High Court Upholds Arbitral Security Deposit Order Against Zanmai Labs in WazirX Cyber-Attack Dispute

The Bombay High Court has delivered a significant ruling concerning the obligations of virtual digital asset platforms following a security breach, upholding a decision by an Arbitral Tribunal that mandates Zanmai Labs Private Limited (the parent company behind the WazirX platform) to provide security deposits for affected users. Justice Somasekhar Sundaresan, presiding over the matter, dismissed appeals filed under Section 37 of the Arbitration and Conciliation Act, 1996, effectively barring the platform from unilaterally diluting user claims through a "socialization of losses" scheme.

The Backdrop: A Platform Under Fire

The dispute originated after a major cyber-attack on July 18, 2024, which compromised multi-signature wallets on the WazirX platform, leading to the theft of ERC-20 tokens valued at approximately USD 235 million. Following the incident, Zanmai Labs invoked force majeure clauses to restrict withdrawals, effectively freezing user assets. Zanmai attempted to address these losses by proposing a scheme of arrangement mediated by its Singapore-based parent company, Zettai Pte Ltd., which aimed to distribute the impact of the theft across all users of the platform—a process labeled as the "socialization of losses."

Bitcipher Labs LLP and Nextgendev Solutions Pvt. Ltd., as professional brokers operating on the platform, challenged these restrictions, arguing that their contractual agreements with Zanmai explicitly mandated security measures that superseded general force majeure excuses.

The Contentions: Privilege and Responsibility

Zanmai Labs argued that the custodial responsibility for the compromised assets lay outside its purview, citing a complex tripartite arrangement involving the global exchange Binance. They maintained that upon Binance’s disassociation from the platform, operational control transitioned through layers of liability that did not place the burden of such large-scale hacks solely on Zanmai.

Conversely, the respondents successfully argued that the Broker Agreement executed between them and Zanmai expressly defined "WazirX" as synonymous with Zanmai Labs. They contended that Zanmai had undertaken a specific duty of care that could not be washed away by the unilateral invocation of corporate restructuring or offshore schemes of arrangement.

Legal Analysis: The Limits of Contractual Obligation

Justice Sundaresan’s analysis pierced the veil of Zanmai’s defense, noting that while rights flowing from a contract may be transferable, substantive obligations require consent. The Court found it implausible that Zanmai could effectively "subcontract" its fiduciary duties to an unnamed or external entity without the agreement of the users.

Critically, the Court observed that the "socialization" proposal lacked a foundation in existing contractual law between the parties. The judgment reaffirmed the principle from Wander Ltd. v. Antox India (P) Ltd. , noting that the appellate court should not interfere with the discretion of the trial court (in this case, the Arbitral Tribunal) unless the decision is perverse or ignores settled legal principles.

Key Observations

Justice Somasekhar Sundaresan offered several sharp takeaways on the nature of digital asset custody: * "To use those assets not belonging to Zanmai, and that too by Zettai, and to utilize them for covering losses attributable to other users is not something even on the face of it lends itself to a reasonable acceptance." * "If an asset is held in the custody of a person under an agreement, it is for the person in whose custody those assets are, held to be accountable for the custody of those assets." * "It is well settled law that an appeal is to be regarded as a continuation of the original proceeding... the appellate court will not interfere with the exercise of discretion... except where the discretion has been shown to have been exercised arbitrarily."

The Verdict and Future Implications

Dismissing the petitions, the High Court held that the Arbitral Tribunal’s interim order for security was a balanced, preservative measure. The Court emphasized that Zanmai must ensure the security of user assets, noting: "All that Zanmai has to do is regain control over the assets of its users and provide assurance that they are secure."

This ruling serves as a cautionary tale for digital asset service providers: the mere presence of a force majeure clause does not grant a platform absolute immunity, especially when it has entered into specific, binding brokerage agreements that promise "best efforts" in maintaining uninterrupted performance. As the industry matures, this decision underscores that platform operators are held to a fiduciary standard regarding client assets, regardless of the complexity of their corporate structures.