CryptoLaw Newsletter #47

Uniswap class action; North Korean hackers and coin-mixer Tornado Cash; DeFi "efficient but risky", says IMF; Delaware court on crypto damages; DeFi developer Cronje to work on "regulated crypto"

Hello everyone,

The theme of the week appeared to be US federal securities laws.

TLDR:

• Uniswap Labs faces US class action, alleging violation of federal securities laws.

• North Korean hackers linked to Ronin hack continue to launder funds through coin mixer Tornado Cash.

• DeFi is “efficient but risky”, says IMF.

• Prolific DeFi developer Andre Cronje switches focus to regulated crypto.

• Delaware court classifies token as  security and determines damages for “volatile” security based on CoinMarketCap valuation.

Top-5 this week:

1. Uniswap Labs was hit with a class action law suit in the US. The claimants accuse the company of allowing fraudulent activity to take place on the decentralized exchange (DEX) Uniswap. The law suit alleges the defendants failed to comply with US federal securities laws and know-your-customer rules. Uniswap Labs should have registered as a broker-dealer, according to the claimants. They want compensation from Uniswap Labs and its investors (including Paradigm and a16z) for the price decrease of the tokens they bought on the DEX. However, there’s one key point that the lawsuit conveniently glosses over: Uniswap Labs is technically distinct from the Uniswap DEX protocol. Uniswap is a decentralized exchange protocol, which anyone with the technical skills can interact with to exchange tokens. Uniswap Labs is the company behind the most commonly used application to interact with the Uniswap DEX protocol. The lawsuit assumes Uniswap Labs controls the Uniswap DEX. The claimants allege that „despite claiming that the Exchange is decentralized, Uniswap has unilaterally delisted tokens from its exchange on multiple occasions.“ In fact, Uniswap Labs delisted tokens only from the user interface it manages, not from the Uniswap DEX protocol as such. The lawsuit also suggests the user interface managed by Uniswap Labs is the only way to use the Uniswap DEX. That’s not true. However, the claim rides on the wave of increased regulatory scrutiny of DeFi. The US SEC also reportedly asked Uniswap Labs for information last year, although there has been no indication of wrongdoing. Perhaps the claimants even felt emboldened by a Harvard journal article taken a legal deep-dive into Uniswap and the UNI token, which concluded that “the SEC may bring charges against Uniswap (or its developers) for operating an unregistered securities exchange”. However, this article, written by a Harvard grad student, also seemed to take for granted that Uniswap Labs controls the Uniswap DEX. If this class action law suit leads to a judgment on the merits rather than a settlement, it will make for interesting reading on what decentralization means.

   John Paul Koning @jp_koning

   If a decentralized exchange lists a pump & dump, who's the guilty party? A class action suit alleges that the creator of Uniswap⁠—Uniswap Labs⁠—is guilty. It failed to register Uniswap as an exchange and promoted the sale of unregistered securities:

2. North Korean hackers linked to the Ronin bridge hack continue to launder funds through coin mixer Tornado Cash. The mixer blacklists the hackers‘ main wallet, sanctioned by the US. However, the hackers found a workaround: they continue to move batches of 100 ETH briefly to a new, non-sanctioned wallet before sending the funds through the Tornado Cash. The coin mixer only blacklists wallets from its front-end, but the blacklisted wallets can still connect to the decentralized back-end through smart contracts. It’s a similar story to the Uniswap one: the front-end user interface can blacklist wallets or tokens, but the decentralized back-end will just keep going regardless.

3. DeFi is “efficient but risky”, according to the IMF. “DeFi offers broad access to players of any size and has no need for custodian service, potentially improving efficiency and financial inclusion”, the Fund wrote. “DeFi has the potential to offer financial services with even greater efficiency, becoming a gravitational force that attracts a large number of crypto investors”. However, it warns about risks in DeFi lending such as price volatility, concentrated token ownership and cyber risks. How should DeFi be regulated? “DeFi’s anonymity, lack of a centralized governance body, and legal uncertainties render the traditional approach to regulation ineffective”, according to the Fund. Instead, in a first step, regulators should regulate centralized entities that enable DeFi, including stablecoin issuers, centralized exchanges and hosted wallet providers, as well as reserve managers (which the IMF doesn’t define), network administrators (also undefined) and market makers. These policy recommendations echoe those of other policymakers, such as the OECD in its DeFi report. The second step, according to the IMF, is to regulate key functions in DeFi, including code development. Regulators could restrict regulated firms from accessing DeFi markets that are not regulated or at least self-regulated.

4. Well-known DeFi developer Andre Cronje built many DeFi projects before leaving… and now announcing his return. Not for another yield-farming protocol, but to focus on regulated crypto: “Instead of trying to fight regulatory bodies because of crypto regulation, we should be trying to engage and educate on regulated crypto.” Cronje and (unidentified) others will “provide, advise, and strategize on regulated crypto access”, including compliant custody, risk & credit reporting, tokenization portals and corporate DeFi bonds.

5. If someone breaches a contract denominated in cryptoassets, how can a court calculate damages? A Delaware court grappled with this question. An ICO issuer had agreed to pay a service provider through tokens. When the issuer refused to make the token-payment, the service provider sued.  First, the court faced the difficult task of legally classifying the token. The lack of regulatory crypto policing was “on full display” in the court case, the judge lamented, citing confusing case law. It applied the Howey test to find the token was indeed a security. The parties had made explicit references to securities law compliance in their contracts, which the court took into account. Next, the court needed to calculate the damages.  “When the consideration to be paid on a contract is in cryptocurrency and the contract is breached, how does the Court calculate the judgment to be entered?”. This was a novel matter to Delaware courts, the judge wrote, especially because of “the volatile and unregulated nature of cryptocurrency”. First, the court needed to find a reliable source for the token valuation and decided CoinMarketCap is such a source. Next, the court needed to calculate damages. For a failure to deliver securities, damages are determined  “by the highest market price of the security within a reasonable time of a plaintiff’s discovery of the breach”. In this case, the court looked at the highest intermediate value of the tokens on CoinMarketCap in the three months before the plaintiff discovered the breach of contract by the ICO issuer.  

_gabrielShapir0 @lex_node

Delaware judge treats cryptocurrency as a security, rather than commodity, for purposes of calculating breach-of-contract damages award. This could be a significant case, will need to dig in.

law360.comDel. Judge Awards $25M In Novel Crypto-Pay Damage Suit - Law360In an apparent first, a Delaware judge has pinned down the value of a normally fluid cryptocurrency for a $25 million breach of contract damage award in a suit filed by a biometric software firm that allegedly encountered cryptic silence after a crypto-consulting job in 2021.

And also…

• A brief overview of crypto regulation per country, worldwide.

• 46 crypto businesses asked the EU to limit disclosure obligations and not go beyond FATF’s money laundering guidance. They also asked to exclude DeFi from the requirement that crypto issuers be legal entities under the draft MiCA Regulation.

• The European Commission received 11,000 comments on its CBDC proposal.

• The crypto industry is wary of indirect US SEC regulation by re-defining “regulated exchanges” and “dealers”.

• The US OCC found Anchorage failed to comply with anti-money laundering rules.

• Bitcoin ownership is “concentrated among young, educated men with high household income and low financial literacy”, according to Bank of Canada research. The survey found that only 5% of Canadians own bitcoin, although awareness is high (80%). However, the survey results are quite old: data collected covered 2018-2020.

• Can France fulfil its crypto ambitions?

• Ireland considering ban on crypto political donations over fears of political interference.

• Law firm Fried Frank on (US) DeFi taxation.

• Blockchain.com co-founder thinks UK “could be a real dark horse in Europe” on crypto regulation.

• After Canada, Australia will have a Bitcoin and Ethereum ETF.

• The Bahamas, home to crypto exchange FTX, will allow citizens to pay taxes in crypto.

• Nearly half of jurisdictions are not requiring crypto companies to comply with know-your-customer rules properly to avoid money laundering, said supranational watchdog FATF.

• Bison Bank became the first bank in Portugal to obtain a crypto license as a Virtual Asset Service Provider.

• Iran will increase penalties for crypto miners illegally using subsidized energy.

• Crypto exchange Binance obtained a money transmitting license in Puerto Rico.

• Australia lays out its crypto regulation roadmap.

• The US Treasury imposed its first sanctions on a crypto miner, targeting Russia-based miner BitRiver. The IMF warned that Russia could uses crypto mining to evade sanctions.

Events

• Stanford, DAO symposium, 2-4 May

• American Bar Association, Legal Governance of Digital Autonomous Organizations, 6 May

Thanks for reading!

Shout out to @jacobrobinsonjd who’s turning this newsletter into a podcast: check out Law of Code.