Nowak v. Xapo, Inc.

DENNIS NOWAK, Plaintiff, v. XAPO, INC., et al., Defendants.

Case No. 5:20-cv-03643-BLF

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

November 20, 2020

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS WITH LEAVE TO AMEND

[Re: ECF 22]

Dennis Nowak ("Plaintiff") sues Xapo, Inc., Xapo (Gibraltar) Limited, Indodax, and ten unidentified John Doe defendants (collectively, "Defendants") for hacking into his cryptocurrency exchange account, stealing 500 Bitcoins, and depositing them into separate hot wallet addresses. Plaintiff asserts violations of (1) California Penal Code § 496 (Possession of Stolen Property); (2) Aiding and Abetting under 18 U.S.C. § 1030(a)(4) (the Computer Fraud and Abuse Act); and (3) Assisting Unlawful Access to a Computer under California Penal Code § 502 et seq. (the Comprehensive Computer Data Access and Fraud Act). See generally Compl., ECF 1. Xapo, Inc. ("Defendant") brings this Motion to Dismiss for failure to state a claim. See Mot. to Dismiss ("Mot."), ECF 22. The Court heard arguments for the Motion on November 12, 2020. Mot. Hr'g, ECF 45. For the reasons stated on the record and discussed below, the Motion is GRANTED WITH LEAVE TO AMEND.

I. BACKGROUND

A. Factual Allegations

In November 2018, unidentified hackers infiltrated Plaintiff's account at a California cryptocurrency exchange and stole approximately 500 Bitcoins. Compl. ¶¶ 16-18, 20. At the time, the digital currency was valued at $2.3 million. Compl. ¶ 19. Plaintiff promptly hired investigative firm Kroll to locate the stolen cryptocurrency. Compl. ¶ 21. Kroll traced it to addresses owned by custodial cryptocurrency firms Indodax and "Xapo." Comp. ¶¶ 22-25, 34. An investigation by Kroll also concluded that Indodax and "Xapo" employ inadequate policies and procedures to prevent use of their services for malicious activity. See Compl. ¶¶ 33-44.

B. Procedural History

On June 1, 2020, Plaintiff filed the Complaint against Defendants. See generally Compl. Plaintiff is a German resident. Compl. ¶ 1. Defendant Xapo, Inc. is a Delaware corporation with its principal place of business in California. Compl. ¶ 2. Defendants Xapo (Gibraltar) Limited and Indodax are foreign corporations. Compl. ¶¶ 3, 5. And the ten John Doe defendants are a collection of unidentified hackers. Compl. ¶ 6. On July 29, 2020, Defendant filed this Motion. See generally Mot. Plaintiff filed his Opposition on August 12, 2020. See generally Opp'n to Mot. to Dismiss ("Opp."), ECF 26. On August 19, 2020, Defendant filed its Reply. Reply in Supp. of Mot. to Dismiss ("Reply"), ECF 28. This Court held a hearing on November 12, 2020. Mot. Hr'g.

II. LEGAL STANDARD

A. Federal Rule of Civil Procedure 12(b)(6): Failure to State a Claim

"A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted 'tests the legal sufficiency of a claim.'" Conservation Force v. Salazar, 646 F.3d 1240, 1241-42 (9th Cir. 2011) (quoting Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001)). When considering such a motion, the Court "accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party." Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). While a complaint typically need not contain detailed factual allegations, it "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible when it "allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. "Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Id.

B. Federal Rule of Civil Procedure 15(a): Leave to Amend

Under Federal Rule of Civil Procedure 15(a), the Court should freely grant leave to amend "when justice so requires," keeping in mind Rule 15's underlying purpose "to facilitate decision on the merits, rather than on the pleadings or technicalities." Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and alterations omitted). When dismissing a complaint for failure to state a claim, "a district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts." Id. at 1130 (internal quotation marks omitted).

III. DISCUSSION

Defendant raises numerous arguments in favor of dismissing the Complaint. These mostly center on Plaintiff's failure to plead sufficient facts showing actionable conduct, knowledge, or loss. See generally Mot. For the reasons discussed below, this Court largely agrees.

A. Notice Requirements of Rule 8(a)(2)

"[A] complaint which lumps together multiple defendants in one broad allegation fails to satisfy the notice requirement of Rule 8(a)(2)." Adobe Sys. Inc. v. Blue Source Grp., Inc., 125 F. Supp. 3d 945, 964 (N.D. Cal. 2015) (internal quotation marks and alterations omitted). Here, the Complaint lumps together defendants Xapo, Inc. and Xapo (Gibraltar) Limited, alleging conduct by "Xapo" without distinguishing what each entity did. Compl. ¶¶ 2-4. Xapo, Inc. and Xapo (Gibraltar) Limited are distinct corporations, the first domestic and the latter foreign. Compl. ¶¶ 2-3; Mot. 14-15; Reply 15. In an amended pleading, Plaintiff must identify exactly what action each took that caused his harm, without resorting to generalized allegations against "Xapo" (or "Defendants") as a whole.¹ See In re Nexus 6P Prod. Liab. Litig., 293 F. Supp. 3d 888, 907-08 (N.D. Cal. 2018) (requiring the plaintiff to distinguish each defendant's conduct).

B. California Penal Code § 496

In Count I, Plaintiff alleges violation of California Penal Code § 496 for possession of stolen property. Comp. ¶¶ 45-53. The elements are "(1) that the property has been stolen; (2) thatthe accused received, concealed or withheld it from its owner; and (3) that the accused knew the property was stolen." People v. Stuart, 272 Cal. App. 2d 653, 656 (1969). The third element, "requires actual knowledge of or belief that the property is stolen." U.S. v. Flores, 901 F.3d 1150, 1161 (9th Cir. 2018) (citing People v. Tessman, 223 Cal. App. 4th 1293, 1302 (2014)).

Here, Plaintiff suggests that Defendant's knowledge can be inferred from its allegedly inadequate "Know Your Customer" ("KYC") and "Anti-Money-Laundering" ("AML") policies and procedures, claiming that, had Defendant followed reasonable compliance standards, it "knew or should have known" of the stolen property. Comp. ¶¶ 40-41, 51. Plaintiff argues that the extent of the inadequacy amounts to "willful blindness." Opp. 8-9; see also People v. Scaggs, 153 Cal. App. 2d 339, 352 (1957) ("[T]he requisite guilty knowledge can be inferred from circumstantial evidence."). But the Complaint fails to show how Defendant's KYC and AML policies and procedures amounted to the type of willful blindness contemplated by § 496, as opposed to mere negligence. See Freeney v. Bank of Am. Corp., No. CV 15-2376-JGB-PJWx, 2016 WL 5897773, at *11-12 (C.D. Cal. Aug. 4, 2016) (holding that the plaintiff failed to plead the bank's actual knowledge of converted funds despite being aware of several red flags).

Plaintiff further argues that even if Defendant was originally unaware of the theft, it became aware upon receiving notice of the Complaint. Opp. 9; see also Scaggs, 153 Cal. App. 2d at 352 (explaining that "even though a person is not aware that property is stolen when he first comes into possession of it, if he subsequently learns of its stolen nature and then conceals or withholds it from its true owner, he is guilty of a violation of [§] 496"). But filing a complaint itself is insufficient to prove actual knowledge under § 496. See Kidron v. Movie Acquisition Corp., 40 Cal. App. 4th 1571, 1586 (1995) (finding that service of the complaint gave the defendant notice of a claim for fraud, not actual knowledge of the fraud itself).

In sum, Plaintiff fails to plead sufficient facts demonstrating Defendant's knowledge that it came into possession of stolen funds. Thus, Defendant's Motion as to Count I is GRANTED WITH LEAVE TO AMEND.

C. The Computer Fraud and Abuse Act ("CFAA")

In Count II, Plaintiff alleges aiding and abetting under 18 U.S.C. § 1030(a)(4) of theCFAA. Compl. ¶¶ 54-61. To succeed, Plaintiff must show that Defendant "(1) accessed a protected computer, (2) without authorization or exceeding such authorization that was granted, (3) knowingly and with intent to defraud, and thereby (4) furthered the intended fraud and obtained anything of value." U.S. v. Nosal, 930 F. Supp. 2d 1051, 1058 (N.D. Cal. 2013) (citing LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009)) (internal quotation marks and alterations omitted). Plaintiff's Complaint fails to state a claim for the reasons below.

1. Failure to Plead Facts with Specificity Under Rule 9(b)

Under Federal Rule of Civil Procedure 9(b), a party must, in alleging fraud or mistake, "state with particularity the circumstances constituting fraud or mistake." For CFAA claims, "Rule 9(b) plainly applies to § 1030(a)(4)'s requirement that the defendant's acts further the intended fraud." Oracle Am., Inc. v. Serv. Key, LLC, No. C 12-00790 SBA, 2012 WL 6019580, at *6 (N.D. Cal. Dec. 3, 2012). Here, Plaintiff alleges that Defendant assisted the unidentified hackers by providing them "safe havens" in its custodial vaults to hide the stolen Bitcoins and that Defendant "knew or should have known the property was so stolen or obtained." Compl. ¶¶ 59-60. To support these allegations, Plaintiff provides conclusory statements that investigative firm Kroll found Defendant's KYC and AML policies and procedures to be inadequate. S...