US regulator proposes making crypto wallets liable for hack-related losses

The US Consumer Financial Protection Bureau (CFPB) has proposed a rule to make wallet providers responsible for hacks resulting in crypto asset loss. In a notice published on January 10, the regulator suggested that the US Electronic Fund Transfer Act could also apply to digital currencies. 

According to the agency, the rule will allow crypto wallets and accounts created for personal, family, or household use to enjoy the same protections as a regular bank account. Under the EFTA, consumers enjoy protection against error and fraud due to electronic fund transfers (EFTs).

It said:

“EFTA provides a considerable set of rights to consumers to dispute errors and limit their liability for unauthorized EFTs, among other things.”

The regulator believes the protections should apply equally to virtual currency wallets for holding and transferring stablecoins or fungible tokens. This would make such wallets consumer accounts and bring them under CFPB regulations.

The proposed rule reads:

“Based on the plain language used in EFTA and the reasoning of judicial decisions, as well as the CFPB’s experience in market monitoring, it has long been clear that the term’ funds’ in EFTA is not limited to fiat currency like US dollars. The CFPB interprets the term ‘funds’ as assets that act or are used like money…”

However, the regulator has asked for comments from the public, noting that comments will be open to the public until March 31. Although it accepts comments via mail, CFPB has advised that users opt for the electronic method, either through email or the Federal eRulemaking portal, as this would be faster.

Industry stakeholders kick against the proposed rule

Meanwhile, the proposed rule has attracted negative reactions from the crypto stakeholders. Despite the rising incidents of crypto hacks, with losses in 2024 exceeding that of 2023, according to several blockchain security firms, including Peckshield, Scam Sniffer, and Certik, many believe this rule will not fix the problem.

Consensys lawyer Bill Hughes believes the rule burdens wallet providers unnecessarily, even for consumers’ negligence. He noted that wallet providers would become liable for any unauthorized transfer, including when someone gains control of a user’s device through fraud, robbery, hacking, and cyber theft. The firm is the maker of MetaMask, the most popular crypto wallet.

He said:

“Hacked because you tweeted you emailed your seed phrase or believed that fashion model in Malaysia needed 5000 bucks to fly to see you?  Don’t worry your wallet might have to cover it . . .”

In his opinion, this is another example of a regulatory agency choosing to legislate through administrative rulemaking, which he describes as “law by decree.” Hughes added that US regulators will keep trying to take control of crypto until someone stops their efforts, and he believes that person would be Donald Trump when he is sworn in.

Hughes is not alone on this stance. One user observed that it could become an infinite money glitch, with malicious users even using it to enrich themselves. Paradigm chief legal officer Katie Biber also questioned the CFPB’s logic and how impractical it would be for noncustodial wallets. She added that this is merely an attempt by the CFPB to regulate anything that touches the dollar.

She wrote:

“Let’s say I choose to carry cash instead of holding $ with a bank. If I drop my wallet, CFPB thinks the manufacturer is responsible. Which means they stop selling wallets.”

Meanwhile, many see it as further proof of Joe Biden’s administration’s anti-crypto position and validates why Kamala Harris did not get elected. Interestingly, the CFPB is one of the federal agencies that Elon Musk’s Department of Government Efficiency (DOGE) is considering axing.

From Zero to Web3 Pro: Your 90-Day Career Launch Plan