March 31, 2025 - Over the last decade, year over year, hackers have stolen billions of dollars in cryptocurrencies. Last month, another of the world's largest cryptocurrency exchanges was hacked in what has been called the largest crypto heist in history. The exchange was Bybit, based in Dubai, and the hackers, which according to a public announcement by the FBI are linked to North Korea, ran away with $1.5 billion in Ethereum (ETH).
Unsurprisingly, crypto holders fear being swept up by the next hack and seek government safeguards and fortified technology. After all, unlike cash deposits or securities, digital assets held on an exchange are not afforded protections by the Federal Deposit Insurance Corporation or the Securities Investor Protection Corporation. And robust countermeasures are needed to offset the growing sophistication and tech of the fraudsters.
However, the issue of who owns digital assets — which comes to the forefront when they are stolen, lost or diminished — is a threshold matter that must be considered by any crypto investor that stores digital assets with a third-party platform. Below is a discussion on the factors courts have considered to resolve the ownership issue.
Cryptocurrencies are "stored" in wallets, a software program or hardware device that functionally acts like (but is not truly) a bank account for digital assets. "Hot" wallets connect to the internet and are ready for transactions. "Cold" wallets are off-line devices generally considered more secure for long-term crypto storage.
Wallets work by creating the information needed to transact on a blockchain network, including, most basically, a public address and a private key. The public address is used to receive digital assets from others. The private key, similar to a password, is needed for a user to authorize transactions involving the wallet's assets (if lost, the stored assets may become inaccessible forever).
"Custodial wallets" are where a third party — such as an exchange like Binance or Kraken — manages a wallet containing customer assets and maintains control over the private keys. These wallets are popular for their convenience and ease of use. Having said that, decentralized exchanges (DEXs) are growing in popularity and do not require users to surrender control of private keys, but these exchanges can be more difficult to navigate.
All crypto transactions include a "signature," i.e., the hexadecimal numbers created when a wallet user authorizes a transaction. "Multi-signature" wallets, for added security, require two or more people to authorize a transaction.
Fluid ownership factors
In varying contexts and jurisdictions, disputes have arisen over ownership of digital assets held by third-party custodians on behalf of their customers.
Although the law remains in flux, courts have focused on a handful of key factors, including: (i) whether account agreements specify who owns the assets, (ii) whether the custodian can freely use the assets, (iii) whether the assets are maintained in a segregated or commingled basis, and (iv) who controls the wallet's private keys.
'Crypto winter' bankruptcy decisions
In the Celsius bankruptcy case, for example, the Bankruptcy Court for the Southern District of New York issued a decision in early 2023 concluding that the over $4 billion in assets deposited by customers in so-called "Earn Accounts" belonged to the Celsius estate, to the shock and dismay of Celsius customers. The Court's decision was based on the express language of the relevant terms of use, which granted Celsius "all right and title to such Digital Assets, including ownership rights."
In contrast, in the BlockFi bankruptcy case, the Bankruptcy Court for the District of New Jersey determined, also in 2023, that $300 million in digital assets held in "Custodial Omnibus Wallets" were not property of the debtors' estate and could be repaid to BlockFi's customers. Unlike in Celsius, the applicable terms of service stated that "title to the cryptocurrency held in your BlockFi Wallet shall at all times remain with you and shall not transfer to BlockFi."
Similar disputes overseas
In Cryptopia, a liquidation proceeding involving a New Zealand based crypto exchange, the High Court of New Zealand (functioning as a trial-level court) issued a judgment in 2020 concluding that a single hot wallet holding digital assets on behalf of accountholders created an express trust for those accountholders.
Based on language favorable to accountholders in the relevant terms and conditions, the High Court found that the assets were co-owned by the accountholders, despite that the exchange maintained exclusive control over the wallet's private keys.
Forfeiture proceedings and a bit about ByBit
Criminal forfeiture proceedings are becoming a new forum for crypto ownership disputes. In such proceedings, parties have sought to lay claim to digital assets recovered by the government by alleging control of the private keys of customer wallets. Others have pointed to terms of service language and traced the stolen assets back to their individual wallets using public ledgers.
If assets are ever recovered from the ByBit hack, similar ownership issues could arise. There, the hack took place during a routine transfer of ETH from an ETH multi-signature cold wallet to a hot wallet. ByBit controlled the private keys of the wallets, and customer assets were commingled in them, but the terms and conditions do not address the issue of ownership quite as clearly as in Celsius and BlockFi.
Regulatory guidance remains scant
There is little federal guidance on the issue of ownership of assets held in custodial wallets. That could soon change, as the new administration has signaled a willingness to support the crypto industry, including through the executive order seeking to create a "Strategic Bitcoin Reserve as well as a Digital Asset Stockpile."
In January, the Securities and Exchange Commission rescinded part of Staff Accounting Bulletin (SAB) No. 121, opens new tab, which was widely panned by the crypto industry for requiring certain custodians to report customer assets on their balance sheets as both an asset and a liability. SAB 121, opens new tab was understood to have increased capital reserve requirements and, consequently, discouraged companies from offering custodial services.
Requiring firms to keep customer assets on their balance sheets was also thought by some to increase the risk that digital assets are deemed part of a debtor's estate in the event of a bankruptcy.
Conclusion
Custodial wallets are popular and for good reason, as they are easy and convenient to use. In fact, of the more than half a billion crypto holders worldwide, many are likely using custodial wallets without even realizing it. But as discussed, ownership issues could arise if their custodian becomes insolvent, or if the assets are stolen during a cyberattack and are recovered, or some other unforeseen circumstances occur.
The body of law pertaining to legal ownership of digital assets held in custodial wallets remains small and in flux. Yet, the factors discussed above will likely remain paramount. How a court may apply these or other factors will depend on the particular facts and will be influenced by the ever evolving legal landscape of owning digital assets.
At a minimum, industry participants should review the applicable terms and conditions related to any custodial wallets in which they have an interest and consider their options for long-term crypto storage.
Joseph Cioffi is a regular contributing columnist on consumer and commercial financing for Reuters Legal News and Westlaw Today.
