In (1) Lubin Betancourt Reyes (2) Custodial Management Solutions Limited v (1) Persons Unknown x 3 (2) Tether Holdings Limited (3) Binance Holdings Ltd - June 2021, the English courts granted injunctive relief as an initial step to the recovery of stolen digital assets.

Mr Reyes' legal team sought injunctive relief of the courts in London, including orders for disclosure against cryptocurrency exchange Binance, in similar circumstances to the prior case of Ion Science v Persons Unknown (21 December 2020).


The case involved the theft of Tether stablecoin through the use of a malware (malicious software) clipboard hijacker, and in this respect its facts differ to the Ion Science case - which arose from the making of deceitful representations by pseudonymous fraudsters.

Clipboard hijacker malware works by monitoring the user’s computer for text copied to the clipboard in the form of a cryptocurrency wallet address. When triggered, the malware replaces the copied wallet address such that the subsequent paste command outputs a different wallet address that is controlled by the malware authors.

Known clipboard hijacker malware includes ClipboardWalletHijacker, ComboJack, and CryptoShuffler.

Unlike the Ion Science case, which appeared to involve an attempted personal investment by a director using company funds, it would appear that the relevant transaction in Custodial Management Solutions Limited (a company founded by Mr Reyes) was initiated in the course of business. The company is described on its website as “[a] Financial Marketplace for Businesses Wanting to Start a Bank or Transfer Money at the Best Rate”, and advertises payment services to Brazil and China.

In unfortunate circumstances, Mr Reyes fell victim to clipboard hijacker malware which resulted in him inadvertently transferring 109,395 USDT to the malware authors and anonymous fraudulent perpetrators.

Court application

Upon initial steps towards a potential recovery of the stolen USDT, Mr Reyes' legal team followed the approach in the Ion Science case by obtaining blockchain analysis evidence, which showed that the digital currency had been transferred to the Binance cryptocurrency exchange.

An application for injunctive relief was made to the courts in London in the form of an asset preservation order, a worldwide freezing injunction, Norwich Pharmacal relief and Bankers Trust orders. These orders were granted against the respondents - the perpetrators of the fraud, Tether Holdings Limited, and Binance Holdings Ltd - at an initial ex-parte hearing in April 2021, and subsequently continued at return date hearings in May and June 2021.

At the date of publication of this article, it is unknown whether these interim remedies of the court have either led to, or are likely to result in, successful recovery of the stolen digital assets. Mr Reyes and his company will need to assess the merits of a starting a claim after receipt of the disclosure that has been ordered against Binance and Tether.

Norwich Pharmacal order

A Norwich Pharmacal order is a type of order of the English courts which requires a respondent who is involved or mixed up in wrongdoing to disclose certain documents and/or information to the applicant.

In general, an application for a Norwich Pharmacal order will be pursued in circumstances where, without the information requested, a claim cannot be brought against the wrongdoer. This type of court order is similar (although distinct) from a Bankers Trust order, which requires a financial institution to disclose specific information about a customer who is the perpetrator of a fraud.


This case reiterates the effectiveness of the English courts as a forum to secure digital assets.

Cryptocurrency exchanges are generally required to collect KYC (know your customer) and AML (anti-money laundering) information in order to verify the identity of crypto wallet holders who are their customers.

Blockchain analysis provides a means of identifying if misappropriated digital assets have been transferred onto a cryptocurrency exchange, which will typically provide the best opportunity to trace the identity of the fraudulent perpetrators.

The important point of intersection between decentralised and centralised networks, upon which victim litigants will generally rely, has been described as the fiat currency edge.