Bessie Liu

Judges of the United States District Court of Southern California have denied the motion to excuse governance token holders from bZx decentralized autonomous organization (DAO), claiming they are plausibly liable for the loss of $55 million in an exploit occurred in 2021.



Users demanded that bZx be held accountable for the lost funds after it was revealed that a bZx developer had fallen for a “phishing” scam that gave a hacker access to the protocol’s private keys.



After failing to return stolen funds, the court emphasized that DAO governance members fell under the arrangement of a “general partnership” and dismissed a motion against them.&nbsp;



This means that despite not being the individual responsible for the attacks, the governing members of the DAO are all plausibly liable to each of the victims, making it possible that each and every token holder is responsible for the return of the lost funds.&nbsp;



​​In a <a href="https://twitter.com/adamscochran/status/1640526928376483842" target="_blank" rel="noreferrer noopener">Twitter</a> post, Adam Cochran, a managing partner at Cinneamhain Ventures said that “dismissing the motion does not mean the court decided that owning the token makes you 100% liable — yet. It just means they refused to take it off the table.”



“It means that they feel there is some grounds for the case that a DeFi app with a DAO structure could extend legal liability to anyone who simply holds the token in certain circumstances — and that argument merits more discussion in court,” Cochran said.



It is important to note that in the United States, by default, general partnerships imply that there is an equal amount of voting power, which is often not the case for DAOs, where different token holders have a very different amount of control over the protocol.&nbsp;



Although partnership structures could benefit certain DAOs, <a href="https://twitter.com/emjicy" target="_blank" rel="noreferrer noopener">Mel.eth</a>, a pseudonymous DAO governance consultant, told Blockworks, not all DAOs are organized as such. And DAOs that are not structured like this should not be categorized inappropriately.



“The current framework of law isn’t coordinated enough to provide viable solutions and this fact will become increasingly obvious as we see increasingly misfit applications of outdated terminology and organizational strictures,” Mel said. “DAOs are not partnerships in my considered opinion, but a partnership structure might befit some DAOs.”



Updated March 30, 2023 at 9:59 am ET: A previous version of this story stated that Mel.eth was a contributor at Index Coop. 



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

DAO Governance Could Change Following This Court Ruling

Sebastian Sinclair

<div id="highlights-block_6352519f25f8a" class="highlights">
 <ul>
 <li>Around 18 digital-asset-related actions have been undertaken from June 2021 to June 2022, the regulator said</li>
 <li>The CFTC’s posturing highlights an ongoing power struggle between itself and the SEC over how crypto should be regulated</li>
 </ul>
 
</div>



The Commodity Futures Trading Commission (CFTC) said Thursday the crypto industry made up more than 20% of all enforcement cases filed for the 2022 financial year, as questions over which US regulator should police digital assets remain front and center.



Around 18 actions relating to digital assets were executed for the year reported, <a href="https://www.cftc.gov/PressRoom/PressReleases/8613-22" target="_blank" rel="noreferrer noopener">the commission said</a>, including against the operators of the <a href="https://cms.blockworks.co/cftc-accuses-digitex-of-shopping-illegal-crypto-derivatives/" target="_blank" rel="noreferrer noopener">Digitex Futures exchange</a> and Gemini’s alleged “<a href="https://cms.blockworks.co/cftc-steps-up-crypto-enforcement-sues-exchange-gemini-for-false-statements/" target="_blank" rel="noreferrer noopener">false and misleading</a>” statements relating to its application for a bitcoin futures contract in 2017.



Debate over which US regulator — the CFTC or the Securities and Exchange Commission (SEC) — should be the one charged with the industry’s oversight stems from arguments around the asset class’ definition as either a commodity or a security.



The SEC — charged with overseeing securities regulation in the US — wants full control over how it polices most of the privately created digital coins on the market, including stablecoins.&nbsp;



It draws its reasoning from a more than 80-year-old Supreme Court case and seeks to apply that same reasoning to digital assets, which, <a href="https://twitter.com/TuongvyLe12/status/1580626371298021377?s=20&amp;t=uo6iGZvJUtFG0DSQtzx4BA" target="_blank" rel="noreferrer noopener">according to some</a>, is not without its pitfalls.



The CFTC, meanwhile, is also vying for that same control, as it would bring additional revenue to the respective agencies whilst bolstering their mandates over certain financial instruments.



<h3 class="wp-block-heading">CFTC and SEC battle for King of the Hill</h3>



In a surprising move, SEC chair Gary Gensler last month said he <a href="https://cms.blockworks.co/gensler-on-board-with-cftc-taking-over-bitcoin-oversight/" target="_blank" rel="noreferrer noopener">would be happy</a> for the CFTC to regulate bitcoin — the world’s largest crypto by market capitalization —  and “other non-security tokens” while his agency had the pick of the rest.



For years, the SEC has attempted to define crypto as securities, which would bring most crypto under its purview. The regulator has pursued legal action against several high-profile industry-related firms including Ripple Labs, whose legal fight still lingers, pending an outcome in a <a href="https://cms.blockworks.co/ripple-and-the-sec-agree-on-one-thing-let-the-judge-decide-xrps-fate/" target="_blank" rel="noreferrer noopener">US district court</a>.



Earlier this year, the regulator alleged in a complaint against a <a href="https://cms.blockworks.co/sec-charges-former-coinbase-product-manager-with-insider-trading/" target="_blank" rel="noreferrer noopener">former Coinbase product manager</a> that <a href="https://cms.blockworks.co/qa-the-sec-classified-9-tokens-as-securities-now-what/">nine crypto tokens were </a>securities, seemingly a bid to establish a legal precedent over the asset class.



Regardless, the CFTC continues to plow ahead in its own ambition to be the premier industry regulator. Last month, the commission simultaneously filed and settled its case against decentralized autonomous organization <a href="https://cms.blockworks.co/cftc-pursues-first-case-against-a-dao/" target="_blank" rel="noreferrer noopener">bZeroX DAO</a> and its founders for facilitating margined and leveraged retail commodity transactions.



That marked the first time the CFTC had brought an action against a DAO.



A week later, a Judge ruled the CFTC had sound legal footing to serve a summons to bZeroX DAO successor, Ooki DAO, through its <a href="https://cms.blockworks.co/cftc-legally-served-ooki-dao-via-website-help-bot-court-rules/" target="_blank" rel="noreferrer noopener">online help chat box</a>. That action <a href="https://cms.blockworks.co/dao-gains-venture-capital-ally-in-cftc-suit/" target="_blank" rel="noreferrer noopener">raised eyebrows</a> among lawyers working with the industry.



While the debate over how to define crypto continues, it is ultimately up to congress to decide which regulator will take the reins.&nbsp;



Senators in August introduced their <a href="https://cms.blockworks.co/new-cftc-bill-could-overrule-sec-but-leaves-fate-of-many-crypto-tokens-unresolved/" target="_blank" rel="noreferrer noopener">Digital Commodities Consumer Protection Act</a>, suggesting the CFTC should be the one to control crypto’s spot markets, namely bitcoin and ether but potentially others.



With mounting cases brought against defendants in the 2022 financial year, the CFTC, at least for now, could be demonstrating its willingness to heed that call.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

CFTC Racked Up Crypto Enforcement Record in Past Year

<div id="highlights-block_632d6c4e78003" class="highlights">
 <ul>
 <li>bZeroX’s protocol facilitated unlawful margined and leveraged retail commodity transactions on its platform between 2019 and 2021, the CFTC said Thursday</li>
 <li>Its DAO was operating without having first registered as a futures commission merchant, the regulator said</li>
 </ul>
 
</div>



The Commodity and Futures Trading Commission (CFTC) has filed and settled charges against a decentralized autonomous and its founders for facilitating margined and leveraged retail commodity transactions, which they say operated outside the law for years.



The bZeroX DAO deployed, marketed and made solicitations to customers under a protocol of the same name to undertake transactions considered unlawful because those transactions did not occur on a designated market contract, the CFTC said in a <a href="https://www.cftc.gov/PressRoom/PressReleases/8590-22" target="_blank" rel="noreferrer noopener">statement</a> Thursday.



According to the regulator, bZeroX, as well as founders Tom Bean and Kyle Kistner, have been ordered to pay $250,000 for their involvement.



The bZeroX platform was subjected to a <a href="https://bzx.network/blog/prelminary-post-mortem" target="_blank" rel="noreferrer noopener">phishing attack</a>, in November 2021, which extracted stablecoins and DeFi tokens and <a href="https://cms.blockworks.co/hacked-dao-faces-lawsuit-as-users-try-to-recoup-stolen-funds/" target="_blank" rel="noreferrer noopener">prompted a class action lawsuit</a>, though the CFTC is not considering that as part of its filing.



Acting as a pseudo trading marketplace from July 2019 to August 2021, the CFTC said the DAO’s protocol allowed users to take leveraged positions but that bZeroX was operating without having first registered as a futures commission merchant.&nbsp;



The DAO and its founder also failed to adopt know-your-customer procedures under the Bank Secrecy Act, the CFTC said. It&#8217;s believed to be the first such case the regulator has brought against a DAO.



Ooki DAO — a successor to bZeroX — also faces similar charges, the CFTC said. Ooki is said to be operating the same software as bZeroX. As such, the CFTC is seeking restitution, disgorgement, civil monetary penalties, trading and registration bans as well as injunctions against further violations.



While the case is unique based on the involvement of what is perceived as a decentralized organization, the regulator’s move aligns with sentiments laid out last week by CFTC Chair <a href="https://cms.blockworks.co/cftc-preparing-to-oversee-crypto-behnam-tells-senators/" target="_blank" rel="noreferrer noopener">Rostin Behnam</a>.



Behnam told the Senate Agriculture Committee his agency has already begun preparations to take the reins as the primary regulator for the crypto industry.&nbsp;



While the regulator attempts to position itself as the main authority over the new asset class, the SEC has been vying for similar oversight.



Earlier this month, SEC chair Gary Gensler said the CFTC can have authority over bitcoin and other unspecified “non-security tokens,” the securities regulator in turn, it would take charge over all other cryptos. 



The decision ultimately <a href="https://cms.blockworks.co/bitcoin-ether-to-be-regulated-as-commodities-by-cftc-per-new-senate-bill/" target="_blank" rel="noreferrer noopener">rests with</a> Congress, which will have to decide whether either regulator is deemed fit enough to police the industry or whether the creation of an entirely new oversight body is preferred.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

bank secrecy act

CFTC Pursues First Case Against a DAO

Ben Strack

<div id="highlights-block_62718b1e323d8" class="highlights">
 <ul>
 <li>An estimated $55 million of crypto was stolen after a bZx developer had his wallet’s private keys taken in a November phishing attack</li>
 <li>The 14 plaintiffs’ combined losses from the hack total $1.6 million</li>
 </ul>
 
</div>



The victims of a hack of DeFi platform bZx are vying for the return of their funds in a rare attempt to hold a DAO liable in court.



The lawsuit, filed in the Southern District of California Monday, names 14 plaintiffs who claim to have lost funds ranging from $800 to $450,000. Together, the complaint indicates, the plaintiffs lost roughly $1.6 million from the November hack, during which an estimated $55 million of crypto was stolen.&nbsp;



Plaintiffs allege the theft was possible only because the protocol had not yet implemented security measures that its operators knew were reasonably necessary to protect funds.



A spokesperson for bZx did not immediately return a request for comment.&nbsp;



Law firm Gerstein Harrow LLP, whose attorneys have developed a <a href="https://gerstein-harrow.com/crypto" target="_blank" rel="noreferrer noopener">crypto consumer protection practice</a>, represents the plaintiffs. <a href="https://static1.squarespace.com/static/5fe1506a0d430c49279a41de/t/61f06d5e360a0d0ee16ae85a/1643146598737/Kent+Complaint" target="_blank" rel="noreferrer noopener">Its first case</a>, which alleges that a DeFi (decentralized finance) operator called PoolTogether is operating an illegal lottery in New York, also deals with the issue of who can be held liable for the violations of DAOs.



DAOs (decentralized autonomous organizations) are member-owned communities without centralized leadership. The term DAO went mainstream last year when a group of crypto natives — dubbed ConstitutionDAO — raised $49 million in <a href="https://cms.blockworks.co/the-constitutiondao-raises-49m-to-buy-a-copy-of-the-us-constitution/" target="_blank" rel="noreferrer noopener">an unsuccessful bid</a> to buy a copy of the US Constitution. Hedge fund billionaire Ken Griffin won the auction.&nbsp;



“Those who form DAOs apparently believe that they can use the word ‘decentralized’ to evade corporate and individual responsibility,” Gerstein Harrow LLP Partner Jason Harrow said in a statement. “The opposite is true: without the protection of a corporation or limited liability company, everyone involved in a DAO’s governance is liable for the protocol’s negligence and illegality.”



Defendants include bZx protocol co-founders Kyle Kistner and Tom Bean, bZx investors Hashed International and AGE Crypto, and bZeroX, which created the protocol and controlled it until August 2021, according to the complaint. It also names bZx DAO, Ookie DAO and LeverageBox, a company that operated the Fulcrum trading platform, as defendants.&nbsp;&nbsp;



The complaint argues that because the bZx protocol purports to be a DAO that lacks any legal formalities or recognition, it can be considered a “general partnership.”



“That means each of the partners is jointly and severally liable to the plaintiffs and must make good on the full amount of its debts,” the document states.



<h3 class="wp-block-heading">Compensation plan ‘inadequate,’ plaintiffs argue</h3>



A bZx developer had his personal wallet’s private keys taken in the phishing attack, which granted the hacker access to the private keys to the Binance Smart Chain and Polygon deployment of bZx protocol, according to <a href="https://bzx.network/blog/prelminary-post-mortem" target="_blank" rel="noreferrer noopener">a November blog post</a>.



The DeFi protocol said at the time the attack was likely executed by Lazarus Group, which is known to be a state-sponsored <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">hacking organization</a> with links to North Korea. The hacker converted a large amount of stolen assets into ether and transmitted the funds through <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>, according to bZx.



In addition to stating on its website in December that it was preparing to launch the bZx deployments on Binance Smart Chain and Polygon with enhanced security measures, the bZx DAO shared details of <a href="https://bzx.network/blog/bzx-compensation-plan" target="_blank" rel="noreferrer noopener">its compensation plan</a> for victims.



​​The bZx DAO committed to fully compensating those who lost BZRX in the attack with that asset, amounting to about $20 million of BZRX. It agreed to pay back victims who lost money via other tokens over time by buying back debt tokens each month using 30% of protocol revenue and fees.



But the complaint calls the plan “woefully inadequate,” adding “at the current buyback rate, full repayment will take thousands of years.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>