Lawyer Ong Yu Jian told Malay Mail that his client Yew See Tak claimed that Luno failed to safeguard the cryptocurrencies in his Luno account, further claiming that this caused a loss of his cryptocurrencies worth almost RM600,000. ― Reuters pic

Wednesday, 01 Nov 2023 7:00 AM MYT

KUALA LUMPUR, Nov 1 — A Malaysian man yesterday was awarded nearly RM700,000 after successfully suing cryptocurrency investment firm Luno Malaysia Sdn Bhd for negligence, following the allegedly unauthorised use of over half a million ringgit in his Luno account in 2021 to buy the digital currency Bitcoin.

Lawyer Ong Yu Jian told Malay Mail that his client Yew See Tak claimed that Luno failed to safeguard the cryptocurrencies in his Luno account, further claiming that this caused a loss of his cryptocurrencies worth almost RM600,000.

According to Ong, Sessions Court judge Sazlina Safie, through a decision delivered online yesterday, ruled in favour of Yew and held Luno to be negligent.

“The court ordered, among others, for the defendant to compensate the plaintiff the sum of RM597,920.05 together with an additional RM100,000.00 as exemplary damages,” Ong told Malay Mail yesterday regarding the ruling.

Advertisement

Luno will not have to immediately pay the court-ordered sum totalling more than RM697,000 to Yew, as the company managed to obtain a temporary pause on the effect of the Sessions Court’s decision yesterday.

Ong told Malay Mail that the Sessions Court has granted Luno an interim stay of 14 days, pending Luno’s filing of an appeal at the High Court against the Sessions Court’s decision yesterday.

Ong said this means that his client can demand the awarded sum from Luno after the end of the 14-day interim stay.

Advertisement

In this case, Yew was also represented by lawyers Joshua Ho and Nurul Hanani Azamuddin, while Luno was represented by lawyers Muhammad Faisal Moideen, Maximilian Tai, and Clarence Tang.

Commenting on the significance of the Sessions Court’s decision yesterday, Ong said: “This decision sends a clear message that cryptocurrency platforms can be made liable if their customers’ accounts get scammed or hacked.

“It is a very encouraging development in cryptocurrency law. If not wrong, this is the first decision of this kind in Malaysia against a cryptocurrency platform which is recognised by Securities Commission Malaysia. Hopefully, this leads to cryptocurrency platforms being much safer to use in the eyes of the public,” he told Malay Mail.

From Malay Mail’s checks of regulator Securities Commission Malaysia’s (SC) website of the latest list as of August 17, 2022, Luno Malaysia Sdn Bhd is one of five recognised market operators which the SC has registered and allowed to operate digital asset exchanges in Malaysia.

What is this case about?

In his lawsuit filed through a writ of summons at the Sessions Court in Petaling Jaya on August 25, 2021 against Luno Malaysia Sdn Bhd, Yew sought for several court orders, including a court declaration that he was not involved in the transactions on March 6, 2021 in his Luno account.

He had also sought court orders for compensation in the form of special damages of RM597,920.05, general damages to be assessed, aggravated damages and exemplary damages.

Based on his statement of claim, Yew said he is a registered customer and holder of a Luno account. The Luno account has a Luno wallet where money can be kept online and can be used to buy, store, sell, send, and receive cryptocurrencies.

According to Yew, he had on March 6, 2021 discovered that RM566,570.70 in his Luno account was used in three transactions to buy 2.730096 Bitcoins (BTCs), describing these as illegal transactions that were carried out in a short span of time.

Yew said these newly-purchased 2.730096 BTCs and an existing 0.15106083 BTCs in his account were then transferred to an unknown account via further illegal transactions. Yew said he had never transferred any funds to this unknown account before this.

Based on the exchange rate where one Bitcoin was valued at RM207,527.77 at that time, the total of 2.88115683 BTCs transferred out from Yew’s Luno’s account was worth RM597,920.05 at that time.

Yew said he had never authorised the illegal transactions where new Bitcoins were purchased and the Bitcoins were transferred out from his account, claiming that these were carried out without his knowledge and approval.

Yew said he had lodged a police report over the illegal transactions to enable the police to investigate, adding that he also suspected that it was possible those illegal transactions would be linked to unlawful purposes such as money laundering.

Yew said the illegal transactions were suspicious when based on the short timeframe which they happened and when cross-checked against the history of activities in his Luno account, and as the unlawful transactions involved all or nearly all of the funds in his account.

Yew claimed that Luno was negligent due to various alleged reasons, such as the alleged failure to stop the illegal transactions despite the exceeding of the daily transaction limit; failure to verify with him if he had authorised those transactions; failure to freeze the account despite suspicious activities and to investigate and take immediate steps to mitigate his losses; and failure to detect the possibility of money laundering and failure to report the transactions to authorities including the SC.

Yew said he had made a report to Luno’s customer service on March 7, 2021 but claimed that the latter took the view that there was nothing suspicious in the Luno account.

In its statement of defence, Luno Malaysia denied Yew’s allegations, and presented its own chronology of events that took place.

Luno said its customer support service had on March 6, 2021 evening (instead of the March 7, 2021 date stated by Yew) received Yew’s report claiming unauthorised access to his Luno wallet and that all his Luno account’s funds were withdrawn, and that Yew had requested the withdrawal to be suspended and for Luno to recover around RM566,000.

Luno said it had on March 8, 2021 told Yew it had locked his Luno account for security purposes, adding that it had also on March 9, 2021 responded further to Yew by saying that the latter’s Luno wallet was accessed through his own email and password and no unusual sign-ins were detected; and that all the transactions were done through the Luno website and app from Yew’s mobile phone and each transaction was authorised through a text message sent to his mobile number.

Among other exchanges between the two, Luno said Yew had on March 9, 2021 claimed unauthorised withdrawal of all his funds in his Luno wallet and said his mobile phone was with him when the transactions happened, and that the pattern of transactions were questionable and should have triggered an anti-money laundering alert.

Luno said it had on March 10, 2021 told Yew that there was no indication that his Luno wallet had been compromised and that a Bitcoin transaction cannot be reversed once carried out due to the nature of blockchain technology.

In its defence, Luno said it does not have access to Yew’s Luno wallet and that Yew has full access and exclusive control of his Luno account, adding that no other third party has access to authorise those transactions.

Luno argued that it is Yew’s obligation to keep his own gadget and password secure, and that it is not Luno’s obligation to do so.

Among other things, Luno said it only owes a duty of care to ensure all transactions under Yew’s Luno account are duly authorised, and claimed that each of the transactions — which Yew said were illegal — were authorised by Yew according to Luno’s security features.

Citing the standard terms of use Yew had to accept in order to register his Luno account, Luno said these state that the company does not owe any duty of care for any losses or transactions made that resulted in losses by Yew.

Luno also said the account which received the BTCs from Yew’s account were not flagged by independent third party blockchain monitoring service provider Chainalysis Inc as being linked to illegal activities, explaining that Luno does not suspend or block transactions if not flagged as such and if they were duly authorised.

Luno also said there was no daily transaction limit as claimed by Yew during those alleged illegal transactions, also saying it did not detect suspicious activities on the latter’s Luno account.

In reply, Yew in another court document insisted that Luno is the custodian and trustee of his money and BTC, claiming that Luno still owed the duty of care and fiduciary duty to block all suspicious and fraudulent transactions and seek his clarification before allowing any transactions.

Yew said the option of authorising a transaction carries the risk of unauthorised access by those who have any device that can receive the SMS prompt through the customer’s registered number, and claimed he did not receive or have any knowledge about any SMS requesting for authorisation from Luno for those alleged illegal transactions.

Denying that he had authorised the alleged illegal transactions, Yew claimed to have only discovered the transactions after feeling suspicious when his access to one of his online accounts was blocked with the message “SMS exceeding daily limit” and only after checking his accounts — including the Luno account.

Yew said his Luno account was not accessed via his usual gadget iPhone (which he had been using to trade at all times) but via an unknown gadget not owned by him, and claimed Luno had failed to be alert towards the unknown gadget accessing his Luno account and clearing out his Luno wallet.

Among other things, Yew insisted that there was a daily transaction limit which the alleged illegal transactions had exceeded, and that authorisation of transactions would not cancel out such daily transaction limits.

Ong confirmed that there was no oral hearing and that the case was decided following the filing of written submissions by both Yew and Luno.