A look at Indexed Finance's legal fight with a Canadian teenager who exploited the DeFi platform for $16M, which is raising several tricky legal questions
On Oct. 14, in a house near Leeds, England, Laurence Day was sitting down to a dinner of fish and chips on his couch when his phone buzzed.
BloombergChristopher Beam
Context & Ripple Effects
Indexed Finance's pursuit of Laurence Day through the courts lands in the middle of a 2022 wave of crypto litigation: days before this piece, YC-backed Stablegains faced a lawsuit after losing $44M of users' funds it had parked in UST while claiming USDC exposure. The common thread is that when code fails or gets exploited, the injured parties are bypassing on-chain resolution and going to traditional courts.
The case matters because an exploit sits in legal gray space — is it theft, a tort, or just the protocol working as written? That question was still unresolved when Celsius's own court filing over $439M owed by a private lending platform showed even the largest crypto creditors relying on conventional bankruptcy machinery.
First-order effects
Laurence Day now faces civil litigation and potential asset recovery claims over the $16M exploit, meaning a pseudonymous on-chain actor has been identified and pulled into a national legal system.
Indexed Finance and its token holders are betting that courts, not code or community pressure, are the viable path to recovering exploited funds — a reversal of early DeFi's 'code is law' posture.
Second-order effects
Other exploited DeFi protocols gain a template: if Indexed Finance's suit advances, victims of similar attacks have a precedent for suing identifiable exploiters across borders, as the England-based Day versus Canadian-resident dispute already spans jurisdictions.
The litigation risk cuts both ways for platforms — Stablegains' user lawsuit shows depositors will also sue platforms themselves, so DeFi startups face courtroom exposure from both attackers and customers.
Third-order effects
If courts keep adjudicating exploits and platform failures, case law becomes de facto regulation for DeFi ahead of any formal rulebook, defining where 'protocol behavior' ends and actionable wrongdoing begins.
With Chainalysis's CEO warning that rapid DeFi growth leaves user assets exposed and DefiLlama counting $140B+ held on protocols, the volume of disputes heading into this legal gray zone only grows — making jurisdiction and enforceability against global, often anonymous actors the structural bottleneck.
The trend: Crypto disputes are migrating from on-chain and community resolution into traditional courts, with each case — exploit, platform loss, or creditor claim — writing the rulebook regulators haven't yet supplied.
This is weird, but expected, showing the crypto guys as entirely good guys, but they were stupid enough to get scammed by an elementary grift and shocked when the one who scammed them didn't want to give the “money” back. https://twitter.com/...
What happens when a teenage coder exploits a crypto platform for $16 million, gets caught, and then ... simply refuses to return it? New piece for @BW: https://www.bloomberg.com/...
Fascinating and timely look by @jcbeam at what happens in a DeFi crypto hack, from how it's done to how a platform responds to whether it's even straightforwardly illegal https://www.bloomberg.com/...
An 18-year-old exploited a weakness in Indexed Finance's code and opened a legal conundrum that's still rocking the blockchain community https://www.bloomberg.com/...
Absolutely incredible article from @jcbeam on the Indexed Finance hack. Fascinating to see how, six years after the DAO hack, so many of the issues around the concept “code is law” are unresolved 🤓 https://twitter.com/...
It is disturbingly hilarious how cryptocurrency is all about subverting mainstream institutions, except when there's a problem and those very same institutions and their arbitrary mechanisms are a very good thing. https://www.bloomberg.com/... https://twitter.com/...
6) An 18-year-old math prodigy launched a blockchain hack worth $16 million, then disappeared. Leaves behind so many legal questions in world of DeFi. There's also a cat named Finney who may have helped untangle the hack via moral support. https://www.bloomberg.com/...
Fascinating. All you need to know: “Adding to the uncertainty is the legal and regulatory gray area in which DeFi operates. Anyone with the technical know-how can create an investment vehicle, put it online, and expose users to possible exploits. ” https://twitter.com/...
This story's a lot of fun: hacker “defrauds” a DeFi index fund by executing a series of legal, but unanticipated, trades. Live by the smart contract, die by it? https://www.bloomberg.com/...
This civil case is REALLY interesting and highlights some of the substantial risk of smart contracts: exploiting a poorly written one looks a LOT like speculative trading. As my own lawyer would tell me: don't ever sign something you don't understand. https://www.bloomberg.com/..…
Many thanks to @jcbeam for his patience talking to us over the last couple of months, the Stockwoods LLP team for moving mountains with the legal side of things, and @d1ll0nk for looking better than me in a photo Not going to comment on the case itself, as it's ongoing