Background
A user of a virtual asset exchange (our client) claimed damages against the exchange, alleging that cryptocurrency held in the user's account had been transferred out by a third party. The exchange had earlier suffered an incident in which the personal data of some members was leaked through an external hack (spear phishing), and the user tied that incident to the loss of their assets in seeking to impose liability. The court of first instance found for the exchange, and the user appealed. Changchun represented the exchange (the defendant) on appeal.
The Issue — Are Deception, Negligence and Causation Established?
The key questions were ① whether the exchange had deceived the user or breached a duty of disclosure; ② whether the exchange was negligent (in terms of foreseeability) as to the loss of the assets; and ③ whether there was causation between the exchange's conduct and the loss.
How Changchun Helped
Changchun (attorneys Jaesun Yoon and Kyungseok Park) established that ① the exchange had neither concealed the data leak nor deceived the user by invoking insurance coverage or enhanced security, but had on the contrary notified the leak and provided guidance on protective measures; ② the data leak (spear phishing), the password-guessing attack and the account takeover were each separate incidents, so the earlier incident did not enable the exchange to foresee this loss of assets; ③ the loss was caused by a third party obtaining not only the user's ID and password but also the authentication code sent to the user's mobile phone, so there was no causation with the exchange's conduct; and ④ the exchange's processing of the withdrawal after verifying the ID, password and second-factor authentication was valid as "payment to an apparent holder of a claim."
Outcome
Following the first instance decision, the appellate court likewise rejected the user's claim (appeal dismissed), confirming the exchange's victory.
Even where assets are lost to hacking, liability in damages is not established unless the operator's deception, negligence and causation are proven. Precisely establishing the course of the security incident and the fact that each attack was an independent event decides the case. (Outcomes may differ depending on the facts of each matter.)