700 bitcoin from its parent company, Aquila Holdings Inc. (which is not in bankruptcy), to fund the planned chapter 11 wind down of its U.S. operations and a proposal for repaying customers. The loan from its non-bankrupt parent would be repaid in bitcoin. Bittrex said in court papers that Aquila required bitcoin to be used so it could avoid “potential negative tax consequences” that would have also made the loan more expensive. The Bittrex case is notable for the bankruptcy court authorizing a debtor to obtain post-petition financing solely in bitcoin (BTC) from the debtor-in-possession (DIP) lender.
The SEC charged Bittrex and its former CEO Bill Shihara with operating an unregistered national securities exchange, broker and clearing agency in violation of federal statutes. The complaint alleged that Bittrex worked with crypto issuers who sought to have their crypto assets made available for trading on Bittrex’s platform to first “delete from public channels ‘problematic statements’“ that Shihara believed would lead a regulator, such as the SEC, to investigate the crypto asset as the offering of a security.
Genesis Global Capital, U.S. Bankr. No. 23-10063, S.D. N.Y. (Jan. 19, 2023)
Genesis is one of the largest crypto lenders, owned by venture capital firm Digital Currency Group (DCG). To resolve the bankruptcy case, Genesis intends to sell its assets and/or raise capital. Further details will be provided during the bankruptcy process.
In January 2023 the SEC filed charges against Genesis for the “unregistered offer and sale of securities to retail investors through the Gemini Earn crypto asset lending program.” As of May 2023, Genesis class-action lawsuits filed across the country were in the early stages, and there have been no court-approved settlements or jury verdicts.
Core Scientific, U.S. Bankr. No. 22-90341, S.D. Tex. (Dec. 21, 2022)
Core Scientific is one of the largest publicly traded cryptocurrency mining companies.
A restructuring plan could be finalized by September 2023. The company expects to exit bankruptcy proceedings with an additional $46 million due to recent favorable market conditions. It pointed to decreasing power costs, increasing bitcoin prices, and an increase in the blockchain’s hash rate as the primary market factors contributing to its liquidity increase.
BlockFi, U.S. Bankr. No. 22-19361, D. N.J. (Nov. 28, 2022)
The court approved crypto lender BlockFi’s request to sell its remaining assets. The assets for sale could potentially include the multitude of crypto-mining equipment that the company holds. It received court permission on May 11, 2023, to return $297 million to customers with non-interest-bearing accounts, without repaying customers who had tried to move funds into those accounts at the last minute.
The SEC brought charges against BlockFi Lending LLC for failing to register the offers and sales of its retail crypto lending product, and, in a first-of-its-kind action against crypto lending platforms, for violating the registration requirements of the Investment Company Act of 1940. BlockFi reached a settlement with the SEC and most U.S. states in February 2022 arising from allegations that BlockFi was engaged in an unregistered securities offering. The bankruptcy filing may affect BlockFi’s ability to meet its financial obligations under that settlement.
FTX Trading Limited, U.S. Bankr. No. 22-11068 (JTD), D. Del. (Nov. 11, 2022)
FTX, a Bahamas-based crypto exchange, appointed new management who reported that they have identified and collected over $7 billion in assets available for creditor recovery. The Debtors have not yet determined how they will utilize their customer lists consisting of more than 9 million names and addresses: whether they will be utilized as part of a reorganization or monetized through a sale process.
Numerous federal regulators and law enforcement agencies have taken legal action against former CEO Sam Bankman-Fried and others arising from pre-bankruptcy fraud and other illegal activities (discussed above).
Celsius Network, U.S. Bankr. No. 22-10964, S.D. N.Y. (July 14, 2022)
Celsius’ primary operations consisted of: (a) financial services through which retail, corporate and institutional users could (1) earn rewards on cryptocurrency they transferred to Celsius, (2) securely store and access cryptocurrency, (3) borrow fiat using cryptocurrency as collateral, and (4) send and receive cryptocurrency using Celsius’ CelPay services; and (b) bitcoin mining.
In lieu of an outright sale to a third party and/or a potential competitor, the Debtors have developed a plan for the creation of a new public corporation (NewCo) with professional management that will be owned primarily by shareholders; larger customer creditors will receive equity interests. Through a “recovery corporation,” the value of the Debtors’ assets, including the Debtors’ liquid and illiquid cryptocurrency, loan receivables, mining assets, and proceeds from litigation claims, will be distributed to account holders. The new company intends to affiliate with third-party providers that are regulatorily compliant. The plan will establish a “Litigation Trust” to fund successful fraud judgements against the CEO and officers.
Protecting the privacy of the 1.7 million Celsius consumers/investors is an important aspect of the bankruptcy process. The data of the 600,000 investors with current accounts will be migrated to the new retail assets platform in NewCo. The personal and financial data of the 1.2 million inactive account holders will never be sold to another company, safeguarding the consumers from marketing and advertising campaigns that could put their data at risk of cyber attacks. The personal and financial data will only be retained as long as required by Treasury, IRS and other agency Know Your Customer (KYC) and Bank Secrecy Act (BSA) requirements and will be maintained in the wind down trust. A data retention and disposition plan will ensure that the confidential data is disposed of as soon as is permitted by law and in accordance with applicable federal, state and EU/country data disposal laws.
Voyager Digital Holdings U.S. Bankr. No. 22-10943, S.D. N.Y. (July 5, 2022)
Voyager, a New Jersey-based crypto lender, filed for bankruptcy after Three Arrows Capital (3AC) defaulted on a crypto loan worth more than $650 million. It has 3.5 million active users. Voyager had expected to move its bankruptcy quickly, having reached an agreement in September 2022 to sell its assets for $1.4 billion in crypto to FTX. The proposed sale fell through following the implosion of FTX, and Voyager reopened discussions with other potential buyers.
Voyager received initial court approval in January 2023 for a proposed $1 billion sale of its assets to Binance.US. In light of Binance’s significant ties to China, Voyager sought to expedite the U.S. CFIUS national security review. In March 2023 Voyager’s proposed sale was opposed by the SEC and state securities regulators. The SEC warned that the sale of the VGX token could involve the unlawful sale of unregistered securities, and the FTC said it was investigating Voyager for deceptive marketing, while Texas regulators said creditors weren’t properly warned of legal risks.
Binance US terminated the agreement (Asset Purchase Agreement (APA)) and will not acquire the customer accounts. In response, Voyager announced that it would pivot to self-liquidation and begin the partial distribution of crypto assets to customers by restarting its platform. The financial return to customers is expected to be slightly lower under the liquidation than it would have been under the APA, but the details will depend on the costs of the liquidation and prevailing crypto prices. Further hearings are expected in the coming weeks.
Three Arrows Capital, U.S. Bankr. No. 22-10920-mg, S.D. N.Y. (July 1, 2022)
This Singapore-based crypto hedge fund was the first major crypto firm to go bankrupt in 2022, brought down by the collapse of cryptocurrencies Luna and TerraUSD in May.
3AC was reported to have $10 billion in cryptocurrency earlier in 2022. It began bankruptcy proceedings in the British Virgin Islands in June. Professionals overseeing the 3AC liquidation said that its founders fled overseas and are not cooperating with efforts to recover assets for creditors.
Executive Order (EO) 14067 on Ensuring Responsible Development of Digital Assets (2022) and high-profile federal initiatives have focused on consumer and investor protection, among other issues, in the cryptocurrency arena. EO 14067 addressed the risks and potential benefits of digital assets and identified six key priorities the U.S. should pursue: consumer and investor protection; promoting financial stability; countering illicit finance; U.S. leadership in the global financial system and economic competitiveness; financial inclusion; and responsible innovation. On September 16, 2022, the White House released a report on “Protecting Consumers, Investors, and Businesses” that made the following observations:
Digital assets pose meaningful risks for consumers, investors, and businesses. Prices of these assets can be highly volatile: the current global market capitalization of cryptocurrencies is approximately one-third of its November 2021 peak. Still sellers commonly mislead consumers about digital assets’ features and expected returns, and non-compliance with applicable laws and regulations remains widespread. One study found that almost a quarter of digital coin offerings had disclosure or transparency problems—like plagiarized documents or false promises of guaranteed returns. Outright fraud, scams, and theft in digital asset markets are on the rise: according to FBI statistics, reported monetary losses from digital asset scams were nearly 600 percent higher in 2021 than the year before.
The White House report emphasized the importance of “[d]eveloping, designing, and implementing digital assets in a responsible manner that includes privacy and security in their architecture, integrating features and controls that defend against illicit exploitation, and reducing negative climate impacts and environmental pollution.”
The SEC has begun an expansive enforcement approach toward crypto companies. The Commission sued Binance and Coinbase, two of the largest crypto trading platforms, It charged them with violating securities laws meant to shield against conflicts of interest and provide basic disclosures to investors. The charges against Binance included operating unregistered exchanges, broker-dealers, and clearing agencies; misrepresenting trading controls and oversight on the Binance.us platform; and the unregistered offer and sale of securities. “Through thirteen charges, we allege that Zhao and Binance entities engaged in an extensive web of deception, conflicts of interest, lack of disclosure, and calculated evasion of the law,” said SEC Chair Gary Gensler.
On June 6, 2023, the SEC charged Coinbase, Inc. with “operating its crypto asset trading platform as an unregistered national securities exchange, broker, and clearing agency.” It was also charged for the unregistered offer and sale of securities in connection with its staking-as-a-service program. SEC Chair Gary Gensler said:
Coinbase’s alleged failures deprive investors of critical protections, including rulebooks that prevent fraud and manipulation, proper disclosure, safeguards against conflicts of interest, and routine inspection by the SEC. Further, as we allege, Coinbase never registered its staking-as-a-service program as required by the securities laws, again depriving investors of critical disclosure and other protections.
Likewise, governments around the globe are addressing these and other challenges with digital assets. Watch for significant developments in the cryptocurrency market in the coming months and years.