## Facts

- Nineteen users of the bZx Protocol brought a putative class action after a November 2021 hack allegedly stole about $55 million in cryptocurrency, including roughly $1.7 million from the named plaintiffs.
- The bZx Protocol provided cryptocurrency margin trading and lending products.
- The protocol was initially controlled by bZeroX LLC and Leveragebox LLC, co-founded by Tom Bean and Kyle Kistner, and control was later transferred (August 2021) to bZx DAO, a tokenholder-governed organization.
- Plaintiffs alleged BZRX tokenholders held governance rights (e.g., proposing and voting on treasury spending and policy changes) and shared in profits, while the DAO lacked traditional entity formalities.
- Plaintiffs alleged the hack resulted from a phishing attack on a DAO developer, which exposed key passphrases and enabled theft, and that defendants failed to implement reasonably necessary security measures despite foreseeable risk.
- Plaintiffs asserted a single negligence claim, seeking to impose joint and several liability on certain tokenholders and related entities on the theory that the DAO functioned as a California general partnership.
- Defendants included (i) Leveragebox-related defendants (Kistner, Bean, bZeroX LLC, Leveragebox LLC), (ii) Hashed-related defendants (Hashed International LLC, AGE Crypto GP, LLC), and (iii) bZx DAO and alleged successor Ooki DAO.

## Issues

1. Whether the complaint plausibly stated a negligence claim based on alleged failure to maintain reasonable protocol security.
2. Whether the alleged facts plausibly supported treating the DAO as a California general partnership, exposing qualifying tokenholders to joint and several liability for torts.
3. Whether the complaint sufficiently alleged partner status (token ownership/governance participation) for each moving defendant.
4. Whether the court had personal jurisdiction over Tom Bean.
5. Whether to strike class allegations at the pleading stage based on alleged conflicts arising from tokenholder-plaintiffs suing tokenholder-defendants.
6. Whether the Hashed defendants were properly served and whether subject-matter jurisdiction existed.

## Decision

- The court granted in part and denied in part the Leveragebox defendants’ motion to dismiss.
- The court dismissed the claims against Tom Bean, bZeroX LLC, and Leveragebox LLC without prejudice.
- The court denied the Hashed defendants’ motion to dismiss.
- The court allowed the negligence claim to proceed against remaining defendants, including Kistner, Hashed International LLC, AGE Crypto GP, LLC, and the DAO defendants.
- The court denied the motion to strike the class allegations at the pleading stage.
- Plaintiffs were given leave to amend.

## Legal Principles

- A California general partnership may be inferred from conduct where persons carry on as co-owners a business for profit; the absence of traditional entity formalities does not preclude partnership treatment.
- At the pleading stage, allegations that tokenholders exercise meaningful governance rights and share in profits can plausibly support partnership characterization and potential joint and several liability for partnership torts.
- Negligence is plausibly pleaded where plaintiffs allege a duty of reasonable care in safeguarding user assets, foreseeable risk (including common phishing threats), breach through inadequate safeguards, and resulting loss; factual disputes over contract assent and scope are generally not resolved on a Rule 12(b)(6) record.
- Partner status and the extent of a particular tokenholder’s participation are fact questions that may require development beyond the pleadings.
- Personal jurisdiction requires sufficiently alleged forum-related contacts connected to the claims; conclusory or non-specific allegations can support dismissal without prejudice.
- Challenges to adequacy of class representation based on potential conflicts are ordinarily addressed at class certification rather than by striking class allegations at the pleading stage.

## Conclusion

The court permitted a negligence claim arising from a DeFi protocol hack to proceed and held it plausible that a tokenholder-governed DAO could be treated as a California general partnership, potentially subjecting qualifying tokenholders to joint and several tort liability, while dismissing certain defendants without prejudice and leaving class-representation disputes for later proceedings.


Sarcuni v. bZx DAO, 664 F. Supp. 3d 1100 (S.D. Cal. 2023)