NOWAK v. XAPO, INC.

Background

Dennis Nowak alleged that unidentified hackers infiltrated his account at a California cryptocurrency exchange in November 2018 and stole approximately 500 Bitcoins. He alleged that investigative firm Kroll traced the cryptocurrency to addresses owned by custodial cryptocurrency firms Indodax and “Xapo.” The complaint asserted claims against Xapo, Inc., Xapo (Gibraltar) Limited, Indodax, and ten unidentified hackers.

Nowak brought three claims: possession of stolen property under California Penal Code § 496; aiding and abetting under the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(4); and assisting unlawful computer access under California Penal Code § 502 et seq. Xapo, Inc. moved to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).

Court’s analysis

The court first found that the complaint did not satisfy Rule 8(a)(2)’s notice requirement because it treated Xapo, Inc. and Xapo (Gibraltar) Limited together as “Xapo” without identifying what each entity allegedly did. The court stated that an amended complaint must identify the specific action taken by each defendant that caused Nowak’s harm.

For the California stolen-property claim, the court held that the complaint did not plead facts showing that Xapo, Inc. had actual knowledge or belief that the property was stolen. Allegations about inadequate “Know Your Customer” and anti-money-laundering procedures suggested, at most, negligence rather than the required knowledge or legally sufficient willful blindness. The court also held that filing the complaint itself did not establish the required actual knowledge. The motion as to Count I was granted with leave to amend.

For the Computer Fraud and Abuse Act claim, the court found that the complaint lacked the particular facts required by Rule 9(b) for allegations involving fraud. It also found that the complaint did not allege that Xapo, Inc. participated in or knew about the hacking itself. The court explained that the Act targets hacking, not merely benefiting from the results of hacking. Even assuming an aiding-and-abetting theory was available under the Act, the complaint did not allege that Xapo, Inc. substantially assisted the hacking.

The court separately held that the alleged loss of the value of the stolen Bitcoins was not a qualifying loss under the Computer Fraud and Abuse Act. The court noted that Nowak’s opposition claimed more than $5,000 in investigative costs paid to Kroll, but stated that it was unclear whether tracing stolen funds was a qualifying computer-related loss. The motion as to Count II was granted with leave to amend.

For the California Comprehensive Computer Data Access and Fraud Act claim, the court found similar problems. The complaint did not plead with sufficient detail, did not allege that Xapo, Inc. was directly or indirectly involved in the hacking, and did not adequately allege the required knowledge. The court also identified an issue about whether the nature of Nowak’s alleged loss was cognizable under the state statute. The motion as to Count III was granted with leave to amend.

The court further stated that the allegations did not appear to show a sufficient connection between California and Xapo, Inc.’s alleged wrongful conduct for purposes of applying the California-law claims. It directed that any amended pleading clarify the court’s authority to apply California law to those claims.

Disposition

Judge Beth Labson Freeman granted Xapo, Inc.’s motion to dismiss with leave to amend. The order required an amended complaint no later than December 21, 2020.