This section contains the nature of the case and procedural background.

D is a cryptocurrency exchange that enables users to transfer, purchase, trade, hold, and sell cryptocurrencies on its platform. D requires two-factor authentication (2FA) on all accounts that are set up. A 2FA transaction requires the use of an authentication server, which sends a unique code to the device the user has identified for 2FA (Device). The user must then confirm their identity from their Device. This second factor helps limit fraud because the authorized individual is supposed to be the person who has possession of the authentication Device. Ps had accounts with D, and their assets were stolen by unauthorized actors (crooks). Ps allege that D failed to implement 2FA correctly, which allowed unauthorized users to designate new Devices using only the customer's email address and password (and, importantly, without access to the account's original Device). D eventually fixed this issue on their systems. Ps allege that Ds misrepresented the scope of D's security protocols and responsiveness and that Ps have suffered loss of time handling the consequences of the data breach and emotional distress. Ps assert one federal cause of action and eight state law claims. The federal claim is brought under the Electronic Fund Transfer Act (EFTA). The state law claims are for negligence, gross negligence, negligence per se, and negligent misrepresentation as against both named defendants, and violation of New York General Business Law (GBL) § 349, breach of contract, breach of warranty, and unjust enrichment as against D. Ds moved to dismiss for failure to state a claim pursuant to Fed. R. Civ. P. 12(b)(6). D claims that the EFTA applies by its terms to transfers of 'funds' and cryptocurrency does not constitute funds.

The legal issues presented in this case will be displayed here.

The court's holding and decision will be displayed here.

Legal analysis from Dean's Law Dictionary will be displayed here.