Shin v. ICON Foundation
Filing
202
ORDER GRANTING 172 DEFENDANT'S MOTION FOR SUMMARY JUDGMENT AND DENYING 180 PLAINTIFFS MOTION FOR SUMMARY JUDGMENT by Judge William H. Orrick. (jmd, COURT STAFF) (Filed on 6/6/2024)
1
2
3
4
UNITED STATES DISTRICT COURT
5
NORTHERN DISTRICT OF CALIFORNIA
6
7
MARK SHIN,
Plaintiff,
8
v.
9
10
ICON FOUNDATION,
Defendant.
United States District Court
Northern District of California
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Case No. 20-cv-07363-WHO
Re: Dkt. Nos. 172, 180
Plaintiff Mark Shin exploited a bug in software 557 times to generate cryptocurrency
tokens worth $9 million from the ICON Network (the “Network”). Even though he recognizes
that the Network was not operating in the way it was intended while he generated those tokens 557
times, he nonetheless claims that the tokens belong to him and asserts claims for conversion and
trespass to chattels against defendant ICON Foundation (“ICON”) because his accounts were
frozen and those assets seized after ICON and the Network realized what had happened and
identified him. ICON asserts a counterclaim for unjust enrichment. While the cryptocurrency
context of this case makes it somewhat unique, the legal principles are clear cut: Shin has no
legitimate claim to exclusivity over the bug-generated cryptocurrency that he obtained contrary to
the rules and practice of the Network and no right to retain the benefit of his willful decision to
exploit what he knew was a flaw in the Network 557 times. Summary judgment will be granted in
favor of ICON and against Shin. I will address the remedy stemming from Shin’s liability after
further briefing.
25
26
27
28
ORDER GRANTING DEFENDANT'S
MOTION FOR SUMMARY
JUDGMENT AND DENYING
PLAINTIFF’S MOTION FOR
SUMMARY JUDGMENT
BACKGROUND
A.
The ICON Network
A digital currency, often referred to as “cryptocurrency,” is maintained by a decentralized
United States District Court
Northern District of California
1
network of participant’s computers instead of a centralized bank, government, or organization.
2
See Second Amended Complaint (“SAC”) [Dkt. No. 58] ¶ 26. Anyone can join his or her
3
computer to the network the currency uses by installing and running software that allows the
4
computer to communicate with the network and, consequently, interact with the digital currency
5
that network uses. Transactions on that network between participants get recorded on a
6
“blockchain,” which serves as a public database of digital currency transactions. Id. ¶ 21.
7
The Network describes itself as a “next generation blockchain protocol” for “decentralized
8
applications.” ICON’s First Amended Counterclaim [Dkt. No. 100] ¶¶ 8, 10. It hosts a “delegated
9
proof of stake” blockchain which allows for the creation of a cryptocurrency called ICX.
10
Declaration of Min Kim (“Kim Decl.”) [Dkt. No. 174] ¶ 7. Since 2018, the Network has been
11
governed by a body of “at least twenty-two . . . independent representatives,” ICON being one. Id.
12
¶ 5.
13
ICON is a Swiss foundation with its principal place of business in Zug, Switzerland. Id. ¶
14
4. It was created to “promote, develop, and support the ICON Network.” Id. ICON is the largest
15
holder of ICX; today it owns approximately 8% of all ICX tokens. Id. ¶ 12. According to ICON,
16
it “does not control, has not controlled and cannot control any other member of that governing
17
body[.]” Id. ¶ 5. ICON was responsible for launching the Network, and it has been “integral in its
18
development.” Id.
19
The Network has a constitution to which all users are subject. See Dkt. No. 186-2 (ICON
20
Constitution). That constitution asserts that its users (which it refers to as “ICONists”) are to
21
“strive to ensure that the ICON Network runs properly,” and that all users shall “oppose any
22
transgression against the ICON Network.” Id. at 8.
23
B.
24
All ICX holders can contribute to the Network’s operation in governance, which is enabled
ICON Governance
25
in part by selecting delegates (called “Public Representatives” or “P-Reps”) who run the Network
26
computers and servers. Kim Decl. ¶¶ 5, 14. The Network employs a “Delegated-Proof-of-Stake”
27
consensus method to manage and verify transactions on the Network. Id. ¶ 17. This method
28
involves ICX holders electing entities called “Main P-Reps,” who “obtain the right to produce
2
1
blocks, govern, and validate the data or state of the Network.” Id. In 2020, there were 22 Main P-
2
Reps. Id. ¶ 60.
3
4
17. During staking and delegation, any ICX token holder may commit his or her tokens as votes
5
for a Main P-Rep. Id. The delegates who receive the highest volume of staked ICX from ICX
6
holders are elected as Main P-Reps, meaning they can validate transactions and govern the
7
Network. Id. Per the terms of the ICON Constitution, all P-Reps, including the Main P-Reps, are
8
“obliged to protect the [ICON] ecosystem from . . . risks” that include “all forms of criminal
9
activity and abuse, such as network failures, attacks, fraud and collusion.” ICON Const. at 14.
10
United States District Court
Northern District of California
The Main P-Reps are selected by a process called “staking” and “delegation.” Kim Decl. ¶
While ICON tokens are staked and delegated by holders, the tokens are locked in the
11
holder’s wallet until such a time as the holder decides to stop using the tokens to indicate their
12
support for one P-Rep or another. Id. ¶¶17-18. At that point, the holder “undelegates” the staked
13
tokens, and then “unstakes” them. Id. ¶ 18. It typically takes about seven days to complete the
14
unstaking process. See Kim Decl. ¶ 18; Ryu Decl. ¶ 23.
15
C.
16
To encourage ICX holders to participate in this staking process, the ICON Network
17
rewards users who stake their ICX tokens. The Network software calculates a reward score, called
18
“I-Score,” for ICX holders who participate in staking and delegating. The rewards system is
19
publicized. See Kim Decl. ¶ 18; see id. Ex. 1 (ICON Whitepaper discussing “ICON Incentives
20
Scoring System”) at 26-29.
The Role of Rewards in ICON Governance
21
To earn ICX rewards, the holder must delegate staked ICX to one or more P-Rep. ICON
22
describes the staked reward program as being similar to an interest-bearing bank account, in that
23
“[j]ust as a bank customer accrues and receives interest at the applicable rate based on the balance
24
of funds deposited into the account for as long as the funds remain on deposit, ICX holders receive
25
staking rewards based on the number of ICX they have staked and delegated for as long as the
26
ICX remains staked and delegated.” Kim Decl. ¶ 18. The Network continually calculates I-Score
27
rewards based on the frequency and volume of a holder’s staking activity. See Kim Decl. Ex. 2.
28
To delegate tokens to a selected P-Rep, ICON token holders use a cryptocurrency “wallet.”
3
1
Id. ¶ 21. A wallet is a “simple user interface on which a token holder can interact with the
2
Network.” The holder can redeem his or her I-Score for ICX. Kim Decl. ¶ 22; Ryu Decl. ¶ 12.
3
Typically, an ICX holder earns no rewards on tokens he or she merely unstakes or undelegates.
4
See Kim Decl. ¶¶ 20, 23.
United States District Court
Northern District of California
5
When the ICX token launched in 2018, there were 800,430,000 tokens, which included
6
millions of tokens not yet in circulation. Id. ¶ 24. Today, the current total supply of ICX is just
7
over 1 billion. See id. There is no set limit on the supply of ICX. Since 2019, the Network has
8
been programmed to continually generate new ICX tokens at a set rate. Id. ¶¶ 23-25. In 2020,
9
before Revision 9 was released to the Network software, the Network was programmed to mint 36
10
million new ICX annually to be used to reward those who contributed to the governance of the
11
Network. Id. After the Network creates newly minted ICX, it sends those tokens to the Public
12
Treasury. According to Kim, ICON’s self-described “informal” CEO, the tokens can then only be
13
claimed in exchange for contributions to Network governance. Id.; see also Deposition of Min
14
Kim (“Kim Depo.”) [Dkt. No. 186-4] at 24:14-19. The value of ICX depends in part on its
15
scarcity. Id. ¶ 34; Declaration of Christopher Wagner (“Wanger Decl.”) [Dkt. No. 173] Ex. 1
16
(Deposition of Mark Shin (“Shin Depo.”)) [Dkt. No. 173-1] at 97:14-99:11.
17
D.
18
Today the Network is made up of 25 Main P-Reps who have the responsibility of creating
The Revision 9 Bug
19
and voting on Network proposals, producing blocks for the Network, and developing and
20
promoting the Network. Id. ¶ 27. ICON has been a Main P-Rep since 2018. A majority of the
21
Main P-Reps must approve any software that the Network runs. Id. ¶ 31. The software that runs
22
on the Network is developed by ICON in contract with ICONLoop, Inc. (now known as “Parameta
23
Corp.” or “Parameta”). Parameta is the primary developer for ICON Network’s software. Id.
24
In 2020, responding to ICX holders’ requests, Parameta developed a software update
25
known as “Revision 9,” which, among other things, enabled a new feature on the Network known
26
as the “Multiple Unstaking Period” function. Id. ¶ 33. Revision 9 was supposed to allow Network
27
users to make several unstaking requests at one time, which was previously impossible. Id. The
28
Main P-Reps, including ICON, approved Revision 9. Id. ¶ 33.
4
United States District Court
Northern District of California
1
Revision 9 contained a software defect that was unknown to the Main P-Reps when they
2
deployed it. See Kim Decl. ¶¶ 36, 42-45, 63; Ryu Decl. ¶ 18, 21. That software defect affected
3
less than 0.05% of all ICON accounts. Kim Decl. ¶ 73. Before the software defect was fixed,
4
those affected accounts were able to generate tokens equal in number to the number of tokens the
5
user “unstaked.” See id.; see also Ryu Decl. ¶ 37.
Shin’s Exploitation of the Revision 9 Bug
6
E.
7
Shin’s was among the accounts affected by the Revision 9 bug. On August 22, 2020, Shin
8
was unstaking 25,000 ICX tokens. He used the “SetDelegation” function, which allows users to
9
redelegate tokens from one P-Rep to another. Typically, Shin would have received no additional
10
tokens for this action. See Kim Decl. ¶¶ 45. Shin knew this. See Shin Depo. at 91:5-25. But on
11
August 22, when he unstaked 25,000 tokens, the Network generated 25,000 new ICX tokens and
12
made them immediately available to him.1 Id.
13
Shin repeated the process of unstaking 25,0000 tokens 557 times. See Shin Depo. at
14
161:19-25. Each time, the Network delivered 25,000 new tokens to him. Id. While he was doing
15
this, he transferred much of the ICX into different accounts at different cryptocurrency exchanges.
16
Id. at 240:17-243:6. He also transferred a lot of the bug-generated ICX to his family and friends.
17
See Dkt. No. 173, Ex. 5 at 7-8. By receiving 25,000 new tokens 557 times, he caused the total
18
number of circulating ICX to increase by almost 14 million tokens. See Kim Decl. ¶¶ 45, 87; Ryu
19
Decl. ¶ 23. While other Network users also took advantage of the bug to generate tokens, Shin
20
was responsible for the vast majority of the bug-generated ICX.2 Kim Decl. ¶ 77; Ryu Decl. ¶ 41.
The Main P-Reps’ Response to Shin’s Actions
21
F.
22
When ICON became aware of Shin’s actions, it conferred with other P-Reps about how to
23
respond. Kim, in his capacity as “informal” ICON CEO, suggested that ICON propose to the
24
other Main P-Reps that they approve a software update to fix the bug and to blacklist Shin’s
25
26
27
28
I will refer to the ICX tokens generated as a result of Shin’s exploitation of the Revision 9 bug as
the “bug-generated ICX.”
1
At oral argument, counsel for plaintiff contested ICON’s position that Shin was responsible for
85% of the bug-generated ICX but conceded that he was responsible for the vast majority of them.
5
2
1
wallets. See Dkt. No. 186-8 (internal ICON communications); Kim Decl. ¶ 50; Ryu Decl. ¶ 29.
2
ICON did so. The Main P-Reps agreed and voted to approve and deploy a software update, called
3
Revision 10. Revision 10 was intended to remove the Revision 9 bug that was causing the ICX to
4
mistakenly generate and to “blacklist” the wallet associated with the account that took advantage
5
of the bug 557 times. It did both and froze approximately 6.7 million bug-generated ICX in Shin’s
6
crypto wallets. See Kim Decl. ¶ 64.
7
G.
8
On August 19, 2020, there were approximately 550 million ICX tokens in circulation
United States District Court
Northern District of California
9
The Aftermath
worldwide. Kim Decl. ¶ 86. After Shin’s actions, three days later there were approximately 14
10
million more tokens in circulation. Id. The total supply of ICX tokens increased by
11
approximately 2.5%. Approximately a week after Shin created the bug-generated ICX and after
12
ICON posted a blog article explaining what had happened on August 22, 2020, the price of ICX
13
tokens began to drop. See “Network Update: Revision 10” ICON Foundation (Aug. 24, 2020),
14
https://www.icon.foundation/blog/2020/network-update-revision-10-b0ce0bd68cbe/. In the weeks
15
following, the price of ICON’s currency decreased by roughly 40%. Id. ¶ 87.
After Shin was identified as the person behind the misappropriation, a Main P-Rep, Ricky
16
17
Dodds, contacted him. Dodds told him that the ICON community knew that he was responsible
18
for the large number of bug-generated ICX and warned that ICON intended to involve law
19
enforcement if he did not return them. See Declaration of Ricky Dodds (“Dodds Decl.”) [Dkt. No.
20
176] ¶ 31; Shin Depo. at 199:2-200:14. Dodds said that ICON was willing to pay Shin a “bug
21
bounty” of $200,000 in exchange for his return of the bug-generated ICX. Shin refused the offer.
22
See Shin Depo. at 199-200.
ICON did involve law enforcement. The United States Federal Bureau of Investigation
23
24
ultimately seized some but not all of the bug-generated ICX and cryptocurrency that was traceable
25
to the bug-generated ICX that Shin had transferred away from his ICON wallets. See Wanger
26
Decl. Ex. 6 (affidavit of Special Agent Travis Wall, FBI).3 A grand jury in the District Court of
27
28
3
I appointed a Receiver, Ellen London, to oversee the cryptocurrency and fiat currency assets that
the FBI seized. See Dkt. No. 133. Ms. London submitted a proposal for how all the at-issue
6
1
Arapahoe County, Colorado, indicted Shin in 2021, and he was criminally prosecuted for his
2
actions related to the Revision 9 bug. Case No. 2021 CR 001445. After a trial, the jury hung, and
3
the Colorado District Attorney declined to retry Shin and dismissed the criminal action against
4
him on August 4, 2023. See Wagner Decl. ¶ 11.
5
Meanwhile, Shin filed this action in October 2020, asserting claims for conversion and
6
trespass to chattels concerning the blacklisted ICX. ICON counterclaimed for unjust enrichment.
7
Both parties now move for summary judgment. See ICON’s Motion for Summary Judgment
8
(“ICON MSJ”) [Dkt. No. 172]; see also Shin’s Motion for Summary Judgment (“Shin MSJ”)
9
[Dkt. No. 180].
LEGAL STANDARD
10
United States District Court
Northern District of California
11
Summary judgment on a claim or defense is appropriate “if the movant shows that there is
12
no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of
13
law.” Fed. R. Civ. P. 56(a). In order to prevail, a party moving for summary judgment must show
14
the absence of a genuine issue of material fact with respect to an essential element of the non-
15
moving party’s claim, or to a defense on which the non-moving party will bear the burden of
16
persuasion at trial. See Celotex Corp. v. Catrett, 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d
17
265 (1986). Once the movant has made this showing, the burden then shifts to the party opposing
18
summary judgment to identify “specific facts showing there is a genuine issue for trial.” Id. The
19
party opposing summary judgment must then present affirmative evidence from which a jury
20
could return a verdict in that party’s favor. Anderson v. Liberty Lobby, 477 U.S. 242, 257, 106
21
S.Ct. 2505, 91 L.Ed.2d 202 (1986).
22
On summary judgment, the court draws all reasonable factual inferences in favor of the
23
non-movant. Id. at 255, 106 S.Ct. 2505. In deciding a motion for summary judgment, “[c]redibility
24
determinations, the weighing of the evidence, and the drawing of legitimate inferences from the
25
facts are jury functions, not those of a judge.” Id. However, conclusory and speculative testimony
26
does not raise genuine issues of fact and is insufficient to defeat summary judgment. See Thornhill
27
28
assets would be maintained and preserved, which I approved. See Dkt. No. 191. These assets are
currently under her oversight.
7
1
Publ’g Co., Inc. v. GTE Corp., 594 F.2d 730, 738 (9th Cir. 1979).
DISCUSSION
2
United States District Court
Northern District of California
3
I.
CONVERSION
4
Shin asserts a claim for conversion, alleging that “[t]hrough releasing and implementing
5
Revision 10, [ICON] programmatically targeted and restricted [him] from accessing all the ICX
6
that he kept in his personal ICX wallets,” and in so doing, “locked Shin out of . . . accessing his
7
ICX tokens, assuming control over his property, without authorization.” SAC ¶ 135. ICON moves
8
for summary judgment on this claim, arguing that, after two years of discovery, the undisputed
9
facts show that Shin’s conversion claim fails as a matter of law.
10
A.
11
To prevail on a conversion claim, a plaintiff must show “‘ownership or right to possession
Elements of Conversion
12
of property, wrongful disposition of the property right and damages.’ ” Kremen v. Cohen, 337
13
F.3d 1024, 1029 (9th Cir. 2003) (quoting G.S. Rasmussen & Assocs., Inc. v. Kalitta Flying Serv.,
14
Inc., 958 F.2d 896, 906 (9th Cir. 1992)). Ownership or right of possession is determined by a
15
three-part test: “First, there must be an interest capable of precise definition; second, it must be
16
capable of exclusive possession or control; and third, the putative owner must have established a
17
legitimate claim to exclusivity.” Rasmussen, 958 F.2d at 903 (footnote omitted); see also Kremen,
18
337 F.3d at 1030 (applying three-part test). The parties agree that the bug-generated ICX is
19
capable of precise definition and exclusive control. After all, “property subject to a conversion
20
claim need not be tangible in form; intangible property interests, too, can be converted.” Voris v.
21
Lampert, 7 Cal. 5th 1141, 1151 (2019). They are at odds about the third element of right of
22
possession: whether Shin has a legitimate claim to exclusivity over the bug-generated ICX.
23
B.
24
When courts consider whether a plaintiff has a legitimate claim to exclusivity over
No Legitimate Claim to Exclusivity
25
property, they consider whether he has invested substantial time and money into the property at
26
issue, see Rasmussen, 958 F.3d at 903, and whether the actions taken to secure the property were
27
themselves legitimate. See Kremen, 337 F.3d at 1030. Courts also consider the interests of the
28
public in ensuring that property is obtained through legitimate means. See id.
8
1
All considerations weigh against Shin. The undisputed facts show that Shin has no
2
legitimate claim to exclusivity over the bug-generated ICX: he did not obtain them via legitimate
3
means and he did not invest time, money, or anything else valuable in their acquisition.
4
Accordingly, he has no ownership or possessory interest in the property that is the subject of his
5
conversion and trespass to chattels claims. This is dispositive to all of Shin’s claims and compels
6
me to grant summary judgment in ICON’s favor.
7
8
United States District Court
Northern District of California
9
1.
Purpose for Generating ICX
The Network “has always be intended to be programmed to only generate new tokens for
one purpose: to reward ICX holders who contribute to the governance of the Network.” ICON
10
MSJ 7, 19; see Kim Decl. ¶¶ 19, 23-25. ICON’s informal CEO, Min Kim, testified that when ICX
11
first launched in 2018, there were a finite number of them. Since then, the Network software has
12
been programmed to “continually generate ICX tokens at a set rate.” Kim Decl. ¶ 19. Before
13
2020 (when the Revision 9 software was released) the Network was programmed to mint 36
14
million new ICX annually “to be used to reward those who contributed to governance of the
15
Network.” Kim Decl. ¶ 19. After the Network creates newly minted ICX, it sends the ICX to the
16
Public Treasury, “where the tokens can be claimed by holders solely in exchange for their
17
contributions to governance of the Network.” Id. ¶¶ 23-25 (emphasis added); Ryu Decl. ¶ 8. ICX
18
holders are “not intended to receive and historically have never received reward tokens for simply
19
either undelegating or unstaking ICX tokens,” see id. ¶ 23, which is what Shin did to generate the
20
at-issue ICX.
21
Shin argues that the intended purpose for generating tokens is subject to dispute. He
22
contends that “ICON’s use of ICX token as a fundraising vehicle contradicts its factual position
23
that new ICX tokens are created by the Network for ‘one reason only.’” Shin Oppo. 10:12-14.
24
Not so. While Shin points out that in 2017, ICON “publicly sold and issued new tokens
25
representing 50% of the then-current total ICX supply raising for itself approximately $43 million
26
dollars, very similar to an initial public offering,” see id. 10:14-16 (quoting Kim Decl. ¶ 10;
27
Cazares Decl. ¶ 4; Oppo. Ex. A (ICON whitepaper)), the 2017 sale was unrelated to the tokens
28
reward system, the malfunctioning of which enabled Shin to generate the at-issue ICX. ICON has
9
1
shown, and Shin has not effectively refuted, that from the time ICX became available in 2018 after
2
the 2017 issuance, and certainly in 2020, ICON’s sole purpose for generating new ICX tokens was
3
to reward users for participation in governance.
United States District Court
Northern District of California
4
Users of the Network have an obligation under the ICON Constitution to “strive to ensure
5
that the Network runs properly” and to “oppose any transgression against the ICON Network.”
6
ICON Const. at 7 (Article 3, “Duties of the ICONist”). Shin understood on August 22, 2020,
7
when he was generating new ICX tokens by unstaking his existing tokens, that the Network was
8
not operating in the way that it was intended. See Shin Depo. at 86, 90-92. He has confirmed that
9
he was “not expecting to see new tokens in [his] wallet just for unstaking,” and that he was
10
“surprised to see ICX appear in [his] wallet just for unstaking.” Id. at 84-88. He knew that what
11
he was doing was not staking and delegating, which are the only actions that would typically
12
generate new tokens for a user. Id. at 86-89. In fact, he believed the tokens he was generating to
13
be the product of a bug in the system even as he was generating them. See Shin Depo. at 90-92 (“I
14
typically think you stake ICX, you own a percent fixed reward, whereas these were more of an
15
anomaly . . . an outlier . . . a once in a lifetime opportunity, I suppose . . . a product of a bug.”).
16
When he was generating tokens, Shin understood that his actions were enabled by some kind of
17
glitch in the Network. That is what informs my analysis that he does not have a legitimate claim
18
to exclusivity over the bug-generated ICX. Shin was doing the opposite of ensuring that the
19
Network runs properly and opposing any transgression when he exploited the software bug.
20
21
2.
Illegitimate Means of Acquisition
Neither side has found support in the caselaw that is exactly on point regarding whether
22
Shin had a legitimate claim for exclusivity in the bug-generated ICX. But some cases are broadly
23
instructive.
24
Consider Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003), a seminal exclusive interest
25
case. Kremen, who had lawfully registered an internet domain name, sued the registrar, Network
26
Solutions, for assigning that same domain name to another individual, Cohen, who had
27
deceptively asserted a possessory right over the name. See Kremen, 337 F.3d at 1024-25
28
(explaining that Cohen, whom the court described as a “con man,” had sent Networks Solutions a
10
United States District Court
Northern District of California
1
forged letter requesting that it transfer Kremen’s domain name to him, and Network Solutions
2
obliged). The Ninth Circuit held that even though Network Solutions did not have a contractual
3
obligation to Kremen that precluded assignment of the domain name to the second registrant,
4
Kremen, as the only rightful registrant, could assert a conversion claim against the registrar. See
5
id. The court found that “registrants have a legitimate claim to exclusivity” over domain names,
6
observing that “[r]egistering a domain name is like staking a claim to a plot of land at the title
7
office [because] it informs others that the domain name is the registrant’s and no one else’s.” Id. at
8
1030. The court also noted that many registrants “also invest substantial time and money to
9
develop and promote websites that depend on their domain names”: Ensuring that they could reap
10
the benefits of that investment would reduce uncertainty and encourage such investments,
11
promoting internet growth. Id.
12
At a high level, Kremen stands for the principle that legitimate claims to exclusivity are
13
established through legitimate means of property acquisition that favor the public interest. That is
14
instructive here. As discussed, ICON generates new tokens for a limited purpose: rewarding those
15
users who participate in its governance by staking and delegating their tokens. The Network does
16
this by allocating reward scores, I-Score, to users who stake and delegate their tokens, which the
17
user can then redeem for ICX. Kim Decl. ¶¶ 20-22. Shin knew this; it was what helped him
18
recognize that what was enabling him to generate new tokens when he merely unstaked his
19
existing tokens was a bug in the Network software. See Shin Depo. at 91-92. He called this a
20
“once in a lifetime opportunity,” see id. at 91:16-17, and proceeded to repeat the process 557
21
times, generating approximately $9 million worth of tokens for himself. He did not exchange
22
earned I-Score for tokens; he generated them by exploiting a bug in the system. This is the kind of
23
solely self-serving pursuit of property that runs counter to public interest as well as the Network’s
24
interest.
25
Kremen’s predecessor, G.S. Rasmussen & Assocs., Inc. v. Kalitta Flying Serv., Inc., 958
26
F.2d 896, 906 (9th Cir. 1992), is also instructive. There, the Ninth Circuit considered what makes
27
a property interest. It observed in a footnote:
“Opinions defining property for takings purposes often use the phrase
‘reasonable investment-backed expectations’ to describe such claims.
28
11
1
2
3
4
5
6
7
8
The phrase aptly describes the nature of the interest needed to
establish property rights for purposes of California law. The degree
of investment—monetary or otherwise—is relevant, especially when
dealing with intangibles, in determining whether the purported owner
has developed a stake in the thing sufficient to warrant invoking the
protections of the law of property.” Rasmussen, 958 F.2d at 903, n.
13 (internal citations omitted).
The Rasmussen court considered the “time and effort” that the plaintiff put into obtaining
the property at issue in that case. See id. at 903 (“Rasmussen expended considerable time and
effort in research and design [of the property at issue]”). But it also observed that, particularly
when “dealing with intangibles,” whether a plaintiff has a legitimate claim to exclusivity depends
on “the degree of investment” the plaintiff has put into that property. That leaves open a broad
9
range of factors for courts to consider, not just time and effort.
10
Shin did not invest time, money, effort, or anything else in the bug-generated ICX. He
11
United States District Court
Northern District of California
admits that he knew he was receiving the bug-generated ICX through some kind of flaw in the
12
13
14
Network. He described it as a “lucky windfall,” and testified that he thought the first time it
happened a “visual bug” was responsible, and that the ICX was “invalid.” Shin Depo. at 276:1123. He even told his father that he “found a bug that [was letting him] mint free tokens.” Id. at
15
153:12-15. Investment costs something. It is not free.
16
Despite all of this, Shin insists that the way that he generated the at-issue ICX was not
17
illegitimate. He argues that he was only ever operating within the bounds of the Network, stating
18
19
20
21
that he “obtained all of his Newly Generated ICX making lawful and approved use of a
‘decentralized’ Network that he was authorized to use in an unlimited capacity.” See Shin Oppo.
21:11-10; see also Robilliard Decl. ¶¶ 9-10. He denies performing “any harmful or morally
unjustified ‘exploitation’ that would delegitimize his lawful claim” because he discovered the bug
22
by accident and did not take any action to exceed his level of authorization within the Network.
23
See Shin Oppo. 16:22-17:2; Shin Decl. ¶¶ 3, 9. In short, Shin does not dispute that he replicated a
24
25
26
value-generating transaction for his benefit—he denies that behavior was “exploitation” in what
his counsel described as a “decentralized ecosystem.”
I will not debate morality with Shin. But his actions were not “authorized” by the
27
Network. Revision 9 contained a bug. A bug belies authorization. As discussed at oral argument,
28
12
1
that the Main P-Reps approved the software update with an unknown bug that enabled Shin’s
2
profit does not suggest that his actions were authorized.4
No matter what type of “ecosystem” Shin was operating in, he has no legitimate claim to
United States District Court
Northern District of California
3
4
the bug-generated ICX. He deliberately took advantage of what he understood to be a glitch in the
5
Network’s system to enrich himself, and he cashed in 557 times. He exploited the bug in a way
6
that undermined the Network’s reward system, which was designed to encourage ICON users to
7
participate in governance of the Network. He used the bug to generate millions of dollars’ worth
8
of tokens for himself. He did not earn the ICX through contributions to the Network and did not
9
redeem any I-Score to obtain them or provide other consideration for the ICX he generated.5
10
The Ninth Circuit in Rasmussen emphasized the role of investment—monetary or
11
otherwise—in the property over which one asserts an interest. See supra (discussing Rasmussen,
12
958 F.2d at 903, n. 13 (internal citations omitted)). In Kremen, the court sought to encourage
13
legitimate practices, reward investment, disincentivize profit-by-deception, and promote growth in
14
the emerging internet by recognizing that individuals who diligently pursued and legitimately
15
acquired intangible property possessed an interest in that property. See supra (discussing Kremen,
16
337 F.3d at 1030-31). Shin, on the other hand, did not invest—in any meaningful way—in the
17
18
19
20
21
22
23
24
25
26
27
28
4
Shin bridles at being compared to a bank hacker, or a counterfeiter, see ICON MSJ 20:1-3, and
points out that he did not go looking for a vulnerability in the Network as such actors would but
simply happened upon one and took advantage of it. See Shin Oppo. 17. Taking advantage of
ICON’s mistake does not legitimize what he did. Nor does it make him analogous to a plaintiff
who invests in property over which he later claims a right. See Rasmussen, 958 F.2d at 903, n. 13.
5
ICON argues that Shin’s failure to give any consideration for the bug-generated ICX further
delegitimizes any interest he might have in the ICX. It points out that Shin did not redeem any IScore for the bug-generated ICX or provide anything else of value in exchange for them, as users
are supposed to do to generate new ICX tokens. See Shin Depo. at 169:1-25.
Shin responds that he did provide ICON with consideration because he “contributed incredible and
incalculable value to the ICON Network by allowing ICON to detect and patch a huge issue
lurking in its code.” Shin Oppo. 14. This argument rings hollow. Shin refused the bug-bounty.
He also used the bug to his own benefit 557 times. I take Shin’s point that had he not taken
advantage of the Revision 9 bug so many times and to such great personal profit, ICON may have
taken longer to discover the problem. But alerting someone to a flaw in their system by repeatedly
taking advantage of that flaw hardly seems to qualify as “contributing incredible and incalculable
value.” While my decision does not rest on this argument, Shin’s lack of consideration does not
stack in his favor when considering whether he has a legitimate claim to exclusivity.
13
1
property he obtained by exploiting the bug; he received it for free.6
Shin lacks a legitimate claim to exclusivity over the bug-generated ICX. Accordingly, he
United States District Court
Northern District of California
2
3
has no ownership or property interest in it, and his conversion claim fails as a matter of law.
4
ICON’s motion for summary judgment as to Shin’s claim for conversion is GRANTED.
5
II.
TRESPASS TO CHATTELS
6
Under California law, trespass to chattels “lies where an intentional interference with the
7
possession of personal property has proximately caused injury.” In re iPhone Application Litig.,
8
844 F. Supp. 2d 1040, 1069 (N.D. Cal. 2012) (quoting Intel Corp. v. Hamidi, 30 Cal.4th 1342,
9
1350–51 (2003)). A trespasser is liable when the trespass diminishes the condition, quality or
10
value of personal property. See eBay, Inc. v. Bidder’s Edge, Inc., 100 F.Supp.2d 1058, 1071 (N.D.
11
Cal. 2000).
For the same reasons that ICON prevails on summary judgment against Shin’s conversion
12
13
claim, it prevails on his trespass to chattels claims. The undisputed facts show that Shin has no
14
legitimate claim to exclusivity over the bug-generated ICX. See supra, Section I(B). There can be
15
no trespass where the defendant has interfered with property over which the plaintiff has no
16
personal right. ICON’s summary judgment motion on Shin’s trespass to chattels claim is
17
GRANTED.
18
III.
UNJUST ENRICHMENT
Unjust enrichment is an equitable principle that underlies “various legal doctrines and
19
20
remedies.” See Dinosaur Development, Inc. v. White 216 Cal. App. 3d 1310, 1315 (1989). It is
21
“synonymous with ‘restitution,’” and describes the theory that “a defendant has been unjustly
22
conferred a benefit through mistake, fraud, coercion, or request.” Astiana v. Hain Celestial Grp.,
23
Inc., 783 F.3d 753, 762 (9th Cir. 2015) (citations omitted). It is based on the idea that “one person
24
should not be permitted unjustly to enrich himself at the expense of another, but should be
25
26
27
28
6
Shin also argues that he reported the bug to ICON via Thomas Aellis. The undisputed facts
show that he talked to Aellis as his “friend” and not as representative for ICON. Even if Shin had
reported the bug to ICON, he still exploited it 557 times for his own personal gain. Merely
reporting one’s wrongdoing, while continuing on with that wrongdoing, does not legitimize an
otherwise illegitimate claim to exclusivity.
14
United States District Court
Northern District of California
1
required to make restitution of or for property or benefits received, retained, or appropriated,
2
where it is just and equitable that such restitution be made, and where such action involves no
3
violation or frustration of law or opposition to public policy, either directly or indirectly.” See
4
Cnty. of San Bernardino v. Walsh, 158 Cal. App. 4th 533, 542-43 (2007), as modified on denial of
5
reh’g (Jan. 25, 2008).
6
Unjust enrichment “applies where plaintiffs, while having no enforceable contract,
7
nonetheless have conferred a benefit on defendant which defendant has knowingly accepted under
8
circumstances that make it inequitable for the defendant to retain the benefit without paying for its
9
value.” Hernandez v. Lopez, 180 Cal. App. 4th 932, 938 (2009). While the defendant’s benefit
10
and the plaintiff’s loss are often the same, the principle of unjust enrichment is “broader” than a
11
mere “restoration” of what the plaintiff lost. See Walsh, 158 Cal. App. 4th at 542. Indeed, where
12
“a benefit has been received by the defendant but the plaintiff has not suffered a corresponding
13
loss, or, in some cases, any loss, but nevertheless the enrichment of the defendant would be unjust
14
. . . [t]he defendant may be under a duty to give the plaintiff the amount by which [he] has been
15
enriched.” See id. (quoting the Rest., Restitution, § 1, com. e.).
ICON seeks summary judgment on its unjust enrichment counterclaim, arguing that the
16
17
undisputed facts show that it is unjust for Shin to retain the bug-generated ICX. Shin counters that
18
ICON’s unjust enrichment counterclaim fails as a matter of law because neither ICON nor any
19
other ICX holder transferred the bug-generated ICX tokens to him, so no one suffered any loss or
20
expense through his actions. Shin MSJ 11-12. His argument is unpersuasive.
Fundamentally, ICON does not need to establish that it, or any Network user, transferred
21
22
the bug-generated ICX to show that Shin was unjustly enriched by their receipt. Shin points to no
23
contrary authority. Nobody else needed to have a property interest in the tokens before Shin
24
generated them for Shin to have been unjustly enriched.7 See e.g., Walsh, 158 Cal. App. 4th at
25
26
27
28
7
Shin also argues that the law does not recognize an unjust enrichment claim where the benefit
was not conferred by an “identifiable entity.” Here the identifiable entity was the Network,
established by ICON. Only a flaw in software that the Main P-Reps approved—Revision 9—
allowed his exploitation. See supra.
15
1
543 (“[t]ypically, the defendant’s benefit and the plaintiff’s loss are the same . . . [but] the
2
principle of unjust enrichment is broader than mere ‘restoration’ of what the plaintiff lost”).
3
California public policy “does not permit one to ‘take advantage of his own wrong’,” regardless of
4
whether the other party suffers actual damage. See Ward v. Taggart, 51 Cal.2d 736, 741–42
5
(1959). Unjust enrichment focuses on the wrongdoer’s gain, not the victim’s loss. See Walsh, at
6
542.
But on top of that, Shin caused harm. He denies that, contending that ICON has not shown
United States District Court
Northern District of California
7
8
that his actions were what caused the price of ICX to drop. See Shin MSJ 22-26. But his
9
argument defies common economic logic. The value of any commodity is derived at least in part
10
from its scarcity, and there is no reason why cryptocurrency would be an exception. See Kim Decl.
11
¶ 34; Shin Depo. at 97:14-99:11. And it is generally true that faith in the stability and integrity of
12
a system enhances its reputation and therefore the likelihood of use of the system. See ICON MSJ
13
3:3-6 (observing that endorsement of Shin’s claims would “make digital property value systems
14
substantially less secure”); see Kim Decl. ¶ 87 (asserting that Shin’s sales of the bug-generated
15
ICX depressed the price of ICX and damaged ICON’s reputation).
Shin’s generation of 14 million ICX tokens on August 22, 2020, increased the total volume
16
17
of ICON’s cryptocurrency and lessened its scarcity. After ICON’s public disclosure of what Shin
18
did on August 22, 2020, the price of ICX decreased by nearly 40% in the two weeks following.8
19
Shin objects to ICON’s evidence in support for its claims of damage to its value. See Reply in
20
Support of Shin MSJ (Evidentiary Objections) [Dkt. No. 192] 5-6 (objecting to Kim Decl. ¶ 87,
21
which states that “‘Shin’s substantial sales of the Bug-Generated ICX had the effect of depressing
22
the price of ICX and damaging the reputation of the ICON Network. In the two-week period
23
between August 24 and September 5, 2020, when Shin’s exploit became widely known within the
24
ICON community, the price of ICX decreased by almost 40%, from 65 cents to 40 cents.’”); see
25
also Shin MSJ 22-26 (arguing that ICON has not produced sufficient proof that Shin’s actions
26
27
28
Shin’s “finders keepers” argument is also unavailing. See Shin MSJ 16-18. Shin did not “find”
the bug-generated ICX. He intentionally produced it via a bug in someone else’s software. The
ICX would not have existed but for his repeated triggering of the bug in question. This was not
“abandoned property, [a] treasure trove, or lost property.” See Shin MSJ 16.
16
8
1
were responsible for its downturn in currency price following the Revision 9 bug). But it seems
2
implausible that Shin’s actions did not have a detrimental impact in some way on the Network,
3
either by decreasing the scarcity of ICX tokens or by damaging its reputation or both.
United States District Court
Northern District of California
4
The parties argue over the applicability of a case that ICON cites in response to Shin’s
5
summary judgment motion, Hernandez v. Lopez, 180 Cal. App. 4th 932 (2009). There, the
6
defendants began the process of purchasing the plaintiffs’ restaurant, never closed escrow, but
7
then purported to resell the restaurant they did not own to a third party and retained all the
8
proceeds for themselves. The plaintiffs sued for conversion, trespass, and unjust enrichment. The
9
trial court dismissed their case for failure to state a claim and allowed the defendants to keep the
10
proceeds of the sale. In reversing the trial court’s decision, the California Court of Appeal
11
explained that the unjust enrichment doctrine applies “where plaintiffs, while having no
12
enforceable contract, nonetheless conferred a benefit on defendant which defendant has knowingly
13
accepted under circumstances that make it inequitable for the defendant to retain the benefit
14
without paying for its value.” Hernandez, 180 Cal. App. 4th at 938-39 (citing Dunkin v. Boskey,
15
82 Cal. App. 4th, 171, 195 (2000)) (emphasis added). The court also noted that “ ‘[i]n the modern
16
legal usage, [the term unjust enrichment]’s meaning has frequently been extended to include not
17
only the restoration or giving back of something to its rightful owner, but also compensation,
18
reimbursement, indemnification, or reparation for benefits derived from, or for loss or injury cause
19
[sic] to, another.’” Id. at 939. “ ‘The phrase ‘unjust enrichment’ does not describe a theory of
20
recovery, but an effect: the result of a failure to make restitution under circumstances where it is
21
equitable to do so.’” Id. (quoting Dunkin, at 198).
22
Shin asserts that Hernandez considered a “textbook example” of unjust enrichment that
23
compelled a “morally obvious rule,” which is “inapposite to the facts of this case.” Shin Reply
24
[Dkt. No. 192] 11. I do not agree. Hernandez stands for the principle that unjust enrichment
25
exists when someone has retained a profit that they should not have because they made that profit
26
via inequitable means, regardless of whether that profit was derived from or equal to the plaintiff’s
27
loss. This rule applies here. That Shin received a benefit is not disputed. Even though many of
28
the ICX tokens were frozen or seized, Shin acquired other assets with some of the tokens that were
17
1
not frozen or seized and transferred several thousand others to his family and friends. He was able
2
to spend more than $1 million of the bug-generated ICX before any of it was frozen by the Main
3
P-Reps or the exchanges. Dkt. 173 ¶ 2, Ex. 1 at pp. 243:1-6. His actions were inequitable not only
4
because he caused ICON direct harm, which he disputes, but also because he exploited, received,
5
and knowingly retained a benefit that was conferred to him via his willful decision to manipulate
6
what he understood to be a flaw in the Network, which he concedes.
There may be a factual dispute about the degree to which Shin’s actions drove ICON’s
United States District Court
Northern District of California
7
8
downturn in token price. That dispute is immaterial, because to prevail on its unjust enrichment
9
counterclaim ICON need not show that Shin caused it harm. Unjust enrichment is an equitable
10
claim, the remedies for which are designed to fill in the gaps left by an absence of contract or other
11
protective law. Shin was unjustly enriched by exploiting the bug in the software 557 times. It
12
would be inequitable to allow him to retain any benefit from that conduct.
For the reasons described throughout this Order, ICON’s Motion for Summary Judgment
13
14
on its unjust enrichment claim is GRANTED. Shin’s Motion for Summary Judgment on the same
15
is DENIED.
16
IV.
17
DECLARATORY RELIEF AND REMEDY
ICON also seeks declaratory relief. It wants a court order requiring that the bug-generated
18
ICX be destroyed and that the crypto assets that Shin acquired with the bug-generated ICX be
19
converted back into ICX and then destroyed. ICON MSJ 25; Opposition to Shin MSJ (“ICON
20
Oppo.”) [Dkt. No. 188] 20-25. It “predicates its declaratory relief claim on two, related, but
21
different equitable remedies—nonrestitutionary disgorgement and constructive trust.” See ICON
22
Oppo. 20-21. Shin responds generally that ICON’s proposed remedy “does not achieve equity”
23
and “seeks to turn this court into a tool of [ICON’s] own market manipulation.” Reply in Support
24
of Shin MSJ [Dkt. No. 192] 16-18. It is unclear from his arguments whether he asserts that any of
25
the seized assets were acquired independent from the bug-generated ICX.
26
As I stated at oral argument, the determination of the equitable remedy requires more
27
attention. Shin shall file a memorandum of no more than 10 pages within two weeks explaining
28
why ICON’s request is inequitable and making any appropriate counter proposal. ICON may
18
1
respond two weeks thereafter with a memorandum of no more than 10 pages. Shin may reply a
2
week after that with a memorandum of no more than five pages. I will set a hearing if necessary
3
after reviewing the briefing.
4
CONCLUSION
5
ICON’s Motion for Summary Judgment on Shin’s conversion and trespass to chattels
6
claims and on its unjust enrichment counterclaim is GRANTED and those claims are dismissed
7
with prejudice. Shin’s Motion for Summary Judgment on ICON’s unjust enrichment claim is
8
DENIED.
9
10
IT IS SO ORDERED.
Dated: June 6, 2024
United States District Court
Northern District of California
11
12
William H. Orrick
United States District Judge
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
19
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?