Crypto Asset Recovery: Legal Remedies When Virtual Assets Are Stolen or Lost in Hong Kong

Introduction: The Growing Problem of Virtual Asset Losses

The rapid growth of the virtual asset market has been accompanied by an equally rapid growth in virtual asset theft, fraud, and loss. Exchange hacks, rug pulls, phishing attacks, SIM-swapping frauds, and the collapse of unregulated platforms have caused billions of dollars in losses to investors globally. When a victim's virtual assets are stolen or misappropriated, what legal remedies are available?

Hong Kong's courts have been at the forefront of developing a legal framework for virtual asset recovery, recognising the proprietary character of cryptocurrencies and developing the procedural tools necessary to trace stolen assets and obtain effective relief. This article examines the legal remedies available in Hong Kong when virtual assets are lost through theft, fraud, or exchange insolvency.

Are Virtual Assets Property Under Hong Kong Law?

The threshold question in any virtual asset recovery claim is whether cryptocurrencies and other virtual assets constitute "property" for the purposes of Hong Kong law. The answer determines whether victims can assert proprietary claims (which may take priority over other creditors in insolvency), trace stolen assets, and obtain proprietary injunctions.

Hong Kong courts have increasingly recognised virtual assets as property capable of being owned and protected by the law. In Innodeal Ltd v Standard Chartered Bank Hong Kong Ltd [2021] and in subsequent decisions, Hong Kong courts have affirmed that cryptocurrencies have the essential characteristics of property: they are definable, capable of being identified, capable of being assumed by third parties, and have some degree of permanence. This recognition has opened the door to proprietary claims and asset tracing in virtual asset recovery cases.

The Law Reform Commission of Hong Kong published a consultation paper in 2023 recommending legislative recognition of digital assets as property, which would put the position beyond doubt. If enacted, this legislative change would significantly strengthen the legal framework for virtual asset recovery in Hong Kong.

Types of Virtual Asset Loss

Exchange Hacks and Third-Party Theft

A virtual asset exchange hack occurs when malicious actors breach the security of an exchange's systems and transfer virtual assets to wallets under the hackers' control. Victims who held assets on the exchange at the time of the hack face the challenge of recovering assets that have already been moved through multiple wallets and potentially converted to other cryptocurrencies or fiat currency.

Internal Fraud and Misappropriation

Virtual assets may be misappropriated by insiders — including exchange employees, fund managers, or co-founders of blockchain projects — who abuse their access to transfer assets to their own wallets without authorisation. The collapse of several prominent crypto businesses in 2022 — including FTX and Celsius Network — involved allegations of deliberate misappropriation of customer funds by insiders.

Phishing and Social Engineering

Phishing attacks and social engineering tactics can lead victims to disclose their private keys, seed phrases, or exchange account credentials to fraudsters, enabling the fraudsters to access and drain the victim's wallets. These attacks may be sophisticated (involving cloned websites, fake customer support communications, or SIM swapping) and the funds may be moved rapidly once obtained.

Exchange Insolvency

The insolvency of a virtual asset exchange raises complex questions about the legal status of customer assets held by the exchange. If customer assets are held on trust by the exchange for the benefit of customers, they are not available to the exchange's general creditors in insolvency. If, however, the exchange holds customer assets as a debtor (i.e., owes a debt to customers rather than holding their assets), customers rank as unsecured creditors and may recover only a fraction of their losses.

Legal Remedies for Virtual Asset Recovery

Proprietary Claims and Tracing

Where a victim's virtual assets have been misappropriated, the victim may assert a proprietary claim to trace and recover those assets, or their traceable proceeds, from any person who has received them without being a bona fide purchaser for value without notice (the "BFP defence").

Tracing virtual assets on a blockchain is technically feasible: blockchain analytics tools can follow the movement of funds through a chain of transactions, identifying intermediate wallets and potentially linking stolen funds to identified persons or exchange accounts. Companies such as Chainalysis, Elliptic, and CipherTrace specialise in blockchain forensics and can provide expert evidence in support of legal proceedings.

However, tracing becomes significantly more difficult when stolen funds are passed through mixing services (such as Tornado Cash) or are converted to privacy coins (such as Monero) that obscure the transaction history. In these cases, the evidential trail may be broken and the proprietary claim may be defeated.

Freezing Orders (Mareva Injunctions)

A freezing order — also known as a Mareva injunction — is an interim court order that prevents a defendant from disposing of their assets pending the determination of a legal claim. Freezing orders are a powerful tool in virtual asset recovery because they can prevent stolen assets from being dissipated before the victim has had an opportunity to obtain judgment.

Hong Kong courts have shown willingness to grant freezing orders in virtual asset cases, including orders that extend to identified cryptocurrency wallets. The applicant must satisfy the court that it has a good arguable case, that there is a real risk of dissipation of assets, and that the balance of convenience favours the grant of the order.

Norwich Pharmacal Orders

A Norwich Pharmacal order is an order requiring a third party who has become innocently mixed up in wrongdoing to provide information to assist the victim in identifying and pursuing the wrongdoer. In virtual asset cases, Norwich Pharmacal orders have been obtained against cryptocurrency exchanges, requiring them to disclose KYC information (name, address, identification documents) about the holders of wallets to which stolen assets were transferred.

Hong Kong courts have granted Norwich Pharmacal orders against both Hong Kong-based and foreign exchanges, recognising that the disclosure of KYC information is necessary to enable victims to pursue their claims. The threshold for obtaining such an order is that the applicant can demonstrate that the respondent has become mixed up in the wrongdoing and that the information sought is necessary to enable the applicant to pursue its claim.

Proprietary Injunctions

A proprietary injunction preserves assets in which the claimant asserts a proprietary interest pending the determination of the claim. Unlike a freezing order (which is a discretionary remedy designed to prevent dissipation), a proprietary injunction may be obtained as of right where the claimant can demonstrate a seriously arguable proprietary claim to specific assets. In virtual asset cases, a proprietary injunction may be sought to prevent a defendant from moving, selling, or converting cryptocurrency that is traceable to the victim's original assets.

Criminal Proceedings and Law Enforcement

Virtual asset theft and fraud are criminal offences under Hong Kong law, including theft under the Theft Ordinance, obtaining property by deception under the Theft Ordinance, and money laundering under the Organised and Serious Crimes Ordinance. Victims of virtual asset crime should report the matter to the Hong Kong Police Force, which has a dedicated cybercrime unit. Law enforcement authorities can seek production orders and other investigative tools that are not available in civil proceedings.

Challenges in Virtual Asset Recovery

Jurisdictional Complexity

Virtual asset theft frequently involves perpetrators, victims, exchanges, and assets in multiple jurisdictions. Hong Kong courts can grant relief in personam against defendants who are subject to Hong Kong jurisdiction and in rem against assets located in Hong Kong, but the enforcement of Hong Kong judgments in foreign jurisdictions requires separate proceedings in those jurisdictions.

Speed of Asset Movement

Stolen virtual assets can be moved globally in seconds, far faster than traditional asset recovery mechanisms can respond. The speed advantage lies firmly with the thief, and victims who discover a theft must act immediately to identify the assets, obtain emergency legal relief, and notify exchanges that may be holding the stolen funds.

Anonymous and Pseudonymous Perpetrators

Many virtual asset fraudsters operate anonymously or under pseudonyms, making it difficult to identify and serve legal proceedings on the wrongdoer. Norwich Pharmacal orders against exchanges are often the first step in unmasking the perpetrator, but this process takes time and may be frustrated if the perpetrator used anonymous accounts or false KYC information.

Conclusion

The legal framework for virtual asset recovery in Hong Kong is developing rapidly, with courts showing increasing sophistication in applying traditional equitable and common law remedies to the novel challenges of blockchain-based assets. Victims of virtual asset theft and fraud have meaningful legal remedies available, including proprietary claims, freezing orders, Norwich Pharmacal orders, and criminal proceedings, but acting quickly is essential.

Alan Wong LLP's digital assets team has experience advising victims of virtual asset theft and fraud on the full range of legal remedies available in Hong Kong. We work with blockchain forensics experts, international counsel, and law enforcement authorities to develop comprehensive recovery strategies tailored to the specific circumstances of each case. Contact us immediately if you have experienced a virtual asset loss.