## Facts

- Uphold HQ Inc. (Uphold) operated a cryptocurrency-exchange platform that maintained customer accounts and allowed users to transfer, purchase, trade, hold, and sell cryptocurrencies.
- To open and access an Uphold account, users were required to set up two-factor authentication (2FA), intended to add security beyond a username and password by requiring verification tied to a registered device.
- A putative nationwide class of current and former Uphold customers alleged Uphold’s 2FA was implemented in a way that let an unauthorized actor reassign a user’s 2FA device using only the user’s email address and password, without verification through the originally registered device.
- The customers alleged this design allowed attackers to access customer accounts and make unauthorized transfers that drained customers’ cryptocurrency holdings.
- The customers also alleged that Uphold and its former CEO, J.P. Thierot, made misleading statements about the platform’s security protocols and responsiveness to security problems.
- The customers brought federal and state causes of action, including a claim under the Electronic Fund Transfer Act (EFTA), 15 U.S.C. § 1693 et seq., and various New York statutory and common-law claims.
- Uphold moved to dismiss the first amended complaint under Federal Rule of Civil Procedure 12(b)(6), arguing (among other things) that EFTA applies only to transfers of “funds” and that cryptocurrency is not “funds.”

## Issues

1. Whether cryptocurrencies transferred from customer accounts can qualify as “funds” and “electronic fund transfers” under the EFTA at the pleading stage.
2. Whether Uphold plausibly qualified as a covered “financial institution” under the EFTA based on its role maintaining customer accounts used to make such transfers.
3. Whether the customers plausibly stated New York and common-law claims (including GBL § 349, contract, warranty, negligence/gross negligence, unjust enrichment, and negligent misrepresentation) based on the alleged 2FA flaw and alleged security-related statements.

## Decision

- Motion to dismiss the EFTA claim: denied.
- Motion to dismiss all other claims (including GBL § 349, breach of contract, breach of express and implied warranty, negligence, gross negligence, unjust enrichment, and negligent misrepresentation): granted.

## Legal Principles

- “Funds” in the EFTA is interpreted using its ordinary meaning; at the pleading stage, cryptocurrency can qualify as “funds” for purposes of an EFTA unauthorized-transfer claim.
- A platform that maintains consumer accounts and enables electronic transfers from those accounts can qualify as a “financial institution” under the EFTA when it holds the accounts from which the challenged transfers are made.
- On a Rule 12(b)(6) motion, a plaintiff states an EFTA claim by plausibly alleging (among other elements) unauthorized electronic transfers from the plaintiff’s account and a statutory violation tied to the institution’s duties regarding unauthorized transfers and error resolution.
- Under New York law, breach of contract requires identification of a specific enforceable contractual promise and facts showing breach; generalized security marketing or aspirational statements typically do not suffice as contractual commitments.
- Warranty theories generally require a cognizable warranty tied to the transaction; allegations aimed at the quality of services or generalized security assurances may not fit express or implied warranty requirements.
- Negligence and gross negligence claims fail where the claimed duty is not independent of the parties’ contractual relationship or is otherwise duplicative of contract-based allegations seeking recovery for economic loss.
- Negligent misrepresentation requires a special or privity-like relationship and sufficiently concrete, actionable misstatements; ordinary customer–service-provider relationships and generalized statements about security are usually not enough.
- Unjust enrichment is not available where the parties’ relationship is governed by contract and the quasi-contract theory duplicates contract-based allegations.
- A New York GBL § 349 claim requires materially misleading consumer-oriented conduct and injury caused by the deception; conclusory allegations of deception or causation are insufficient.

## Conclusion

The court held that plaintiffs plausibly alleged an EFTA claim based on unauthorized cryptocurrency transfers because cryptocurrency can constitute “funds” and Uphold could qualify as a covered “financial institution,” but it dismissed every non-EFTA claim, leaving the case to proceed only on the federal statutory theory.


Rider v. Uphold HQ Inc., 657 F. Supp. 3d 491 (2023)