Partner Nicola McKinney and Associate James Philippsohn analyse the role of white-hat hackers in civil litigation

Partner Nicola McKinney and Associate James Philippsohn explore the developing role of white-hat hackers in civil proceedings, and discuss some of the challenges and opportunities this can present for litigators.

Nicola and James’ article was published in Thomson Reuters Regulatory Intelligence, 25 March 2025, and can be found here.

Introdcution

The increasing popularity of digital assets has corresponded with a rise in cybercrime, including complex heists where fraudsters abscond with hundreds of millions, or billions, of dollars’ worth of cryptocurrency.

Whilst law enforcement would traditionally serve as the primary mechanism for recourse, crypto investment has exploded against a background which leaves transactions largely unregulated, where criminal recourse faces significant jurisdictional barriers, and where the prospects of a swift recovery even through traditional alternatives such as civil litigation, are slim.

Consequently, many turn to alternative strategies, such as blockchain forensic analysis, and engagements with cybersecurity specialists, including amateur cyber sleuths and white hat hackers (WHH).

Blockchain Analysis and Legal Claims for Recovery

Victims are often reluctant to rely solely on police to try to recover stolen crypto, as they may not have the resource, expertise or legal powers necessary to assist.  Private forensic blockchain analytics have therefore emerged as a tool of crypto asset recovery, which has been endorsed by the English courts as a viable way to evidence where stolen crypto has ended up after a fraud or hack, provided that a proper methodology is followed[1].

A crypto fraud victim’s first likely hurdle will be this step of locating their assets, as fraudsters often swiftly make onward transfers, mixing assets with those of other victims, moving crypto through multiple wallets, or across different blockchains. As such, companies with proprietary tracking software have emerged to assist victims with civil recovery. If a victim cannot demonstrate that the assets they have tracked to a location belong to them, their legal case for recovery is bound to fail.

Legal practitioners frequently collaborate with blockchain analysts to:

• Trace the illicit movement of funds across decentralised ledgers and centralised exchanges.
• Identify complex layering techniques designed to obscure transactional provenance.
• Generate admissible forensic reports that substantiate asset tracing claims within litigation proceedings.

Pursuing legal action for stolen cryptocurrency can provide a structured and secure method for asset recovery. The English courts can issue injunctions, disclosure orders, and freezing orders which can prevent further loss and aid recovery. This approach also ensures adherence to legal and regulatory standards, mitigating risk.

Furthermore, the legal route guarantees procedural integrity, upholding claimants’ rights with established evidentiary standards.

However, using blockchain analysis evidence in court proceedings can be expensive and slow. Crypto fraud proceedings can also have their own cross-jurisdictional limitations. Victims are therefore increasingly likely consider whether there are other ways to recover their assets, and to turn to civil proceedings for compensation claims against third parties, rather than for recovery claims.

The Role of White Hat Hackers

In high-profile crypto hacks, faster solutions will undoubtedly be more attractive to victims. A failure to reassure the market about recovery steps might, disastrously, spell a total loss of confidence in the company, even if it has the assets to compensate victims for any losses.

An example is the February 2025 ByBit hack, in which nearly $1.5 billion worth of crypto was stolen. ByBit quickly put out a call to the crypto community to assist with the identification of the stolen assets, as well as offering 5% of recovered sums.

ByBit’s recovery scenario invites third parties to first identify and then to seek to negotiate with the holders of the stolen crypto in a particular location, to voluntarily freeze the funds or return it to ByBit. A 5% reward is offered for a verified trace of funds, and a further 5% of the recovered funds for a successful freeze or return. These ‘bounty hunters’ have reportedly come from all parts of the crypto community, including blockchain investigators.

By mid-March 2024, ByBit had reportedly paid out around $2.2 million under this scheme.

A step further than the ByBit call to arms is the use by victims of white hat hackers, who hold themselves out as ethical cybersecurity professionals, specialising in the identification of vulnerabilities within blockchain, and digital asset storage mechanisms. In more extreme scenarios, WHHs will themselves employ hacking expertise to carry out ‘reverse’ hacks on fraudsters.

Unlike black hat hackers, who exploit these weaknesses for illicit gain, WHH employ their expertise to assist victims in tracing and potentially recovering misappropriated assets. In certain instances, negotiations between WHH and malicious actors – many of which appear to go unreported – have culminated in the voluntary restitution of large portions of stolen funds.

The ethical grey area inhabited by some WHHs is demonstrated by the Poly Network hack, whereby the self-styled WHH stole and then returned (most of) the $610 million worth of crypto, allegedly to highlight a software vulnerability before it was exploited by a genuine bad actor.

Reliance on bounty hunters and WHHs does, however, present legal and ethical complexities.

As with ByBit, their remuneration model frequently involves contingency-based compensation. Their methodologies – which may include penetrating compromised wallets or reversing unauthorised transactions – also risk contravening such laws which may exist in the countries connected with the wrong-doing. There remain multiple questions of law regarding crypto which are still developing in many jurisdictions, including the location of the assets, its owner and the fraudulent act.

Using these actors can therefore expose parties to risk, and information derived from them can complicate the admissibility of their findings in later legal proceedings.

Risks Associated with WHH Engagement:

• Potential Legal Violations: Unauthorised access to digital wallets and recovery attempts conducted outside of judicial oversight may contravene cybersecurity laws.
• Ethical and Professional Liability: Legal practitioners advising clients on WHH engagements must ensure that such collaborations do not breach professional ethical standards or regulatory obligations.
• Evidentiary Challenges in Litigation: Courts may deem evidence obtained through WHH activities inadmissible, particularly where forensic methodologies deviate from legally sanctioned standards.

Can Legal Practitioners Utilise WHH-Derived Intelligence?

A growing number of victims of crypto heists have engaged WHH to conduct preliminary asset tracing prior and recovery. This raises the question of whether intelligence obtained through WHH activities can be used within litigation.

While blockchain forensic findings generated through legitimate investigative tools may be relied upon if the ‘tracing’ methodology is accepted as sound, intelligence derived from unauthorised access or ethically dubious engagements risks exclusion on grounds of impropriety.

Accordingly, victims considering engaging WHHs should, at least:

• Conduct due diligence to ensure they understand relevant cybersecurity statutes and evidentiary rules, and try to comply with those.
• Structure agreements to preserve legal privilege and confidentiality in asset tracing investigations.
• Rely on investigators who employ sound forensic methodologies to ensure evidentiary integrity in judicial proceedings.

Conclusion

In the evolving landscape of crypto asset recovery, victims can choose from an intersection of forensic investigation, legal recourse, and cybersecurity considerations.

While multiple avenues exist, judicial intervention remains the most reliable and enforceable mechanism for restitution; it is rendered less useful by its slow pace, but can still often assist victims when used alongside other techniques, including negotiating voluntary returns of stolen assets.

By leveraging blockchain forensic analysis and pursuing structured litigation, victims can maximise their recovery prospects while mitigating exposure to legal and ethical complications. The increasing prevalence of digital asset fraud underscores the necessity for enhanced legal frameworks to facilitate effective judicial redress.

[1] D’Aloia v Persons Unknown Category A and Ors [2024] EWHC 2342 (Ch)