Attorney Shao Shiwei | DEXX Trading Platform Suffers Theft of User Assets Exceeding Hundreds of Millions: What Liabilities Should the Platform and KOLs Bear?

On November 16, 2024, the crypto assets trading platform DEXX was subjected to a hacker attack. Related reports indicate that user assets stolen by hackers exceeded hundreds of millions of US dollars, causing significant losses to many users, while rights-protection groups are rapidly forming. As an emerging crypto assets trading platform operated by Chinese nationals, its rapid rise benefited from extensive promotion by numerous Key Opinion Leaders (KOLs).

So, regarding this security incident, what are the legal risks for the platform operator and KOLs? What liabilities should they bear for user losses?

01

As a Memecoin platform supporting multi-chain asset trading, DEXX covers on-chain assets across SOL, ETH, TRX, BASE, BSC, and other chains. According to its official website, it features functions such as on-chain mobile take-profit/stop-loss, hot concept push notifications, smart wallet tracking push notifications, principal withdrawal upon doubling, one-click anti-sandwich attacks, and one-click copy buying/selling. Because the DEXX interface is quite similar to Binance, some KOLs have also referred to it as the "on-chain Binance."

In the early hours of November 16, DEXX reported a hacker attack, with multiple users reporting unauthorized transfers of their wallet assets. Blockchain security audit firm CertiK stated that the primary cause of the incident was improper private key management by the DEXX platform, leading to the leakage of official private keys. Yu Xian, founder of SlowMist Technology, also mentioned in his post: "The victims were associated with using DEXX to trade speculative tokens/MEME coins; since private keys were under DEXX's centralized custody, they were definitely leaked."

Investigations by some individuals revealed that DEXX had a vulnerability involving plaintext transmission of private keys. This means that users' private keys were stored on DEXX servers; if the system were attacked, hackers could easily obtain users' private keys and subsequently steal assets.

DEXX has not been established for long. The rapid growth in its user base is closely related to extensive promotion by numerous Chinese-language KOLs on Twitter.

According to the DEXX official website, the platform's promotional commission rate is as high as 60% of transaction fees.

                                                                                                                                                                                                   (Commission Ranking List)

Following this incident, many KOLs began deleting promotional posts and quickly distanced themselves from the platform to clarify their stance.

First, as a crypto assets trading platform operated by Chinese nationals and open to citizens within China, given that the "September 24 Notice" of 2021 stipulated that virtual currency-related businesses constitute illegal financial activities, and that overseas virtual currency exchanges providing services to residents within China via the internet also constitute illegal financial activities, the platform faces significant criminal risks regardless of whether this incident was "insider theft" or an "accidental event."

Second, according to in-depth technical analysis by the BitJungle monitoring system, the DEXX trading platform has the following serious security issues:

• Private Key Storage: Although DEXX claims not to be a custodial wallet, it records users' private keys. Once the system is attacked, hackers can easily obtain users' private keys and thereby steal user assets.

• Plaintext Transmission of Exported Private Keys: DEXX took no encryption measures when users exported private keys, resulting in private keys being exposed in plaintext during transmission, making them highly susceptible to interception by hackers.

Before the facts are fully ascertained, we will not discuss whether the platform engaged in "insider theft" regarding this incident. However, based solely on the aforementioned security issues, the platform violated its legal obligation under China's Cybersecurity Law to protect user information security. The platform's plaintext transmission of user passwords, leading to information leakage, also constitutes tortious conduct against users.

Furthermore, although plaintext transmission itself may not constitute a criminal act, if it causes serious consequences, persons responsible for the platform may be suspected of criminal offenses such as the crime of illegally obtaining data from computer information systems and the crime of infringing upon citizens' personal information, pursuant to the Criminal Law.

According to the "September 24 Notice," "overseas virtual currency exchanges providing services to residents within China via the internet also constitute illegal financial activities... Legal persons, unincorporated organizations, and natural persons who know or should know that they are engaged in virtual currency-related business but still provide services such as marketing and promotion... shall be held legally accountable."

Leveraging their credibility and influence within the crypto circle, KOLs heavily promoted the DEXX platform on social media platforms such as Twitter, referring to it as the "on-chain Binance" and earning high commission revenues. Their conduct violates the aforementioned regulations.

Attorney Shao previously mentioned in the article "What Are the Legal Risks for Crypto Circle KOLs Promoting Projects?" that KOLs promoting crypto assets trading platforms may be suspected of crimes such as fraud, operating casinos, and organizing or leading pyramid schemes, citing several cases in the article.

However, regarding the security incident on the DEXX platform, the criminal charge most likely to be implicated is the crime of illegally utilizing information networks (often referred to as a "pocket crime"). The most distinct feature distinguishing this crime from others is the utilization of information networks, where the dissemination of information is conducted exclusively through online means. As Attorney Shao mentioned in the article "A Crime That Crypto Entrepreneurs Must Pay Special Attention To—Crime of Illegally Utilizing Information Networks (Part II)", many Web3 entrepreneurs are aware of common legal provisions in China, such as the prohibitions on operating exchanges, issuing tokens, and mining. However,the publication and promotion of crypto-related news and information are generally not considered to carry legal risks, but once problems arise with the promoted project, the publishers of such information face legal risks.

For the Platform Operator, regarding this incident, if it is indeed confirmed that the platform operator engaged in "insider theft," the relevant liabilities are self-evident. If it was indeed an accidental event caused by a hacker attack, given that the platform operator did store users' private keys and transmitted exported private keys in plaintext, failing to effectively protect user information security and resulting in damage to user assets, it is recommended that the platform continuously update investigation progress, including detailed analysis of technical vulnerabilities, proactively assume responsibility, and clarify compensation mechanisms and specific measures for user losses.

For KOLs, since they relied on their own influence to promote the platform, and fans chose to believe the promotional information based on trust in the KOLs, regardless of the specific liability of the platform operator in this incident, it is recommended that KOLs proactively acknowledge the subsequent collateral impact, actively assist users in protecting their rights, and provide help within legal bounds, such as compiling data on user losses and assisting users in communicating with the platform for solutions. Of course, if conditions permit, it is recommended that KOLs provide certain compensation to users to the best of their ability. Even if KOLs are not legally determined to bear liability for their promotional acts, proactive compensation demonstrates the KOLs' emphasis on user rights and a responsible attitude toward their promotional conduct. Objectively, compensation can also effectively reduce the likelihood of affected users taking further legal action.