A German appeals court has ruled that using known wallet passwords to transfer cryptocurrency without permission may not violate criminal law.
The decision is drawing sharp criticism from legal and crypto communities who warn it exposes a dangerous gap in existing statutes.
German Legal Loophole Allows Crypto Thief To Walk Free
A man helped someone (the complainant) set up a crypto wallet to hold €2.5 million worth of certain tokens.
The thief created the wallet and retained the 24-word recovery phrase. Unfortunately, the victim never changed that recovery phrase.
Sponsored
Later, without authorization, he used the correct recovery phrase to transfer and potentially steal all the coins. The defendant was not authorized to move the coins and gave false statements.
The Higher Regional Court of Braunschweig concluded that the defendant did not “hack” the wallet, since he used passwords he had legitimately set up and retained.
Therefore, the action did not satisfy the requirement of “overcoming a special access security” as defined under Germany’s Criminal Code.
Furthermore, the court ruled there was no deception involved, rejecting charges of computer fraud.
Blockchain systems, the court said, do not assess user intent or permission. It only affirms the presence of a valid cryptographic signature. The court also dismissed claims of data tampering.
This means that as long as someone has a valid password or recovery phrase—regardless of how they obtained it—transferring assets may not count as a crime, at least under current German law.
The ruling effectively removes criminal liability for actions that would otherwise be seen as theft in traditional finance. It highlights the legal system’s struggle to adapt to the technical structure of decentralized assets.
The court noted that while the conduct may violate civil obligations, contract breaches, or broken trust, do not automatically qualify as criminal offenses.
However, the ruling does not suggest that all crypto theft is legal. If credentials were obtained through fraud or hacking, different charges could apply. But this case centered specifically on non-technical access using pre-existing, known credentials.
For now, the judgment exposes a gray area that German lawmakers have yet to address.
source: https://beincrypto.com