Sebastian Sinclair

<div id="highlights-block_633bf8e68f5a4" class="highlights">
 <ul>
 <li>The DAO is embroiled with the CFTC for allegedly operating a crypto derivatives platform outside of the law</li>
 <li>Ooki DAO is the successor to bZeroX, which has already settled similar charges with the CFTC</li>
 </ul>
 
</div>



Decentralized autonomous organization Ooki has been dealt another legal blow: A court has ruled the Commodities and Futures Trading Commission (CFTC) effectively served a summons via its online help chat box.



Ooki is a blockchain-powered protocol for borrowing, lending, margin trading and staking. It enables DeFi apps to service traders keen on making leveraged bets, both long and short, across crypto markets.&nbsp;



It is the successor to bZeroX, which the CFTC <a href="https://www.cftc.gov/PressRoom/PressReleases/8590-22" target="_blank" rel="noreferrer noopener">simultaneously</a> filed and settled charges with on Sept. 23 in its first ever case against a DAO.



At the same time, the CFTC levied analogous allegations against Ooki, labeling it liable as an &#8220;unincorporated association.&#8221;



The CFTC found bZeroX had facilitated margined and leveraged retail commodity transactions outside the law between July 2019 and August 2021. Its founders were forced to pay $250,000 for their involvement.



Now, the CFTC is after Ooki. The agency served the <a href="https://cms.blockworks.co/cftc-pursues-first-case-against-a-dao/" target="_blank" rel="noreferrer noopener">revamped</a> protocol late last month, alleging it had been operating for years without registering as a futures commission merchant, but questions had remained over whether the CFTC had sufficiently served its charges.



Ooki’s chat box, like other online assistants, provides automated responses to questions or queries potential customers may have relating to the organization. The CFTC lodged its filings through that portal.



The US Northern District Court of California ruled the CFTC was justified in serving a copy of its court summons and complaint to Ooki in this way, opening up potential ramifications for similar cases in the future.



It’s also unclear exactly who is responsible: the protocol founders, the DAO or its voting members. Both the DAO and its members could be simultaneously held liable for operating the platform outside of what the CFTC deems the law. 



Etherscan <a href="https://etherscan.io/token/0x0De05F6447ab4D22c8827449EE4bA2D5C288379B" target="_blank" rel="noreferrer noopener">shows</a> around 1,200 addresses hold Ooki’s native token, which currently trades 92% below its all-time high recorded in December. The DAO itself counts 103 members, according to <a href="https://snapshot.org/#/ooki.eth" target="_blank" rel="noreferrer noopener">snapshot.org</a>.



Members of Ooki DAO were also alerted to the CFTC’s summons and complaint through an online forum designated for governance discussions on Sept. 28.



Ooki now has until Oct. 13 to respond to the <a href="https://storage.courtlistener.com/recap/gov.uscourts.cand.400807/gov.uscourts.cand.400807.17.0.pdf" target="_blank" rel="noreferrer noopener">allegations</a>, otherwise the CFTC could face default judgment, CoinDesk reported.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

CFTC Legally Served Ooki DAO via Website Help Bot, Court Rules

Ben Strack

<div id="highlights-block_62718b1e323d8" class="highlights">
 <ul>
 <li>An estimated $55 million of crypto was stolen after a bZx developer had his wallet’s private keys taken in a November phishing attack</li>
 <li>The 14 plaintiffs’ combined losses from the hack total $1.6 million</li>
 </ul>
 
</div>



The victims of a hack of DeFi platform bZx are vying for the return of their funds in a rare attempt to hold a DAO liable in court.



The lawsuit, filed in the Southern District of California Monday, names 14 plaintiffs who claim to have lost funds ranging from $800 to $450,000. Together, the complaint indicates, the plaintiffs lost roughly $1.6 million from the November hack, during which an estimated $55 million of crypto was stolen.&nbsp;



Plaintiffs allege the theft was possible only because the protocol had not yet implemented security measures that its operators knew were reasonably necessary to protect funds.



A spokesperson for bZx did not immediately return a request for comment.&nbsp;



Law firm Gerstein Harrow LLP, whose attorneys have developed a <a href="https://gerstein-harrow.com/crypto" target="_blank" rel="noreferrer noopener">crypto consumer protection practice</a>, represents the plaintiffs. <a href="https://static1.squarespace.com/static/5fe1506a0d430c49279a41de/t/61f06d5e360a0d0ee16ae85a/1643146598737/Kent+Complaint" target="_blank" rel="noreferrer noopener">Its first case</a>, which alleges that a DeFi (decentralized finance) operator called PoolTogether is operating an illegal lottery in New York, also deals with the issue of who can be held liable for the violations of DAOs.



DAOs (decentralized autonomous organizations) are member-owned communities without centralized leadership. The term DAO went mainstream last year when a group of crypto natives — dubbed ConstitutionDAO — raised $49 million in <a href="https://cms.blockworks.co/the-constitutiondao-raises-49m-to-buy-a-copy-of-the-us-constitution/" target="_blank" rel="noreferrer noopener">an unsuccessful bid</a> to buy a copy of the US Constitution. Hedge fund billionaire Ken Griffin won the auction.&nbsp;



“Those who form DAOs apparently believe that they can use the word ‘decentralized’ to evade corporate and individual responsibility,” Gerstein Harrow LLP Partner Jason Harrow said in a statement. “The opposite is true: without the protection of a corporation or limited liability company, everyone involved in a DAO’s governance is liable for the protocol’s negligence and illegality.”



Defendants include bZx protocol co-founders Kyle Kistner and Tom Bean, bZx investors Hashed International and AGE Crypto, and bZeroX, which created the protocol and controlled it until August 2021, according to the complaint. It also names bZx DAO, Ookie DAO and LeverageBox, a company that operated the Fulcrum trading platform, as defendants.&nbsp;&nbsp;



The complaint argues that because the bZx protocol purports to be a DAO that lacks any legal formalities or recognition, it can be considered a “general partnership.”



“That means each of the partners is jointly and severally liable to the plaintiffs and must make good on the full amount of its debts,” the document states.



<h3 class="wp-block-heading">Compensation plan ‘inadequate,’ plaintiffs argue</h3>



A bZx developer had his personal wallet’s private keys taken in the phishing attack, which granted the hacker access to the private keys to the Binance Smart Chain and Polygon deployment of bZx protocol, according to <a href="https://bzx.network/blog/prelminary-post-mortem" target="_blank" rel="noreferrer noopener">a November blog post</a>.



The DeFi protocol said at the time the attack was likely executed by Lazarus Group, which is known to be a state-sponsored <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">hacking organization</a> with links to North Korea. The hacker converted a large amount of stolen assets into ether and transmitted the funds through <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>, according to bZx.



In addition to stating on its website in December that it was preparing to launch the bZx deployments on Binance Smart Chain and Polygon with enhanced security measures, the bZx DAO shared details of <a href="https://bzx.network/blog/bzx-compensation-plan" target="_blank" rel="noreferrer noopener">its compensation plan</a> for victims.



​​The bZx DAO committed to fully compensating those who lost BZRX in the attack with that asset, amounting to about $20 million of BZRX. It agreed to pay back victims who lost money via other tokens over time by buying back debt tokens each month using 30% of protocol revenue and fees.



But the complaint calls the plan “woefully inadequate,” adding “at the current buyback rate, full repayment will take thousands of years.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.