I. The 3 Legal Models of Liability

Indian Law Status: Crypto not legal tender, but treated as property / commodity. RBI Circular 2018 struck down by Supreme Court in Internet & Mobile Association of India v RBI (2020) – so exchanges legal, but unregulated. IT Act 2000 Sec 43A, Consumer Protection Act 2019, and Contract Act apply.

II. Indian Legal Framework – Delhi Courts

1. IT Act 2000 – Sec 43, 43A, 66 – Data Protection & Hacking

• If body corporate fails to maintain reasonable security practices and hack occurs → liable to pay compensation under Sec 43A.
• Reasonable security = ISO 27001, CERT-In guidelines.

2. RBI – Cyber Security Framework for Banks & Fintechs – 2016, Digital Lending Guidelines 2022, Master Direction on Cyber Security 2023

• Banks must have SOC, 2FA, risk-based authentication. Failure = contributory negligence.

3. Consumer Protection Act 2019

• Crypto exchange user is "consumer" if exchange provides service for fee (trading fee). Delhi State Consumer Commission has accepted jurisdiction in WazirX hack complaints 2024.

4. Indian Contract Act – Sec 151, 152 – Bailment

• Sec 151: Bailee must take as much care of goods bailed as a man of ordinary prudence would take of his own goods.
• Sec 152: Bailee not liable for loss if took such care – but must prove.

III. Case Laws – Exchange Hack Liability

A. GLOBAL LEADING – CEX HACKS

1. B2C2 Ltd v Quoine Pte Ltd – SGCA (I) 2 – Singapore – 2020 – The First Crypto Exchange Liability Case

• Facts: Quoine exchange hacked / glitch – price feed showed BTC at 10x due to eventual consistency failure. B2C2's bot bought cheap. Quoine reversed.
• Held: Exchange is custodian/broker. Once matching engine executes, trade is FINAL per exchange terms. Exchange cannot reverse claiming system error, unless terms expressly allow. Quoine liable for breach of contract to B2C2.
• Ratio for Hack: If exchange terms define settlement finality at trade execution, hack after that does not allow reversal – exchange bears loss.

2. Mt. Gox Hack – 2014 – 850,000 BTC Stolen – Tokyo District Court – Bankruptcy Case 2015

• Facts: World's largest exchange – hack via transaction malleability bug.
• Held: Tokyo Court: Bitcoin is NOT property (movable) under Japanese law, but is property under bankruptcy – users are NOT owners of specific BTC (no bailment), they are unsecured creditors. Exchange operator (Mark Karpeles) not personally liable unless negligence proved.
• Impact: Led to all modern exchanges adopting "100% cold storage" – failure = negligence.

3. Cryptopia Ltd (In Liquidation) – NZHC – NZHC 728 – Hack Jan 2019 – $30M[2020]

• Facts: NZ exchange hacked, private keys stolen. Liquidators asked: Are crypto assets held on trust for users or company property?
• David Gendall J – LANDMARK:
• Held: Cryptocurrencies ARE property capable of being held on trust. Exchange held crypto on express trust for account holders (per T&Cs saying "held on trust"). Therefore, hacked assets – users have proprietary claim, not just unsecured claim. Remaining assets belong to users, not liquidator for creditors.
• Ratio: If T&Cs say "held in trust / custody" – exchange is trustee, must make good loss unless hack was despite reasonable care.

4. WazirX Hack – July 2024 – $235M – India – The Biggest Indian Case

• Facts: WazirX multisig wallet (Liminal Custody) hacked – North Korea Lazarus Group suspected. WazirX filed moratorium in Singapore, proposed socialized loss – 55% haircut to all users.
• Current Litigation:
• Delhi High Court W.P. – Users Association v WazirX – 2024: Users argue bailment – exchange must bear loss, cannot socialize. Interim application under IT Act Sec 43A for compensation.
• Singapore High Court – Zettai Pte Ltd (WazirX) – HC/OA 2024: Court refused to allow 55% haircut without user vote, ordered enhanced disclosure of security practices.
• Legal issue: Did WazirX have reasonable security (ISO 27001, MPC wallet)? CERT-In report said private key management failure = negligence → liable under Sec 43A.

5. Coincheck Hack – Jan 2018 – $534M NEM – Tokyo District Court – 2020

• Facts: Hot wallet hack.
• Held: Exchange liable to users under bailment. Coincheck voluntarily reimbursed $425M from own funds – court held that if exchange had NOT reimbursed, it would be liable for negligence because storing 100% NEM in hot wallet violates reasonable care.

6. Bitfinex Hack – 2016 – 119,756 BTC – US S.D.N.Y. – Ilya Lichtenstein Case – 2023

• Hack due to BitGo multisig flaw.
• Civil suit – Alagheband v Bitfinex – 2022:
• Court: Bitfinex terms – "Bitfinex is not liable for losses due to hack if took reasonable security". BUT – storing majority in hot wallet with single point of failure = NOT reasonable. Exchange settled for $20M.

B. FINTECH / BANKING HACK – PSD2 / UPI

7. Joby Sebastin v PhonePe – Kerala State Consumer Commission – 2021 – UPI Hack

• User's PhonePe account hacked via SIM swap, Rs 1.2L debited.
• Held: Fintech is payment system operator – must have strong customer authentication per RBI Circular 2019. PhonePe failed to flag new device login + high value – negligent. Liable to refund with 9% interest.

8. RBI Circular – PNB vs. ICICI – Cyber Fraud Liability – Supreme Court – Internet & Mobile Association

• SBI Cards v Union – Delhi High Court – 2022 – Customer Liability in Unauthorised Electronic Banking Transactions – RBI Circular 6 July 2017:
• Zero liability if customer reports within 3 days and bank's contributory negligence. Limited liability Rs 10k-25k if reported 4-7 days. This applies to fintech wallets also.

9. HDFC Bank Ltd v Anup Kumar – NCDRC – 2023 – Netbanking Hack

• Held: Bank liable if phishing happened despite bank having 2FA. Bank must prove customer compromised credentials via negligence. Mere hack of customer device not enough to escape bank liability if bank's fraud detection failed.

C. DEFI / NON-CUSTODIAL – NO BAILMENT

10. Risley v Universal Navigation Inc (Uniswap) – S.D.N.Y. – 2023 – Router Hack / Scam Tokens

• Users lost money via scam tokens traded via Uniswap protocol.
• Judge Failla: Uniswap is software provider, not custodian – no bailment. Not liable under Securities Act for user-deployed contracts. DeFi protocol not exchange under Exchange Act.

11. BProtocol / bZx Hack – UK – Tulip Trading Ltd v Van der Laan – EWCA Civ 83 – 2023 – Bitcoin Hack

• Craig Wright lost 111k BTC in hack, sued 12 developers to force code change to reverse hack.
• Court of Appeal: No fiduciary duty on open-source developers to reverse blockchain hack. Hack finality remains – code is law unless developers voluntarily change.

12. SEC v Poly Network – 2021 – $610M Hack – White Hat Return

• No liability case – hacker returned funds. But SEC statement: If DeFi protocol holds admin keys that can freeze – then it is custodian and liable as exchange.

IV. Liability Decision Tree – For Your Case

Use this in court / complaint:

Q1 – What do T&Cs say?

• "Held in trust / custody / segregated" → Bailment → Strict liability (Cryptopia)
• "Non-custodial / You control keys" → No liability (Uniswap)

Q2 – Did exchange have reasonable security per CERT-In / ISO 27001 / RBI Cyber Security Framework?

Checklist:

• Cold storage >95%? Hot wallet limit?
• MPC / Multisig?
• Penetration testing quarterly?
• Bug bounty?
• SOC 2 Type II?
• Insurance – Crime / Specie?

If NO to 2+ → Negligence under IT Act 43A → Liable (Coincheck, WazirX)

Q3 – Did exchange socialize loss vs own funds?

• Socializing loss (55% haircut) = breach of trust if T&Cs say segregated – illegal under Indian Trust Act.

Q4 – Was hack force majeure?
Courts reject – Hack is foreseeable risk in crypto business. Only state-sponsored zero-day with no patch may be force majeure. Mt. Gox rejected force majeure.

V. Remedies – How to Claim in Delhi

1. File FIR: Sec 66 IT Act – Hacking – at Cyber Cell, Dwarka / IFSO Delhi Police – get 65B certificate
2. Consumer Complaint: District Commission, Delhi – under CPA 2019 – Deficiency of service – Sec 2(11), ask refund + compensation + interest 12%
3. Civil Suit: Specific performance of bailment – Sec 151 Contract Act
4. RBI Ombudsman: If bank / PPI involved
5. Singapore / Foreign Arbitration: If T&Cs have arbitration clause (WazirX has Singapore arbitration) – file under SIAC

Draft Prayer:

• Declaration that exchange held crypto on trust
• Direction to restore account or pay INR value on date of hack (highest value – choose date beneficial to client – Cryptopia says value at date of restoration)
• Damages under IT Act 43A up to Rs 5 Cr per IT Act (now unlimited after 2022 amendment)
• Interest 18% p.a.