A court of appeal in Germany has ruled that using a known wallet password to transfer cryptocurrencies without permission may not constitute a criminal offense.
This decision is causing sharp criticism from the legal and cryptocurrency communities, who warn that it exposes a dangerous loophole in current regulations.
Legal gap in Germany allows crypto thieves to act freely
A man helped another person (the complainant) set up a cryptocurrency wallet to hold tokens worth 2.5 million euros.
The thief created the wallet and retained the 24-word recovery phrase. Unfortunately, the victim never changed that recovery phrase.
Subsequently, without permission, he used the exact recovery phrase to transfer and potentially steal all the coins. The defendant was not authorized to move the coins and made false statements.
The Braunschweig Higher Regional Court concluded that the defendant did not "hack" the wallet, as he used a password he had legally set up and retained.
Therefore, this action did not meet the requirement of "overcoming special access security" as defined in Germany's Criminal Code.
Moreover, the court ruled that no deception was involved, dismissing computer fraud allegations.
The blockchain system, according to the court, does not evaluate the user's intent or permission. It only confirms the presence of a valid cryptographic signature. The court also rejected data forgery accusations.
This means that as long as someone has a valid password or recovery phrase—regardless of how they obtained it—transferring assets may not be considered a crime, at least under current German law.
This ruling effectively removes criminal liability for actions that would otherwise be considered theft in traditional finance. It highlights the difficulty of the legal system in adapting to the technical structure of decentralized assets.
The court noted that although this behavior may violate civil obligations, contract breaches, or break trust, these are not automatically considered criminal offenses.
However, the ruling does not suggest that all cryptocurrency theft is legal. If login credentials were obtained through fraud or hacking, other charges could be applied. But this case specifically focuses on non-technical access using previously known login information.
Currently, this ruling exposes a gray area that German legislators have yet to address.
