Bluemoonstudio Inc v Bybit Technology Limited (CC 40 of 2025) [2025] SCSC 138 (25 August 2025)

SUPREME COURT OF SEYCHELLES In the matter between: BLUEMOONSTUDIO INC (rep. by Attorney-at-law Ms Rene Durup) and BYBIT TECHNOLOGY LIMITED (rep. by Attorney-at-law Ms Evelyn Almeida) Reportable CC 40/2025 Plaintiff Defendant Neutral Citation: Bluemoonstudio Inc v Bybit Technology Limited (CC 40/2025) Before: Summary: Heard: Delivered: 6th October 2025 Burian J Declaration of ownership-return of frozen cryptocurrency assets 25th August 2025 and 5th September 2025 6th October 2025 ORDER (i) It is hereby declared that the Plaintiff is the lawful owner of the frozen cryptocurrency assets amounting to 4,685,957.6 TAVA token, 3.55147012 bitcoin, 414,479 USDT and 2.62236501 BNB; (ii) The Defendant shall release and transfer the frozen assets as stipulated in (i) above into the Plaintiffs chosen wallet address which is as follows: Wallet Address: Network: Ethe (iii)The claimed funds cannot and should not be released from the personal funds and wallet addresses of the Defendant but only from the accounts on which the frozen funds were traced to and frozen; (iv) Until the transfer referred to in (ii) above is completed, the injunction granted on the 2nd December 2024 continues to remain in force; and (v) Each party shall bear their own costs. JUDGMENT BURIANJ BACKGROUND FACTS [1] The Plaintiff is a South Korean company and the Defendant is an intemational business company incorporated in Seychelles and operating the Bybit online exchange. In December 2023, the Plaintiff purportedly obtained 55 million TAVA tokens from the Altava Foundation, a Singaporean entity and creator of the TAVA token. The tokens were deposited on the online Metamask decentralized wallet on six partner wallets. It is the Plaintiff's case that the said 55 million TAVA tokens were stolen by way of an unauthorized transfer from the said six partner wallets on 1 June 2024 to five different hacker wallets. [2] Of the 55 million TAVA tokens from hacker wallets, 22,125,928 TAVA tokens were deposited into the Bybit deposit wallets. The Defendant promptly identified suspicious activities and froze the accounts associated with the deposit addresses, preventing further deposits by the hackers. [3] According to the Plaint, after the Defendant froze the accounts, the hackers used decentralized exchanges to convert the remaining TAVA tokens into USDT. The USDT were transferred to four swap exchange platforms to convert the USDT into Bitcoin to obfuscate the funds trail. On 27 June 2024, the assistance of the law enforcement and cybersecurity agencies at Korea National Police Agency ('KNPA') were sought to pursue further investigation. The Cyber Investigation Division at the Seoul Metropolitan Police Agency ('SMPA') investigated the case and identified that the reported hacked funds flowed into the deposit wallets held within the centralized exchange platform. After investigation, SMPA confmned that the funds are currently frozen pending legal proceedings from the exchanges. On 17thJuly 2024, SMPA sent an official request to the Defendant to provide the necessary procedures for retrieving these frozen funds in accordance with the applicable laws and regulations and requested cooperation for the release of the funds back to the owner. [4] Simultaneously upon SMPA's request, the Defendant provided the details of deposit and withdrawal logs by the hackers, as summarized below. According to the log provided to SMPA on 17th July 2024, a total of 22,125,928 TAVA tokens were deposited into Bybit deposit wallets, and a withdrawal ofUSD 482,832 in Bitcoin and USDT were made after the hackers swapped the TAVA tokens into Bitcoin and USDT. As of 14 August 2024, the Bybit law enforcement team confirmed that 4,685,957.6 TAVA tokens, 3.55147012 Bitcoin and 414,479 USDT and 2.62236501 BNB remained frozen, which are subject to retrieval and would require a court order issued by the Seychelles Courts for the Defendant to release the frozen funds. [5] Wherefore, the Plaintiff is therefore moving this Honorable Court for a judgment as follows: (i) A declaration that the above said 4,685,958 TAVA tokens, 3.55147012 Bitcoin and 414,479 USDT and 2.62236501 BNB belong to the Plaintiff; (ii) An order that the Defendant transfer the 4,685,958 TAVA tokens, 3.55147012 Bitcoin, 414,479 USDT and 2.62236501 BNB into the Plaintiff's wallet address, provided as follows: a. Wallet Address: b. Network: Ethereum Main Network, (ERC-20) (iii) Lastly to pay costs to the Plaintiff. [6] Following the filing of the principle suit, the Plaintiff was granted injunctive relief on the 2nd December 2024 whereby the court pending the final disposal of the main action or until further order issued the following order: (i) Prohibiting or preventing the disposal by the Defendant of the following which originated from the Plaintiff's 22,125,928 TAVA tokens: 4,685,958 TAVA tokens, 33.55147012 Bitcoin and 414,479 USDT and 2.62236501 BNB; [7] The Defendant is not disputing the claim per se and acknowledges that 22,125,928 TAVA tokens were deposited into the wallet addresses held on Bybit Exchange, based on 11 wallet addresses and their respective transaction hashes which were provided by the SMPA, to Bybit's law enforcement team via an official law enforcement request dated 17th July 2024. It has further accepted that the Defendant promptly identified suspicious activity and froze the accounts associated with the deposit addresses. It is further admitted that the SMPA sent an official request to the Defendant on 17thJuly 2024 requesting the release of the frozen funds to Altava Group following which the Defendant requested that measures be taken to obtain a court order in order to retrieve the frozen funds in the wallet addresses as identified in SMPA's request. [8] The Defendant position is that the frozen assets can be traced back to the unique identifiers in lJID 194480711, lJID 195812413, UID 197104129 and UID 194906827. The Defendant does not accept responsibility for the hacking incident but has in good faith frozen the funds and as such will release the funds from the frozen accounts to the proven lawful owner. [9] Contrary to the sums as pleaded in the Plaint, it is averred that the amount of frozen funds is 4,685,957.6 TAVA tokens, 3.55147012 Bitcoin, 414,479 USDT, and 2.62236501 BNB, and not the amount as claimed by the Plaintiff. [10] The Defendant therefore prays for the following orders: (i) a court declaration that the frozen funds amount to 4,685,957.6 TAVA tokens, 3.55147012 Bitcoin, 414,479 USDT, and 2.62236501 BNB and not the amount as averred by the Plaintiff; (ii) An order for the release of the frozen funds only to the proven lawful owner of the said funds and that these funds if ordered to be released are released only from the accounts on which the frozen funds were traced to and frozen; (iii)An order that the claimed funds cannot and should not be released from the personal funds and wallet addresses of the Defendant as the Defendant is not the hacker and therefore not the cause of the Plaintiff s purported loss of funds; (iv)That the Plaintiff bears the costs of the suit; and (v) Any other order that the Court deems fit in these circumstances. EVIDENCE [11] Mr. Daniel Choe, is authorised to represent and testify on behalf of the Plaintiff through a Power of Attorney dated 5thSeptember 2024 and duly registered in Seychelles on the 22nd October 2024. [12] The following documents were tendered as exhibits through Mr. Daniel Choe: • Exhibit PI: A duly apostilled copy of the United States Passport of Mr. Daniel Choe; • Exhibit P2: A duly apostilled and registered Power of Attorney dated 5th September 2024 and registered 20th October 2024; • Exhibit P3: A duly apostilled affidavit of Mr. Kim Nampyo along with its supporting documents; • Exhibit P4: The Plaintiffs duly apostilled certificate of business registration; • Exhibit P5: A duly apostilled and certified copy of the Plaintiffs company register; • Exhibit P6: Certificate of incorporation of change of name of the Defendant and a copy of the official search; • Exhibit P7: A duly apostilled token purchase agreement dated 13th December 2023; and • Exhibit P8: A duly apostilled expert report dated 2nd September 2024. [13] Through the evidence of Mr. Daniel Choe it has been established that the Plaintiff is an investment company operating out of Seoul, South Korea and carries out business including but not limited to the holding of foreign assets including cryptocurrency. He confirmed that the Plaintiff had through a purchase agreement dated 13th December 2023 come into possession of 300 million TAVA tokens. The tokens were purchased from ALTCORE LIMITED, a company with its registered address in the British Virgin Islands for the price of 100 Korean Won per TAVA. [14] Mr. Daniel Choe was also called upon to give his expert testimony on the hacking incident of the TAVA tokens belonging to the Plaintiff. Mr. Choe is employed as an Investor with the ALTAVA GROUP. He comes from a diverse background with seven years in the financial industry and three years in both block chain and crypto projects. He confirmed that with his background and expertise, he is qualified to trace stolen cryptocurrency assets. He went on to explain that during the investigative stage he used various forensic tools and blockchain explorers to track the hacker movement across wallets, all of which is detailed in his expert report. He confirmed that he made use of platforms like Etherscan and Arkham Intelligence to analyse transaction activities and wallets. He further confirmed that the data collected and all the evidentiary needs align with industry standards and blockchain practices. After an examination as to his qualifications and experience in the field of cryptocurrency and tracing, this Court was satisfied that Mr. Choe had the required expertise to testify as an expert witness. [15] The report compiled dated 2nd September 2024 was prepared to provide a comprehensive understanding of the hacking incident involving the unauthorised transfer and exchange of TAVA tokens on the I" June 2024. The report outlines the sequence of events, methods of unauthorized transactions by the hacker, and ALTAVA Group's subsequent tracing efforts across various exchanges and blockchain networks of the stolen assets for the Plaintiff. [16] According to the executive summary, the hacking incident took place on the 151 June 2024 whereby 55 million TAVA tokens were hacked from six Bluemoon Studio's wallets (Table I of exhibit P8) and subsequently transferred across different exchanges and platforms and partially depositing into a central exchange, of which 22,125,928 TAVA tokens were deposited into deposit wallets held by the Defendant (Table 3 of exhibit P8). Upon discovering the hack, the Plaintiff alerted ALTAVA GROUP who immediately reached out to the Defendant to identify and freeze all suspected wallets used to siphon the stolen funds. [17] The report goes on to detail that out of the 22,125,928 TAVA tokens deposited into the Defendants deposit wallets, the hacker managed to withdraw USD 482,832 by swapping TAVA tokens into Bitcoin and USDT (Table 7, 8 and 9 of exhibit P8). Mr. Choe also confirmed that the hack had been reported to the KNPA in order for them to pursue further investigation and the SMPA investigated the case and identified that the reported hacked funds flowed into the deposit wallets held with the centralized exchange platforms, which included the Defendant. Upon SMPA's request, the Defendant provided the details of deposit and withdrawal logs by the hacker (Table 10 of exhibit P8). The Defendant was however able to freeze the remaining amount and their law enforcement team has confirmed that 4,685,958 TAVA token, 3.55147012 Bitcoin, 414,479 USDT and 2.62236501 BNB remain frozen as of the 14th August 2024, which funds are subject to retrieval following a cOUl1order for the Defendant to release the frozen funds back to the Plaintiff. [18] Mr. Choe confirmed that the sum of 4,685,958 TAVA token was initially claimed by the Plaintiff however acknowledged that this figure was rounded up and accepted the correct sum to be 4,685,957.6 TA VA token currently frozen and held by the Defendant. The Plaintiff further agreed to drop its claim for costs against the Defendant. [19] Upon cross-examination, Mr. Choe confirmed the Plaintiff purchased 300 million TAVA tokens from ALTA VA Group in December 2023 which is why his employer agreed to assist the Plaintiff with the recovery of the stolen assets. He further confirmed that through the power of attorney, he was duly appointed to represent the Plaintiff in all conununications and dealings with both the police authorities and the Defendant for the recovery of the stolen assets and he confirmed that all assets were traced to four Unique Identifiers held by the Defendant and that the request for the release would be in respect of those four wallets and not the personal wallets of the Defendant. [20] Mr. Kim Nampyo, a South Korean national and a director of the Plaintiff testified through the assistance of an interpreter. He confirmed that the Plaintiff is a registered South Korean Company and that one of its activities is to invest in cryptocurrency assets including TA V A tokens. He confirmed that the Plaintiff bought 300 million TA VA tokens from ALTAVA Group and that 55 million of those tokens were hacked. He stated that the assistance of law enforcement was sought after the incident and that the tokens were traced to four wallets held in the Defendant's exchange. He further confirmed that a case has now been filed before the Seychelles Supreme Court for a declaration that the outstanding assets belong to the Plaintiff and for an order that the assets be transferred back to the Plaintiff. [21] Mr. Nampyo confmned that the Plaintiff had granted a power of attorney to Mr. Daniel Choe to pursue the investigation into the stolen assets and to represent the Company in the court action. He further confirmed that authorisation had been given for Mr. Choe to accept the assets in a designated wallet account on the Plaintiffs behalf and that afterwards the assets would be transferred back to the Plaintiff. He further agreed that no costs will be sought for against the Defendant. Upon cross-examination, he confirmed that Mr. Choe had full power of attorney to represent the Plaintiff and acknowledged that the amongst the frozen tokens included 4,685,957.6 TAVA tokens. [22] The defence relied on the evidence of a sole witness, namely, Mr Chris Sow, a Law Enforcement Officer duly authorised to testify on behalf of the Defendant through a Power of Attorney (Exhibit Dl). He confirmed that the Defendant had received a claim from the Plaintiff in relation to certain assets held on the exchange that had been frozen by the Defendant following suspicious activity. He acknowledged that 22,125,928 TAVA tokens were deposited into wallet addresses held on the Defendants exchange and that the police authorities had made a specific request for information pertaining to 11 wallet address held on the exchange. He further confirmed that the Defendant does not have access to the wallets as they are held by individuals and not the Defendant, but that he was able to identify four unique identifiers (the accounts holding the wallets) based on the 11 wallet addresses and that this information was subsequently provided to the police along with their withdrawal and the deposit history. Mr. Sow confirmed that the frozen assets amounted to 4,685,957.6 TAVA token, 3.55147012 bitcoin, 414,479 USDT and 2.62236501 BNB. [23] Lastly, Mr Sow confirmed that following communications with Mr Daniel Choe, the Defendant had requested that a court order be obtained in order to verify the owner of the assets following which they would be remitted to the rightful owner. LAW AND ANALYSIS Expert evidence: [24] There was a question as to whether Mr. Daniel Choe should be considered an 'expert witness' and as to whether his report should be admissible. In the case of Grandcourt v Seychelles Petroleum Co. (Ply) Limited' , Justice Twomey-Woods took the time to examine the definition of an expert witness in order to assist her with a determination as to the experts credibility. [25] The legal definition of an expert witness has been expressed as: 1 (SCA 53 of 2019) [2022) SCCA 15 (29 April 2022) "a person who is a specialist in a subject, often technical, who may present his/her expert opinion "without having been a witness to any occurrence relating to the lawsuit or criminal case. "2 [26] Justice Twomey-Woods also considered the definitions as provided in the case of Hedge Funds investment Management Ltd v Hedgeintro international Ltd & 2 Ors': "[33] ... Stroud's Judicial Dictionary defines an expert as: "one who has made the subject upon which he speaks a matter ofpractical study, practice, Or observation; and he must have a particular and special knowledge of the subject" (2nd Edn 670, citing Dole v Johnson 50 N Hamp 454,). [34] Black's Law Dictionary defines an expert as "A person, who through education or experience, has developed skill or knowledge in a particular subject, so that he or she mayform an opinion that will assist the fact-finder" (9th Edn, 661). " [27] Our Evidence Act, defines an expert opinion as follows: "Expert opinion 17..(J) In any trial a statement, whether offact or opinion or both, contained in an expert report made by aperson, 'whether called as a witness or not, shall, subject to this section, be admissible as evidence of the matter stated in the report of which direct oral evidence by the person at the trial would be admissible. (3) Nothing ill this section affects the admissibility of an expert report under any other written law or otherwise thanfor the purpose of proving the matter stated in the expert report. 2 https:fflegal-dictionary. thefreedi ctionary.com/expert+witness 3 (CC 4f2012) [2017] SCSC 88 (06 February 2017) (4) In this section "expert report" means a written report by a person dealing wholly 0" mainly with matters on which the person is or would, if'living, be qualified to give expert evidence. " [28] Taking into account all the above, I am of the considered view that the courts have broad discretion in recognizing a witness as an expert and the test as highlighted in paragraphs 24-26 above, involves a determination as to whether the person possesses specialized knowledge, skill, experience, training, or education that is likely to assist the court in understanding or determining a fact in issue. I am of the opinion that formal certification is not an absolute requirement and practicable demonstrable experience can suffice if it is shown to give the person expertise beyond that of an ordinary layperson. [29] In the UK & Commonwealth jurisdictions, the court often accept experts based on experience alone, e.g. forensic accountants or IT professionals without formal academic credentials but with long practical experience. An example occurred in the case of R v Silverlock', whereby a solicitor with experience in handwriting comparison (but no formal training) was admitted as an expert. Similarly, courts have recognized police officers as experts in drug valuation, gang operations, and digital forensics based purely on expenence. [30] Therefore I believe that the court may declare a person with three or more years of on the-job experience in cryptocurrency tracing as an expert, even without formal certification, if they can show: (i) Their work has given them specialized knowledge not possessed by ordinary persons. (ii) They can explain their methods clearly and withstand cross-examination. (iii)Their expertise will help the court resolve technical issues relating to cryptocurrency. [31] In the present case, Mr. Daniel Choe testified to the fact that has worked in the cryptocurrency field for three years in a professional capacity, handling real-world investigations, analysis, and reporting. This practical experience was sufficient for the cOUl1to recognize him as an expert and I am of the view that the absence of formal 4 (1894)2 QB 766 academic qualifications or certifications in crypto-tracing did not automatically disqualify him as an expert because I find that his knowledge was specialized enough and relevant to assist the Court in the determination before it. Proof of 0wnersb ip: [32] Courts that deal with stolen or hacked cryptocurrency face a unique challenge because unlike traditional property, cryptocurrency assets are decentralised, pseudonymous, and often cross borders. The methods used to establish ownership and traceability are numerous and include wallet addresses and transaction history which can show the Plaintiffs wallet held the cryptocurrency in question before it was transferred away. [33] The courts will therefore look for evidence showing that the Plaintiff was the rightful holder of the assets before the theft. In this instance, the Plaintiff has produced a token purchase agreement dated 13th December 2023 in which it purchased 300,000,000 tokens ofTAVA fromALTCORE LIMITED at the price of 100 Korean WonperTAVA. [34] The expert report shows that on the l" June 2024 (table 1) six of the Plaintiffs wallets were subject to unauthorised transactions. The data reveals a total of 55,000,0001- TAVA tokens were hacked and transferred to five different wallets controlled by the unidentified hackers. The expert report went on to demonstrate how blockchain analysis tools where used to follow the path of the stolen crypto which led to five unidentified wallets (table 2). Out of the 55 million TAVA tokens stolen, 22,125,9281- tokens were retransferred and deposited into the Bybit deposit wallets (table 3). The Defendant co operated with law enforcement and their law enforcement team provided a log to the SMPA on the 17thJuly 2024 which confirmed that a total of 22, 125,928 TAVA tokens were deposited into Bybit deposit wallets (Table 10) and that withdrawals of USD 482,832 in Bitcoin and USDT were made after the hacker swapped TAVA tokens into Bitcoin and USDT (Table 11). [35] This Court also notes that it is also not in dispute that as of the 14thAugust 2024 the total amount frozen is 4,685,957.6 TAVA token, 3.55147012 bitcoin, 414,479 USDT and 2.62236501 BNB, which assets the Defendant is prepared to return to the rightful owner subject to a court order. CONCLUSION AND ORDERS: [36] Considering the pleadings and evidence, this COUltis satisfied on the balance of the probabilities that the cryptocurrency assets presently frozen by the Defendant in its exchange account and traced to the following Unique Identifiers ('UJD') namely UJD 194480711, UID 195812413, UJD 1971104129 and UJD 194906827 are stolen funds belonging to the Plaintiff. I am further satisfied that the frozen funds amount to 4,685,957.6 TAVA token, 3.55147012 Bitcoin, 414,479 USDT and 2.62236501 BNB. The Defendant has no objection in maintaining the freeze and they are willing to release the assets subject to a court order. In the circumstances, it is just and equitable that a declaration of ownership be made in favour of the Plaintiff, and that consequential relief be granted directing the return of the assets to the Plaintiffs designated wallet. [37] I therefore make the following declarations and orders: (i) It is hereby declared that the Plaintiff is the lawful owner of the frozen cryptocurrency assets amounting to 4,685,957.6 TAVA token, 3.55147012 Bitcoin, 414,479 USDT and 2.62236501 BNB; (ii) The Defendant shall release and transfer the frozen assets as stipulated in (i) above into the Plaintiff's chosen wallet address which is as follows: Wallet Address: Network: Ethereum Main Network (ERC-20) (iii) The claimed funds cannot and should not be released from the personal funds and wallet addresses of the Defendant but only from the accounts on which the frozen funds were traced to and frozen; (iv) Until the transfer referred to in (ii) above is completed, the injunction granted on the 2nd December 2024 continues to remain in force; and (v) Each party shall bear their own costs. Signed, dated and delivered at Ile du Port on 6th October 2025 Burian J