Crypto Phishing Loss: Istanbul Court of Appeal Ruling 2025/1603

A user who cannot log in to an account on a crypto asset platform finds, a few days later, that the bitcoin in the wallet has been sent to another address. According to the platform, the transfer was made with the correct username, the correct password and a confirmation link sent to the registered e-mail address. According to the user, the system failed to notice log-ins made from different cities minutes apart. So who bears the loss: the platform, which is expected to put security measures in place, or the user, who did not protect the log-in details?

The Istanbul Regional Court of Appeal, 14th Civil Chamber, answered this question in its decision of 09.10.2025 (Docket No. (E.) 2022/244, Decision No. (K.) 2025/1603) in light of expert reports. The Istanbul 21st Commercial Court of First Instance had dismissed the compensation claim, and the Chamber rejected the user's appeal on the merits. According to the Chamber, no technical security vulnerability was found on the platform, the transactions were carried out with the user's own credentials, and the user had been exposed to an attack of the phishing type; therefore no fault could be attributed to the platform.

🪙 From opening the account to its being emptied

According to the statements given in the criminal investigation and recounted in the decision, the claimant began trading bitcoin on the recommendation of a person he had befriended at the hotel he ran, opened an account on the platform and deposited a total of TL 115,000.00. He stated that after some time he could not access his account, that he told this person, and that the account was emptied on the date he spoke with that person.

Based on the platform's account and the expert findings, the sequence of events can be summarised as follows:

The claimant first applied to the court of his place of residence, asking for the balance in his account to be established, for a new account to be opened in his name and for the balance to be transferred to it. The defendant argued that the user agreement made the Istanbul courts competent and that the commercial courts of first instance had jurisdiction; the decision under appeal was given by the Istanbul 21st Commercial Court of First Instance on 12.10.2021.

🖥️ What did the two expert reports say?

The key question in the dispute was whether there was a security vulnerability in the platform's systems. The court first obtained a report from a capital markets expert and, after the claimant's objections, added a computer programmer to the panel and obtained a second report:

The court of first instance also established that the e-mail address the claimant used when registering on the platform belonged to a domain whose service was obtained through the website of the person he was complaining about, that the claimant had sent some documents to an address that did not belong to the platform, and that he had been told this address was not the platform's.

🧾 A preliminary issue: was the user a consumer?

The court of first instance explained why it did not decline jurisdiction before examining the merits. It referred to decision No. 2017/11-2348 (E.), 2019/82 (K.) of the General Assembly of Civil Chambers of the Court of Cassation, under which the purpose stated in the contract must be taken into account. Considering together the number and volume of transactions in the claimant's account statements, his statements in the investigation file and the fact that he operated a hotel, it held that the transactions were made for the purpose of making a profit and concluded that the commercial court of first instance had jurisdiction.

This finding is separate from the assessments on the merits of the decision and rests on the facts of the particular case. The article on jurisdiction in a crypto exchange caseTR, which discusses the jurisdiction question in disputes between a crypto platform and a user in detail, shows that a different outcome was reached in a different case.

📨 The appeal objections and the Chamber's answer

In the appeal petition, the claimant's lawyer raised detailed objections:

The Istanbul Regional Court of Appeal, 14th Civil Chamber, did not find these objections well founded. Evaluating the relevant articles of the user agreement, the expert reports and the criminal investigation file together, the Chamber found the first-instance dismissal consistent with procedure and law and rejected the appeal on the merits under Article 353/1-b-1 of the Code of Civil Procedure (HMK). The decision was given on 09.10.2025, unanimously, and is open to appeal to the Court of Cassation.

⚖️ How were fault and causation assessed?

The Chamber's reasoning rests on reading the contract provisions and the technical findings together. The provisions of the user agreement mentioned in the decision are the following:

Within this framework the Chamber reached the following conclusions: the claimant did not protect the password and other details of his user account; the sale of the bitcoin and its transfer to another account were carried out through the claimant's username, password and the e-mail address defined on the account; according to the technical examination the claimant was exposed to a phishing-type fraud and it was not possible for the platform to detect this; and there was no security vulnerability at the time of the transactions. Therefore no fault attributable to the defendant was found, and no adequate causal link could be established between the loss and the platform's acts. The court of first instance had also stated that the loss was based on the claimant's own fully faulty conduct.

🔎 The suspicious log-in claim and the burden of proof

The aspect of the decision most likely to carry over into practice is the kind of evidence needed to support a claim of suspicious activity. The claimant presented log-ins from different cities minutes apart as an anomaly the platform should have noticed. The expert panel, for its part, stated that given the changing IP addresses of individual users and the widespread use of VPNs, these movements were not an unusual situation that the platform should have treated as a threat; the courts based their judgment on this finding.

Similarly, it had to be shown that a withdrawal made with the user's details and the registered e-mail confirmation resulted from a security weakness of the platform. In this case, the points that worked against the user were that, by his own statements, he pointed to a person outside the platform having access to the account, and that the registration e-mail belonged to an untrustworthy domain.

The limits of the decision are also clear. The Chamber did not separately discuss the e-mail correspondence said to come from the support team and said to admit the error, the SMS question in the second password change, or the request to obtain the HTS records; it was content to accept that the expert reports were suitable as a basis for judgment. The events took place in 2018, and the decision does not rely on the later legislation on crypto asset service providers. The article on SIM cloning and a crypto accountTR, which examines a crypto account emptied through a replacement SIM card issued by the mobile operator, offers an example in which responsibility is directed at a different link in the chain.

📌 Takeaways from the decision

❔ Questions readers may ask

For detailed information and legal support, you can contact Savun Law & Consultancy. Contact details are available on the contact page, and other articles in the series can be found in the Precedent DecisionsTR archive.