GOS v Bybit Fintech Ltd (MC 54/2023) [2023] SCSC 821 (10 November 2023)

A. Madeleine, J

Background

1. This is an application by the Government of Seychelles (hereinafter referred to as the “GOS”) under section 4 of the Proceeds of Crime (Civil Confiscation) Act 2008 (hereinafter referred to as the “POCCCA”), for an Interlocutory Order prohibiting the Respondent from disposing of or otherwise dealing with or diminishing the value of the whole or any part of the hereunder described cryptocurrencies -

Items	UID	Description	Estimated Value
1.	40781842	ETHERUM (ETH)	62.266478563 USD120,249.64
2.	40781842	TETHER (USDT)	184, 823.92 USD184,832.92
3.	40781842	BITCOIN (BTC)	4.4549409776215 USD134,482.14
Total			USD 439,564.70

 

2. The GOS also seeks an Order under Section 8 of the POCCCA, appointing Sergeant Hamzah Majah, of the Financial Crime Investigation Unit in the Seychelles Police Force, as Receiver of the above-described cryptocurrencies and for service of all orders made on the Respondent.
3. The application was filed inter partes against Bybit Fintech Ltd, an International Business Company incorporated in Seychelles on 12^th March 2021 with IBC number 226958 having its registered office address at the House of Francis, Room 303, Ile Du Port, Mahe, Seychelles (hereinafter referred to as the “Respondent” or “Bybit”). The Respondent was served with the application on 21^st July 2023 at its registered office address, but despite service, it failed to enter an appearance and/or respond to the application within the prescribed time.
4. On 4^th August 2023, on the application of the GOS, this Court ordered ex-parte hearing of the application with notice on the Respondent. Notice of ex-parte hearing was served on the Respondent at its registered office address on 1^st September 2023. Despite service of the notice, the Respondent failed to appear at the hearing or to file any relevant applications in Court.
5. The hearing proceeded ex-parte on 22nd September 2023, whereat Counsel for the GOS relied entirely on the supporting Affidavit and exhibits produced therein.

 

 

Application and Affidavit in support

6. The grounds for the application are made out in the affidavit of Sergeant Hamzah Majah dated the 18th day of July 2023 (hereinafter referred to as the “Applicant’s Affidavit”). The gist of his depositions are as follows.
7. On 14 July 2023, this Court made an interim order under the section 3 of the POCCCA in respect of the cryptocurrencies referred to under paragraph [1] above.
8. The application for the section 3 interim order and the current application are based upon investigations carried out by the Federal Bureau of Investigation in the United States (hereinafter referred to as the “FBI”) and by the Financial Crime Investigation Unit of Seychelles (hereinafter referred to as the “FCIU”). The FBI referred the matter to the FCIU following their own investigation into a series of waves of cryptocurrency theft involving wire fraud between 20^th February 2023 and 31st March, 2023 leading to the Respondent company in Seychelles. The FBI requested the FCIU to seize the assets found in Seychelles and to transfer the seized assets to the United States.
9. The details of the FBI’s investigation are contained in the statement of Special Agent Roderick Coffin (hereinafter referred to as “Special Agent Coffin”) produced in the Applicant’s Affidavit [Exhibit HM 3]. Upon the request of the Court, the Applicant filed the original statement duly notarised before Notary Public Rebecca Petty of Atlanta, Georgia, United States and apostilled in accordance with the Hague Convention.[1]
10. According to the statement of Special Agent Coffin, on 20^th February 2023, approximately $9.4 million in cryptocurrency was stolen from approximately 24 cryptocurrency wallets. On 5^th March 2023, a second wave of attacks led to approximately $555,000 in cryptocurrency stolen from approximately 16 different wallets. On 6th March 2023, a third wave of attacks led to approximately $1.98 million in cryptocurrency stolen from approximately 1,198 different wallets. Moreover, on 17^th March 2023, a fourth wave of attacks led to approximately $10,508 in cryptocurrency stolen from 378 wallets, and on 31^st March 2023, a fifth wave of attacks led to approximately $77,857 in cryptocurrency stolen from 33 wallets.

 

11. The FBI’ investigation revealed that each one of the affected wallet addresses was managed through a web application called MyAlgo Wallet owned by Rand Labs, Inc. which the users accessed through a customer facing website namely, wallet.mayalgo.com. The said website enabled its users to manage their cryptocurrency wallets from the web browser by storing their “private Key” or “seed phrases” locally on their computer or device. The website wallet.myalgo is delivered to users by the company CloudFlare, an internet infrastructure company that offers content delivery services through a network of more than 200 locations around the world that connect website providers and internet users. CloudFlare enables its customers to make changes to code through the “CloudFlare worker” before it reaches the end-user. In the cryptocurrency thefts investigated by the FBI, the attacker was able to set up a “CloudFlare Worker” and changed the wallet.myalgo.com website before it reached users. The attackers thereby obtained the victim’s private keys and seed phrases in unencrypted form and were able to reconstitute the victim’s wallets on their own device and steal cryptocurrencies from the victims’ accounts.

 

12. The statement of Special Agent Coffin also establish that on 15^th May 2023, Special Agent Coffin was informed by the US-Based outside counsel of the virtual currency exchange company Bybit that they believed that a Bybit account received virtual currency stolen through the MyAlgo Wallet hack and that Bybit had frozen the associated assets. Moreover, Bybit identified the following Algorand transactions (“Attacker Bybit Transactions”) as related to the transfer funds from the MyAlgo Wallet hack to Bybit, namely –

 

UNZAIAQJKHSUC4CZRYMB5KP5VYIGTXAHD5YW66X7SZUHQYNEEQPA

HZSRQHXNZWZWLP6TBQ3VJ623HSMHEYC3HV6Q6DSJ35BBZ7G7CMBQ

ZXSIWGJFURKYZNPVL2RFRP5AKXMAX7KYQFBN2QAOPKKGVRYSA6XQ

REL6WADBNNTNCY4XIAN54GCCIZVOM7TXIWR5DF2VD605KWP7F4YQ

XBAD3YY7AJXS2KHH6KWS46374C4XKZLNI2SYRXFDIVJVKHEE2YYQ

P5TLR4BIILJD4PVVWIJTIHDQBDJ76JWDD6KF2AIP7HQA7QESURPQ

6VUZ6OW4AICCHYATLTOU5RZ47FZTO2WWKT44B6R3DT3HAPLKP3MQ

 

13. Further, according to information available on the publicity available Algorand blockchain, each of the Attacker Bybit Transactions identified above sent Algorand virtual currency from the following Algorand address (“Attacker Address”) KMQG24BRP4ZZWPGDJRDJPC3NQR5MFY5M24WSZGT2EXRYTEFE4YM2YFTV5E to the following Algorand address (“Bybit Address”) BS2URPR7D3OSD4SMIK5QCJGP6CJCHCPQYC2V3D5QPERCOGTYZKDJP2NQ6I.

 

14. In addition, one victim filed a complaint with the Internet Crime Complaint Center (“IC3.gov”) had reported that 1,783.198548 Algo (approximately $402) was stolen from their MyAlgo Wallet on 6^th March 2023. The victim identified their compromised Algorand wallet address as the following Algorand address (“Victim Address”) 2DRMJDCBIEKW3I7OLFME3DFX6CY5UH3BR2HBOCMTYDZVAIL7G6I3NKXXPU.

 

15. Special Agent Coffin’s analysis of the above transactions using a blockchain analysis tool revealed that:

 

1. Algorand stolen from the Victim Address was transferred indirectly to the Attacker Address as shown in exhibit 1 to HM3;

(ii) 7,726 additional transactions received by Attacker Address from 4^th January 2023 through 15 May 2023 and that the vast majority of the transactions were classified as “stolen Funds” by the blockchain analysis tool and specifically identified as related to the “MyAlgo Wallet Hack”.

(iii) From 23^rd April 2023, through 2^nd May 2023, approximately USD $1.2M was transferred from the Attacker Address to the Bybit Address as shown in Exhibit 2 of HM3.

 

16. The Applicant’s Affidavit also show that the FCIU conducted its own analysis. Sergeant Hamza Majah consulted the blockchain where he was able to verify that funds from wallet 2DRMJDCBIEKW3I7OLFME3DFX6CY5UH3BR2HBOCMTYDZVAIL7G613NKXXPU were transferred indirectly to the Attacker Address on the 6^th March 2023.

 

17. Based on information received from Special Agent Coffin to the effect that Bybit had confirmed, by email, that the crypto currency wallet mentioned is under their control in the Bybit crypto currency exchange, the FCIU sent a letter to Bybit requesting further details on the account holder and history of the account. A copy of the FCIU’s letter to Bybit was produced in the Applicant’s Affidavit as exhibit HM5.

 

18. In response to the FCIU’s request, Bybit provided accounts information but could not provide personal information such as KYC on the said accounts. A copy of Bybit’s response to the FCIU was produced in Sergeant Hamza Majah’s affidavit as HM6.
19. Based on the matters stated in Applicant’s Affidavit, Sergeant Hamza Majah is of the belief that -

1. the Respondent is in possession or control of specified property that is to say the property set out in the table appended to the Notice of Motion and as described under paragraph [1] herein and that the said property constitutes direct or indirect benefit from criminal conduct;

 

            (ii) the Respondent is in possession or control of specified property and the said property mentioned in the table appended to the Notice of Motion and as described under paragraph [1] herein and that the said property is the proceeds of criminal conducts namely unauthorized interference with computer data, electronic fraud, theft and money laundering.

 

             (iii)  the total value of property mentioned in (i) and (ii) above is not less than SCR50,000/.

 

20. The Applicant’s Affidavit further clarifies that the grounds for Sergeant Hamza Majah’s belief are based upon –

1. The sworn statement of Special Agent Roderick Coffin in which he explains the modus operandi followed to defraud the victims in order to gain illicit funds;

2. The manner in which the victims were scammed and the subsequent transfer of the cryptocurrency to wallet held at Bybit exchange.
3. The technical aspect of how the wallets of the victims were compromised.

 

21. Based on the explanations given by Special Agent Coffin and his own investigations, Sergeant Hamza Majah is of the belief that the criminal conduct of which the properties have been acquired, in whole or in part, include the unauthorized interference with computer data, electronic fraud, theft of crypto currency and Money Laundering.

 

Law and Analysis

22. Section 4 of the POCCCA empowers the Court, on an inter partes application, to make an interlocutory order prohibiting person(s), whether specified in the order or having notice of the making of the said order, from disposing of, diminishing the value of, or otherwise dealing with the whole or any part of specified property on evidence that –

           “(a) A person is in possession or control of –

1. Specified property and that the property constitutes, directly or indirectly benefit from criminal conduct; or
2. Specified property that was acquired , in whole or in part , with or in connection with the property that directly or indirectly constitutes benefit from criminal conduct and

(b)   The value of the property or the total value of the property referred to in sub paragraphs (i) and (ii) of paragraph (a) is not less than R 50,000.”

 

23. Pursuant to section 9 of the POCCCA, belief evidence based upon reasonable grounds are admissible in proceedings under sections 3 (interim orders) and 4 (interlocutory orders) as evidence that the respondent is in possession or control of specified property and that the property constitutes, directly or indirectly, benefit from criminal conduct or that the property was acquired, in whole or in part, with or in connection with property that, directly or indirectly, constitute benefit from criminal conduct. Such belief evidence is also admissible as to the total value of the property.
24. In Financial Intelligence Unit v Mares Corp (2011) SLR 404 the Seychelles Court of Appeal (hereinafter referred to as the “Court of Appeal”) explained that applications to the Supreme Court under section 4 of the POCCCA should proceed as follows:

           “i.          The applicant (FlU), files an application under section 4 of the Act.

ii.            The applicant supports the application either by affidavit (which discloses reasonable grounds for beliefs under sections 9(1) (a) or (b)) and/ or with other evidence.  Such application and supporting affidavit is served on the respondent.

iii.          The respondent may or may not respond. At this stage there are three different ways of proceeding depending on the facts -

 

1. Where no affidavit or evidence is tendered by the respondent, then the Court proceeds to make the interlocutory order pursuant to section 4 (1) and based on the applicant's application and affidavits.
2. Where an affidavit is filed by the respondent but contains matters which can be resolved by the cross-examination of the respondent, and the applicant so elects, the matter proceeds by affidavit evidence before the Court and the Court grants or refuses the application of the interlocutory order.
3. Where an affidavit is filed by the respondent comprehensively refuting the belief affidavit of the applicant, parties are invited to file further pleadings (plaint, defence etc) in order to proceed to trial according to the Seychelles Code of Civil Procedure. An interlocutory order pursuant to section 4(1) issues in the event.

 

In all the above three eventualities if the Court is satisfied that the respondent is in possession or control of the specified property which are proceeds of criminal conduct (as set out in section 4(1) (a) and (b)), the Court makes an interlocutory order prohibiting the person specified in the application from disposing or dealing with the property unless the respondent can bring evidence to show otherwise, or the making of the order would result in an injustice to any person in which case the onus of proof of establishing that fact shall be on that person.”

 

(emphasis added)

 

25. The Court of Appeal in Mares (supra) also explained that the POCCCA “involves a reverse burden of proof in that once the applicant has provided the court with prima facie evidence, the burden shifts to the respondent to show on a balance of probability that the property is not the subject of crime.”
26. In Financial Intelligence Unit v Sentry Global Securities LTD (2012) SLR330 the Court of Appeal gave the following guidance to courts in dealing with similar applications for interlocutory orders –

“1. On an application by the designated officer of FIU, if it appears to the Court on prima facie evidence (or reasonable belief evidence) of the designated officer of the FIU that the property is the benefit of criminal conduct and the respondent neither appears nor contests the application, the Court must make the order.

2.Where, in response to the prima facie evidence or belief evidence the Respondent engages in the court process, be it by filing an affidavit or by leading direct evidence and is able to show to the satisfaction of the court (on a balance of probabilities) that the specific property is not wholly or partly directly or indirectly the benefit of criminal conduct, the court shall not make an order under section 4 of POCCCA.

3. Where the Court is not satisfied that the respondent has adduced evidence on a balance of probabilities that the property is not the proceeds of crime then the Court shall make the interlocutory order.

4. In a case where the respondent has met the evidential burden, the court should proceed to examine the evidence adduced by the applicant and balance the evidence against the respondent’s in the usual way and decide the issues.”

(emphasis added)

27. Following Mares and Sentry Global LTD (supra), given that these proceedings were held ex-parte after due service of both application and notice of ex-parte hearing on the Respondent without a response, I proceed with the present application based on the Applicant’s documents.
28. I am satisfied that the present application made under section 4 of the POCCCA is supported by the affidavit evidence of Sergeant Hamza Majah exhibiting documents that supports his belief that: (i) the cryptocurrencies described under paragraph [1] hereunder are in the possession or control of the Respondent; (ii) that the said cryptocurrencies constitute, directly or indirectly, benefit from criminal conduct or was acquired, in whole or in part, with property or in connection with property that, directly or indirectly constitute benefit from criminal conduct and (iii) that the total value of the said cryptocurrencies is USD 439,564.70/-. I am satisfied that the belief of Sergeant Hamza Majah is based upon reasonable grounds following reasonable enquiries and investigations as made out in the statement of Special Agent Coffin and annexures thereto, duly admissible in these proceedings, his own investigations and analysis and documents received by the FCIU from the Respondent as exhibited in the Applicant’s Affidavit.
29. I am therefore satisfied that the present application satisfies section 4(1) of the POCCCA and is supported by evidence admissible under section 9 of the same POCCCA, and I proceed to grant the said application.

Order

30. I hereby make the following orders -

1. An Interlocutory Order pursuant to Section 4 of the Proceeds of Crime (Civil Confiscation) Act 2008 (“POCCCA”) prohibiting the Respondent or such other person having notice of the making of this Order, from disposing of or otherwise dealing with or diminishing the value of the whole or any part of the following property:

Items	UID	Description	Estimated Value
1.	40781842	ETHERUM (ETH)	62.266478563 USD120,249.64
2.	40781842	TETHER (USDT)	184, 823.92 USD184,832.92
3.	40781842	BITCOIN (BTC)	4.4549409776215 USD134,482.14
Total			USD 439,564.70

 

2. An Order pursuant to Section 8 of the POCCCA, appointing Sergeant Hamzah Majah as Receiver of all or part of the property referred to under paragraph (a) above to manage, to keep possession or dispose of or otherwise deal with any other property in respect of which he is appointed in accordance with the Court’s direction.
3. A copy of this Order is to be served on the Respondent.

Signed, dated and delivered at Ile du Port on 10th November 2023.

 

 

____________

A. Madeleine, J