Homeowners Insurance Does Not Cover Cryptocurrency Theft, 4th Circuit Affirms

A federal appeals court has affirmed that a homeowners insurance policy does not cover the theft of cryptocurrency because the loss of a digital currency does not involve a “direct physical loss” as required by the policy.

The Fourth Circuit Court of Appeals held that a physical impact to covered property is required for a “direct physical loss” to have occurred and no such physical impact to cryptocurrency is possible because it exists wholly virtually.

The three justice panel of the appeals court in Richmond upheld a February 2023 ruling by the federal district court for Eastern Virginia in a win for the insurer Lemonade Insurance.

Ali Sedaghatpour owned substantial amounts of various cryptocurrencies that he stored on a hot wallet server known as APYHarvest, which is physically located in Ireland and England. APYHarvest’s hot wallet, like other hot wallets, was always accessible to him via the internet. On December 31, 2021, he discovered that all of his cryptocurrency stored in the APYHarvest hot wallet—worth $170,424.67 at that time—had been stolen.

On January 3, 2022, Sedaghatpour made a claim under his Lemonade homeowner’s insurance policy for the policy’s limit of $160,000. Lemonade denied the claim on the ground that the policy protects plaintiff’s “stuff,” or property, only when that property is “damaged directly” by one of the “specific losses” contemplated in the policy including theft.

Lemonade further reasoned that, even if the loss were covered by the policy, the policy’s limitation of $500 for loss “resulting from theft or unauthorized use of an electronic fund transfer card or access device used for deposit” limited coverage for the loss of cryptocurrency to $500. Accordingly, Lemonade paid Sedaghatpour $500 to cover the lost cryptocurrency.

Sedaghatpour brought suit against Lemonade. In May 2022, the district court dismissed the original complaint without prejudice, giving Sedaghatpour an opportunity to amend his complaint to identify the types of cryptocurrencies allegedly stolen, when and how the cryptocurrencies were stolen, and the place from which they were stolen. Sedaghatpour filed his amended complaint in May 2022, which Lemonade asked the court to dismiss.

The amended complaint identified the 11 specific cryptocurrencies that Sedaghatpour said were stolen after he transferred them from his laptop or smartphone while sitting at home to the APYHarvest hot wallet. The amended complaint alleged that APYHarvest was itself the thief that stole his cryptocurrency, first by moving it to a company in the Cayman Islands—Binance.com—and thereafter by selling the cryptocurrency to an unidentified third party. According to the Sedaghatpour, Binance.com informed him that his cryptocurrency had been sold. He claims his loss totaled more than $170,000.

In moving for dismissal, Lemonade again argued that the policy does not cover loss of cryptocurrency or, in the alternative, that the policy limits coverage for loss of cryptocurrency to $500, an amount that it had already paid out.

In opposition to the dismissal, Sedaghatpour argued that the policy insures against loss of cryptocurrency and that no provision in the policy limits coverage for loss of cryptocurrency to $500.

The principal issue for the district court was whether theft of cryptocurrency is a “direct physical loss” within the policy’s coverage. The justices found that various dictionaries and governmental agencies define cryptocurrency as existing wholly virtually or digitally and the Internal Revenue Service defines cryptocurrency as “a type of virtual currency that uses cryptography to secure transactions that are digitally recorded on a distributed ledger, such as a blockchain.” Thus, the district court stated: “[I]t is clear that cryptocurrency, by its nature, exists only virtually or digitally and has no physical or tangible existence. It follows, therefore, that the policy does not cover loss or theft of cryptocurrency because the loss or theft does not constitute a ‘direct physical loss’ to plaintiff’s property.”

The district court noted that its result is consistent with a Fourth Circuit case in 2003 involving Hartford Insurance that applied Virginia law in the computer context, albeit not in the cryptocurrency context. In this case, the Fourth Circuit concluded the plaintiff suffered a “direct physical loss” because a hacker’s deletion of files on the plaintiff’s own computers caused damage to the plaintiff’s property. In Hartford, had the deletion of files not damaged the computer system, there would not have been a physical loss. Also, deletion of files stored on a non-insured’s computer systems would not have been a “direct physical loss” to the plaintiff’s property. In the Lemonade case, the deletion of files did not occur on the plaintiff’s own computer and there were no facts demonstrating that Sedaghatpour suffered a “direct physical loss” when his wholly-virtual cryptocurrency was stolen, a requisite condition of recovering under the insurance policy.

The Fourth Circuit’s decision in Hartford, although not directly applicable to the cryptocurrency context, “persuasively suggests” that the theft of his cryptocurrency did not involve a “direct physical loss” as required by the policy, the district court added.

After the district court sided with Lemonade, Sedaghatpour appealed that dismissal. The Fourth Circuit panel last week upheld the district court and dispensed with oral argument because further “argument would not aid the decisional process.”