Cybersecurity Awareness Month: lessons in recovering stolen Bitcoin

October is Cybersecurity Awareness Month. As part of that, we look at the recent Court of Appeal decision in Gary Jones -v- Persons Unknown [2026] EWCA Civ 1212, which highlights some of the challenges involved in recovering assets following cyber fraud and the risks of relying on inaccurate cryptocurrency tracing evidence.

Background

The Claimant (Mr Jones) responded to an online advertisement targeting individuals and promising high returns from cryptocurrency investment on a platform (‘the EP Platform’). He was led to believe that the EP Platform was a legitimate online cryptocurrency trading exchange, and he invested heavily in Bitcoin, spending nearly £0.5 million which he transferred to the EP Platform. In total he purchased around 89.6 bitcoin.

Mr Jones claimed that the EP Platform was in fact simply a vehicle for a large-scale cyber fraud committed by unknown fraudsters located overseas. Although Mr Jones's account on the EP Platform appeared to show large profits from supposed trades, these were entirely fictional. The fraudsters simply stole the Bitcoin. When Mr Jones asked for his money back, he received some minimal amounts but otherwise nothing else.

Mr Jones did not know the identity of the fraudsters, but he had commissioned an expert report which claimed to have identified the tHEL wallet, which was controlled by Huobi, as holding some 489 bitcoin, and as being used by the fraudsters. Critically, that tracing evidence was subsequently shown to be wrong as none of Mr Jones's Bitcoin had reached the tHEL wallet.

Mr Jones commenced proceedings to recover his losses against various persons unknown and Huobi. As against Huobi, Mr Jones alleged that it controlled a wallet containing his Bitcoin or its traceable proceeds and therefore held that property on constructive trust for him. He sought delivery up of 89.6 bitcoin.

Mr Jones applied and was successful in obtaining an order for summary judgment against Huobi and he obtained an order for delivery up as against Huobi of the 89.6 bitcoin. Although Huobi had not participated in the proceedings, it complied with the judgment. In doing so, approximately 98.2 bitcoin was ultimately transferred to Mr Jones, with a corresponding debit being made to the account of another Huobi customer, Kyrrex Ltd (Kyrrex). Kyrrex had not been a party to the proceedings and had not been given an opportunity to be heard before the order was made.

Legal issues

As Huobi was purporting to act under the order for delivery up, Kyrrex applied to set aside the summary judgment order. Kyrrex relied on CPR 40.9 which provides that ‘A person who is not a party but who is directly affected by a judgment or order may apply to have the judgment or order set aside or varied.’

Kyrrex’s application was refused at first instance, on the ground that Kyrrex had insufficient standing to apply – the judge saying “…it is quite clear on the evidence that Huobi did not need to access any Bitcoin that belonged to Kyrrex or its clients in order to satisfy this judgment. Moreover, on the merits issues that arise in the case, whilst I have every sympathy with Kyrrex who are entirely innocent losers, I see some considerable difficulties in the manner in which the case is advanced in a way that would justify the setting aside of the order.

“I have referred to what I see as the difficulties in treating Huobi as a custodian in order to bring a claim against them. I do not reject those difficulties out of hand but this would plainly be a problematic claim in which the merits are far from clear cut. In those circumstances, my finding on Kyrrex Ltd not being directly affected is a bar to the application succeeding and it fails on that ground… In those circumstances, while I can only repeat considerable sympathy for the position of Kyrrex, in my judgment this application must be dismissed.”

The result was that Kyrrex, itself an innocent party, was left bearing the loss.

Court of Appeal

Kyrrex appealed to the Court of Appeal. The Court of Appeal unanimously allowed Kyrrex's appeal. It held that Kyrrex was ‘directly affected’ by the summary judgment order and therefore had standing to apply under CPR 40.9.

Importantly, the Court held that the interest affected need not be proprietary. A contractual right may be sufficient. Kyrrex's contractual entitlement to withdraw the Bitcoin credited to its account was capable of constituting the necessary legally recognised interest. The effect of the order was materially prejudicial to that interest, notwithstanding that Mr Jones's Bitcoin had never reached the relevant wallet

The Court of Appeal exercised its discretion in setting aside the summary judgment as the order had been based on a misconception advanced on behalf of Mr Jones, yet its effect was to make Kyrrex the unwitting insurer of his loss.

The Court of Appeal said ‘However much sympathy the court may have for a victim of fraud, it should not compound the matter by means of an apparently unjust order’.

Comment

This case has implications beyond cryptocurrency disputes and is potentially significant for banks, custodians, payment providers and intermediaries, as well as crypto exchanges, where recovery orders obtained by one party may affect the legal rights of third parties.

One of the material factors in the case was that Mr Jones had relied upon expert tracing evidence that incorrectly connected his Bitcoin with the relevant wallet. The case therefore reinforces the need to ensure any tracing evidence sufficiently and accurately stands up to scrutiny.

The case has reinforced the ability of an innocent non-party to use CPR 40.9 to undo an order that has wrongly affected its legal rights (contractual as well as proprietary) particularly where the order was premised on an incorrect tracing report.

Successful cyber recovery depends on getting the tracing right. The court's powers cannot be used to cure one innocent victim's loss by imposing that loss on another innocent party, and CPR 40.9 provides an important safeguard where that happens.

Our Commercial Dispute Resolution team specialise in crypto tracing claims. Contact us today to discuss how we can support you.