Very recently, the Madras High Court, on 25 October, declared cryptocurrency a ‘property’ of the user. The question for declaring it as a property arose from a recent incident in which an investor, Rhuti Kumar, among other investors, lost savings in WazirX due to a cyberattack on the platform. Due to that cyberattack, the accounts of thousands of Indian investors were frozen by the platform due to which they were not allowed to control their coins/points on that platform. The investor approached the Madars High Court and it declared, that cryptocurrency is a “property” under Indian law and restrained the platform from dealing with Rhuti’s property.
The troubling part is that the judgment, although it protects ownership, does not hold as to who shall be responsible for any loss to her assets. What was missed? The Court missed the fact that WazirX employs a dual-structure model. The Indian arm, Zanmai Labs, manages rupee deposits. The Singapore entity, Zettai Pte Ltd, purports to hold the crypto wallets. In court, WazirX asserted that it never owned or controlled the XRP coins, it only managed the interface. Zettai, the foreign company, possessed the keys and the breach occurred in Zettai’s systems. This dual-jurisdiction structure creates a legal grey area. Who owes users the duty of care, the Indian company that accepts the user’s currency, or the foreign company that holds the user’s coins? Another issue is a decisive jurisdictional finding. The failure to disregard the corporate veil between Zanmai and Zettai left behind an operational vacuum of shifting layers of liability.
On occasion, exchanges use these types of structures to essentially operate in India, while eluding regulatory scrutiny in India. This case was an opportunity to clarify that simply because Indian users are trading from servers in India, they will be governed by Indian law, no matter where the parent company is registered. So, if tomorrow the wallet is breached again, would users initiate action against WazirX, or Zettai? Declaring a Custodian is important: When platforms are holding users’ private keys, they are not simply intermediaries; they are fiduciaries. Saying that a hack was “unforeseeable” cannot be used as an excuse to not accept liability. By confirming that crypto is “property,” the Madras High Court legitimised digital assets as having legal status.
But it is not worth much if there is no enforceable duty associated with that property or asset status. Investors may start to approach Indian courts under section 9 of the Arbitration Act for interim protection, but recovering values will still require that custodial liability is evidenced and proven. Courts across the world have already started to close this ethical-legal gap. The UK High Court in AA v Persons Unknown & Ors, Re Bitcoin [2019] EWHC 3556 (Comm). ruled that crypto assets are property, and that intermediaries holding crypto assets act as trustees and therefore have fiduciary obligations. The US SEC requires “qualified custodians,” which are entities that safeguard crypto holdings on behalf of investors to protect them. Thus, India’s assertion of property rights without custodial duty is incomplete.
This case should have initiated three policy responses : a. Clear standards for custodians to mandate segregation of customer assets, similar to the securities business b. Clarity over jurisdiction, if Indians are trading on Indian servers then Indian law ought to apply c. Requirement of insurance for crypto exchanges so that cyber loss does not become a socialized liability Until then, our courts will continue its algorithms for wallet protection one at a time while allowing the conditions for vulnerability to remain. The Road to Reform: In the case of Rhuti Kumari, one would expect a prompt regulatory review and prompt changes. Equivalent considerations, in the first instance, must give rise to clear custodian standards.
Crypto exchanges maintaining the private keys of users, must, like traditional securities intermediaries do with client funds, be required to hold customer assets separately from their own. This would ensure customer assets are ring-fenced and protected from insolvency risks if the platform were to become insolvent or hacked. Secondly, there must be clarity of jurisdiction. If Indian users trade from Indian servers and deposit their money into Indian bank accounts, the transaction should be governed by Indian law irrespective of whether the holding entity is registered somewhere else. Such consideration would prohibit exchanges from hiding behind foreign structures to avoid their obligations.
There must also be a requirement for some form of mandatory insurance mechanism for crypto exchanges. When millions are lost due to hacking or other forms of attacks, taking comfort in knowledge that insurance will absorb the loss, would lead to the result we all would expect. The loss of their digital assets should not become a “socialised liability”, as the innocent investor should not be subject to the costs of the platform collapsing due to cyber hacking. Lastly, it must be stated that the issues of transparency and fairness cannot be negotiable. Every crypto exchange as a “reporting entity” registered under FIU-IND must report under the PMLA regime serious breaches, data theft, or suspicious transactions. Likewise, the government has to regulate clickwrap contracts; those unilateral “I Agree” terms that can be hidden in an avalanche of foreign arbitration clauses often to the detriment of the user.
Users must be given the appropriate chance to litigate in India when they are trading on Indian exchanges. Collectively, these measures would not only protect digital investors but enhance the credibility of India’s rapidly evolving FinTech framework. The real reform doesn’t start with defining crypto as property, but with defining who has the responsibility to protect that property. Property Without a Guardian: The decision in Rhutikumari v. Zanmai Labs is decisive, but also a warning.
We now know crypto is property under Indian law, still we don’t know who is the guardian of that property. Between the click of a button and the crash of a server is a new form of citizenship that is digital, yet stateless. Until custodians are held accountable, each crypto holder is a landowner without land, the owner of something that exists everywhere and nowhere, at the same time. While we have acknowledged ownership in the digital space we have not yet acknowledged responsibility in an earthly jurisdiction. We are going to finish on a both intellectual and emotional note.
(THE WRITERS ARE, RESPECTIVELY, AN ADVOCATE, PRACTICING IN CALCUTTA HIGH COURT, AND AN ADVOCATE PRACTICING IN SUPREME COURT AND DELHI HIGH COURT.)