2026-07-31 · Illicit Finance
A federal judge in San Francisco held that a decentralised autonomous organisation could be sued in its own name as an unincorporated association made up of its token holders, after the CFTC served it through the help chat box on its own website. The organisation never appeared, so the most consequential ruling on DAO liability in the United States rests on allegations a court deemed true by default.
Case file
| Field | Value |
|---|---|
| Matter | Commodity Futures Trading Commission v. Ooki DAO |
| Court | U.S. District Court, Northern District of California, San Francisco Division |
| Docket | 3:22-cv-05416-WHO |
| Judge | William H. Orrick |
| Complaint filed | 22 September 2022 (Dkt. 1) |
| Parallel settled action | In re bZeroX, LLC; Tom Bean; and Kyle Kistner, CFTC Docket No. 22-31, 22 September 2022 |
| Service order | Dkt. 63, 20 December 2022, reported at 2022 WL 17822445 |
| Default judgment | Order Dkt. 76 and Judgment Dkt. 77, both dated 8 June 2023 |
| Penalty, Ooki DAO | $643,542 civil monetary penalty (three violations at $214,514 each) |
| Penalty, bZeroX and founders | $250,000, joint and several, settled without admitting or denying |
| Charges | CEA §§ 4(a) and 4d(a)(1), 7 U.S.C. §§ 6(a) and 6d(a)(1); Regulation 42.2, 17 C.F.R. § 42.2 |
| Capacity holding | Unincorporated association under Cal. Corp. Code § 18035(a), via Fed. R. Civ. P. 17(b)(3) |
| Service holding | Cal. Code Civ. Proc. § 413.30 alternative service, satisfied by help chat box and forum post |
| Amici | LeXpunK, DeFi Education Fund, Paradigm Operations LP, Andreessen Horowitz (a16z) |
| Restitution or disgorgement | None awarded |
| Posture as of 31 July 2026 | Judgment entered 8 June 2023, defendant never appeared, ooki.com does not resolve in DNS |
| Agency | CFTC Division of Enforcement |
What the record shows
bZeroX, LLC operated blockchain software called the bZx Protocol from approximately 1 June 2019 to approximately 23 August 2021. The protocol ran on the Ethereum blockchain and let anyone with an Ethereum wallet post collateral to open leveraged positions whose value turned on the price difference between two digital assets. bZeroX marketed the software through a website, collected fees for access, and held Administrator Keys that allowed it to update the code, pause or suspend trading, and direct deposits of funds to users.
On approximately 23 August 2021, bZeroX transferred control of the protocol to the bZx DAO, which renamed itself Ooki DAO on approximately 18 December 2021. Control of the Administrator Keys passed to holders of the governance token. Token holder votes decided how those keys were used, usually after discussion on the organisation’s online community forum and a non-binding snapshot vote.
The complaint alleges that a key objective of the transfer was to render the DAO, by its decentralised nature, enforcement-proof. It quotes a founder telling community members before the handover that the plan was to take every step possible so that when regulators asked the business to comply, “we have nothing we can really do because we’ve given it all to the community.”
The two filings of 22 September 2022
The Commission acted on both sides of the transfer on the same day.
It filed a civil complaint in the Northern District of California against Ooki DAO, charging three violations: offering leveraged and margined retail commodity transactions off a designated contract market, contrary to CEA § 4(a); acting as an unregistered futures commission merchant, contrary to § 4d(a)(1); and failing to adopt a customer identification program as part of a Bank Secrecy Act compliance program, contrary to Regulation 42.2.
It also entered a settled administrative order against bZeroX, LLC and its founders Tom Bean and Kyle Kistner, CFTC Docket No. 22-31. Respondents settled without admitting or denying the findings and consented to a cease-and-desist order and a civil monetary penalty of $250,000, joint and several.
The settled order is where the member-liability theory appears. It records the Commission’s position that Ooki DAO meets the federal definition of an unincorporated association, that it is organised for profit, and that individual members of a for-profit unincorporated association are personally liable for its debts under partnership principles. It then states the boundary the Commission drew: once a token holder votes to affect the outcome of a governance vote, that person “has voluntarily participated in the group formed to promote the common objective of governing the Ooki Protocol” and on that basis is a member of the unincorporated association. On that footing the Commission found Bean and Kistner personally liable for the DAO’s violations.
Commissioner Summer K. Mersinger dissented. Her statement records that she supported the sanctions against bZeroX and the founders in their own right, and objected to the theory of member liability: “There is no provision in the CEA that holds members of a for-profit unincorporated association personally liable for violations of the CEA or CFTC rules committed by the association based solely on their status as members of that association.” She described the Commission’s approach as “regulation by enforcement, plain and simple.”
Service through the chat box
Five days after filing, the CFTC moved for leave to serve Ooki DAO through the two online mechanisms the organisation maintained for the public: a help chat box and an online discussion forum on its website. The agency’s supporting papers stated that it had taken extensive steps to identify an individual authorised to accept service and could not, because the organisation had no physical address and no publicly identifiable people associated with it. Judge Orrick granted the motion (Dkt. 17). The CFTC then served through both channels, and a post appeared in the forum acknowledging the litigation.
Four organisations sought leave to file amicus briefs: LeXpunK, a community of lawyers and developers working on open-source legal resources for decentralised finance and DAOs; the DeFi Education Fund, an advocacy group; Paradigm Operations LP, a crypto investment firm; and Andreessen Horowitz, described in the order as a venture capital firm with dedicated funds that had raised more than $7.6 billion for crypto and web3 startups. Judge Orrick granted leave and construed all four briefs as motions for reconsideration of his service order. He heard argument on 7 December 2022.
At that hearing the CFTC disclosed for the first time that Bean and Kistner were themselves token holders. Judge Orrick’s order of 12 December 2022 (Dkt. 59) records that this was new information, that neither the complaint nor the service motion had mentioned it, and directs the agency to serve the two men in their capacity as token holders or show cause why service was impossible. The CFTC served them.
The order of 20 December 2022
Judge Orrick’s Order Concluding That Service Has Been Achieved (Dkt. 63) is the part of this case that gets cited. It opens by describing the matter as one of first impression and disposes of the amici’s arguments in two stages.
Capacity. Federal Rule of Civil Procedure 17(b)(3) sends the question of a non-corporate party’s capacity to be sued to the law of the state where the court sits. California defines an unincorporated association as “an unincorporated group of two or more persons joined by mutual consent for common lawful purpose, whether organized for profit or not,” Cal. Corp. Code § 18035(a), and California case law adds a second formulation: a group whose members share a common purpose and who function under a common name in circumstances where fairness requires the group be recognised as a legal entity.
The order works through each element on the CFTC’s allegations. Token holders are persons. They joined by mutual consent, because the founders transferred governance consensually and nothing suggests any holder objected to the power that came with holding a token; a holder who did not want that power “could have sold or given away the tokens.” The common purpose is governing the DAO, and providing and governing this technology is not inherently unlawful, so the California street-gang authorities the amici relied on do not apply. The common name is Ooki DAO, which no amicus contested, and fairness requires recognition because on the pleaded facts the protocol was unregistered “and someone must be responsible.”
A footnote adds that the organisation would also satisfy the federal definition of an unincorporated association, which the Ninth Circuit states as a voluntary group of persons, without a charter, formed by mutual consent to promote a common objective. The federal test carries no lawful-purpose requirement.
Judge Orrick was explicit about what he had not decided. Whether the DAO is subject to regulation under the CEA “is a separate question that goes to the heart of the merits of this case,” and he declined to reach it on a service motion.
Service. California’s ordinary route for serving an unincorporated association, Cal. Code Civ. Proc. § 416.40, requires a designated agent or a named officer, and none existed. The fallback in Cal. Corp. Code § 18220 permits service on designated members plus a mailing to the association’s last known address, and the order holds that this section cannot govern because it presupposes an address the organisation does not have. That leaves Cal. Code Civ. Proc. § 413.30, which allows any manner of service reasonably calculated to give actual notice.
The reasoning under § 413.30 draws on Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002), where the Ninth Circuit approved email service on a defendant that had structured its business so it could be contacted only by email. Judge Orrick found the same pattern: Ooki DAO had no easily discoverable address, and the chat box and forum were its chosen and preferred method of communication. He gave two reasons the postings were reasonably calculated to reach the defendant. Token holders controlled the website itself through the Administrator Keys, so a provocative post on that website was likely to be seen. And binding token votes were preceded by snapshot votes prompted by forum discussion, so a forum post reaches at least some token holders.
The order then records that actual notice was achieved: forum discussion, posts from the organisation’s Twitter account, a snapshot vote on how to respond to the litigation, national media coverage, and four amici who found the case and filed briefs. Service on Bean and Kistner is described as “a belt-and-suspenders procedure” to satisfy due process. Judge Orrick denied the motions for reconsideration and deemed service sufficient as of the date of the order.
Default and judgment
Ooki DAO never appeared. The clerk entered default. The CFTC moved for default judgment, and Judge Orrick granted the four amici leave to file a brief opposing that motion. After a hearing he ordered supplemental briefing on personal jurisdiction and on the request to remove the organisation’s website.
The Order Granting Motion for Default Judgment (Dkt. 76), dated 8 June 2023, holds:
- Personal jurisdiction. CEA § 6c(e), 7 U.S.C. § 13a-1(e), provides for nationwide service of process in language nearly identical to the Clayton Act and the Securities Exchange Act, so the test is minimum contacts with the United States as a whole. Token holders voted from the United States and the founders acted for the DAO while in the United States.
- Capacity and CEA coverage. The CEA imposes liability on any “person,” and § 1a(38) defines that term to include associations. On the state and federal definitions alike, “[r]egardless of whether the state or federal definition applies, it is met here.” Ooki DAO is subject to suit under the CEA as an unincorporated association.
- The three violations, each sustained on the pleaded facts.
- Penalty. $643,542, being three violations at the inflation-adjusted statutory maximum of $214,514 each, under 7 U.S.C. § 13a-1(d)(1) and 17 C.F.R. § 143.8(b)(1).
- Website removal, granted over the amici’s objection, on the reasoning that the complaint put the defendant on notice that a permanent injunction was sought and that shutting the website is how such an injunction is given effect.
Two features of that order are easy to miss. Well-pleaded allegations are taken as true on default, and the court said so; it also recorded that the CFTC had submitted a proposed order containing a section headed “Findings of Fact” and declined to adopt those as findings.
The judgment itself (Dkt. 77), entered the same day, awards $643,542, imposes permanent injunctions against each of the three violations, imposes permanent trading and registration bans, and orders the removal from the internet of all webpages through which the organisation solicited or dealt in leveraged retail commodity transactions, including ooki.com. It binds any person or entity providing web hosting or domain registration in the United States who receives actual notice of the order, requiring them to take the pages down, preserve documents relating to the site, and notify CFTC counsel of any other site operated on the organisation’s behalf. The judgment includes no restitution and no disgorgement.
The Commission announced the result in a statement from Division of Enforcement Director Ian McGinley, Release Number 8715-23, dated 9 June 2023, the day after the judgment.
Later treatment
Two California federal courts have since applied the reasoning.
In Sarcuni v. bZx DAO, No. 22-cv-618-LAB-DEB (S.D. Cal.), decided between the service order and the default judgment, Judge Larry Alan Burns held on 27 March 2023 that plaintiffs in a putative class action over a $55 million phishing loss had adequately pleaded that a general partnership existed among BZRX token holders, so that partners could face joint and several liability. That order cites the Ooki DAO service ruling for the fact that Bean and Kistner were token holders. It rejects the argument that treating the DAO as a general partnership would be a radical expansion of partnership law, quoting the California rule that courts do not countenance partnerships that seek the advantages of commercial dealing without the corresponding liabilities.
In Samuels v. Lido DAO, No. 23-cv-06492-VC (N.D. Cal.), Judge Vince Chhabria cited the Ooki DAO order twice. On 27 June 2024 he deemed service sufficient in part because, as another court in the district had already held, service on a DAO by posting to its governance forum is reasonably likely to give notice. On 18 November 2024 he cited the same order for applying California law to a DAO’s capacity to be sued, then held that the plaintiff had adequately alleged that Lido DAO is a general partnership under California law and that three of the four institutional investors sued, Paradigm Operations, Andreessen Horowitz and Dragonfly Digital Management, are general partners liable for the partnership’s conduct. Robot Ventures was dismissed. On the argument that a DAO is only software, the order describes Lido’s alleged conduct as “the actions of an entity run by people.”
Statutory alternatives
Legislatures had begun offering chartered forms for this kind of organisation before the case was filed, and one significant statute follows it.
| Jurisdiction | Instrument | Status |
|---|---|---|
| Vermont | Blockchain-based limited liability company, 11 V.S.A. ch. 25, subch. 12 | Added 2017, No. 205 (Adj. Sess.), § 7 |
| Wyoming | Decentralized Autonomous Organization Supplement, W.S. 17-31-101 to 17-31-116 | 2021 Senate Enrolled Act 73, effective 1 July 2021 |
| Tennessee | Decentralized organizations, Tenn. Code Ann. § 48-250-101 et seq. | Public Chapter No. 852 (2022) |
| Marshall Islands | Decentralized Autonomous Organization Act 2022, 52 MIRC ch. 7 | P.L. 2022-50, commencement 25 November 2022 |
| Utah | Decentralized Autonomous Organizations Amendments, Utah Code ch. 48-5 | H.B. 357 (2023), effective 1 January 2024 |
| Wyoming | Decentralized Unincorporated Nonprofit Association Act, W.S. 17-32-101 to 17-32-129 | 2024 Senate Enrolled Act 23, effective 1 July 2024 |
The Wyoming 2024 act is the one that speaks directly to the question this case raised. Section 17-32-107(a) makes a decentralized unincorporated nonprofit association “a legal entity separate from its members for the purposes of determining and enforcing rights, duties and liabilities in contract and tort.” Subsections (b) and (c) provide that a person is not liable for the association’s breach of contract or for a tortious act for which the association is liable merely because that person is a member, an administrator, or someone authorised to participate in managing its affairs.
What I think happened
Read both orders end to end and the striking thing is how narrow the decided ground is next to what the case now gets cited for.
Judge Orrick decided two questions. Can this thing be sued in its own name, and was it served. He answered yes to both, and on the second he was on well-worn ground: the Ninth Circuit has allowed electronic service on a defendant who structures itself to be reachable only electronically since 2002. The genuinely new step was the first one, and even there he was careful. He said twice that whether the DAO is liable under the CEA goes to the merits and would wait. When the merits arrived, they arrived on default, which means nobody argued them.
The proposition everyone quotes, that voting your tokens makes you a member and members of a for-profit unincorporated association are personally liable for its debts, is not in the court’s order at all. It is in the CFTC’s own settled order against Bean and Kistner, where the respondents consented without admitting or denying and where nobody tested it. The most influential holding to come out of this matter was never litigated by anyone with a stake in losing it. That is worth sitting with.
Now the part that should actually worry you if you hold a governance token.
The Commission drew its membership line at voting. Judge Orrick’s reasoning drew it somewhere wider. His answer to the amici’s “casting a vote is not mutual consent” argument was that the consent is in the holding: you consented to the governance power that came with the token, and if you did not want it you could have sold the token or given it away. A footnote goes further and says that even a holder who gave away their voting rights made the decision to hold during the relevant period and so comprises the DAO. Read that twice. Under the agency’s theory you are a member if you voted. Under the order’s reasoning you are inside the group if you held. Those are different populations, and the second one is very large.
Then there is the anonymity, which the founders treated as armour and which did none of the work they expected. The organisation built a help chat box and a public forum so users could reach it, and that is exactly how the CFTC reached it. Judge Orrick used the front door.
What he relied on for actual notice is the community’s own reaction to being served: forum threads, posts from the organisation’s Twitter account, and a snapshot vote on how to respond to the lawsuit. They ran a governance vote about being sued. That is about as clean an admission of awareness as a court is ever handed.
The amicus story is the detail I keep coming back to. In late 2022, Paradigm and Andreessen Horowitz paid national law firms to tell a judge in the Northern District of California that a DAO is not an entity, cannot be sued, and cannot be served. In November 2024, in the same district, Judge Chhabria held that a plaintiff had adequately alleged that Paradigm and Andreessen Horowitz were general partners of a different DAO and liable for its conduct. The argument they lost as friends of the court came back at them as defendants. I do not think that is irony so much as the predictable consequence of a doctrine settling: once a court has a workable way to reach a DAO, private plaintiffs use it, and they aim at the participants with money.
One more thing that nobody who cites this case seems to mention. Judge Orrick’s June 2023 order describes the earlier settlement as one in which “Ooki DAO’s founders admitted to the unlawful operation of the trading platform.” The Commission’s order says they settled “[w]ithout admitting or denying any of the findings or conclusions herein.” A footnote in that order does have the respondents consent to the findings being taken as true and given preclusive effect in later Commission proceedings, which gives the judge’s shorthand some footing. The two documents still say different things, and the difference matters when you are working out how much weight this record can carry.
Put this next to Celsius. There, a clause in a terms-of-use document written years before the bankruptcy decided who owned the coins. Here, the absence of any charter at all decided who was exposed to the debts. Both questions were answered long before the trouble started, and in both cases almost nobody involved had read the thing that answered them, or checked whether it existed.
What would have changed the outcome
Be honest about this one, because the tempting answer is wrong.
Nothing about entity structure would have changed the outcome for this defendant. The CFTC’s charge was that an unregistered venue offered leveraged retail commodity transactions to US residents and ran without a customer identification program. A charter does not make an unregistered venue registered. What a charter would have produced is a defendant with an address, a registered agent, and the ability to appear and argue, which is a different thing from a defence.
What is genuinely structural here is the exposure of the people around the edges.
An unincorporated association has no charter, and for a for-profit one the position the CFTC took, and the position two California federal courts have since found plausible on the pleadings, is that partnership principles govern the members. Joint and several liability for the group’s obligations is the default that arrives when nobody has chosen anything else. That is the whole lesson. Participation in an unchartered group can put your own assets in reach in a way that participation in a chartered one does not.
Three checks that follow from the record, none of which is a product:
- Find out whether the thing you are participating in has filed anything, anywhere. If it has not, the characterisation available to a court is the one Judge Orrick reached, and the one Judge Burns and Judge Chhabria reached after him.
- Do not assume the boundary is the core team. The Commission drew its line at voting. Judge Orrick’s reasoning reaches holding. Neither line stops at the people who wrote the code.
- Understand what a wrapper does and does not reach. Wyoming’s § 17-32-107 is written in terms of contract and tort, and it separates the association from its members for those purposes. A federal enforcement action is neither a contract claim nor a tort claim, and nothing in that section is addressed to a regulator’s authority. A chartered form reduces certain private-litigation risks and leaves the regulatory question exactly where it was.
Then the part I would rather overstate than understate. Whether any of this reaches you turns on facts about your own holdings, your own votes, and your own jurisdiction, and it is a question for a lawyer. Digital Ascension Group is not a law firm and does not give legal advice, and neither does this article. Anyone holding governance tokens in an unchartered organisation, and particularly anyone who has voted them, should take actual legal advice on their personal exposure before the next proposal comes up, rather than after somebody files.
Sources
- Commodity Futures Trading Commission v. Ooki DAO, No. 3:22-cv-05416-WHO (N.D. Cal.), Complaint, filed 22 September 2022: cftc.gov
- In re bZeroX, LLC; Tom Bean; and Kyle Kistner, CFTC Docket No. 22-31, order instituting proceedings, making findings and imposing remedial sanctions, 22 September 2022: cftc.gov
- CFTC Release Number 8590-22, 22 September 2022: cftc.gov
- Dissenting Statement of Commissioner Summer K. Mersinger, 22 September 2022: cftc.gov
- Order to Serve Individuals or Show Cause, Dkt. 59, 12 December 2022: govinfo.gov
- Order Concluding That Service Has Been Achieved, Dkt. 63, 20 December 2022, 2022 WL 17822445: govinfo.gov
- Order Granting Motion for Default Judgment, Dkt. 76, 8 June 2023: cftc.gov
- Judgment, Dkt. 77, 8 June 2023: cftc.gov
- CFTC Release Number 8715-23, statement of Division of Enforcement Director Ian McGinley, 9 June 2023: cftc.gov
- Sarcuni v. bZx DAO, No. 22-cv-618-LAB-DEB (S.D. Cal.), Dkt. 49, order on motions to dismiss, 27 March 2023: govinfo.gov
- Samuels v. Lido DAO, No. 23-cv-06492-VC (N.D. Cal.), Dkt. 75, order on alternative service, 27 June 2024: govinfo.gov
- Samuels v. Lido DAO, Dkt. 115, order on motions to dismiss, 18 November 2024: govinfo.gov
- 11 V.S.A. § 4173, blockchain-based limited liability companies: legislature.vermont.gov
- Wyoming Decentralized Autonomous Organization Supplement, 2021 Senate File 0038, Senate Enrolled Act 73: wyoleg.gov
- Tennessee Public Chapter No. 852 (2022), House Bill 2645: publications.tnsosfiles.com
- Republic of the Marshall Islands, Decentralized Autonomous Organization Act 2022, 52 MIRC ch. 7, P.L. 2022-50: rmiparliament.org
- Utah H.B. 357 (2023), Decentralized Autonomous Organizations Amendments, enrolled copy: le.utah.gov
- Wyoming Decentralized Unincorporated Nonprofit Association Act, 2024 Senate File 0050, Senate Enrolled Act 23: wyoleg.gov
- Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002), and Committee for Idaho’s High Desert, Inc. v. Yost, 92 F.3d 814 (9th Cir. 1996), both relied on in the service order.
Related on this desk
- Tornado Cash: the sanctions arc, Blender to Van Loon to delisting — the same question about liability for software, answered with sanctions instead of an enforcement action.
Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.