Cybersecurity Policy Report, S.D.N.Y.: Crypto law firm sues Phantom Technologies over meme coin cyber breach, (Apr 16, 2025)
Organizations Mentioned:Phantom Technologies, Inc.
A New York attorney claims a major crypto service provider knew about specific cybersecurity vulnerabilities in its software but failed to warn users.
In a new federal lawsuit, the owner of a small crypto-focused law firm alleges that a crypto wallet provider concealed specific known risks of cyber hacks, resulting in significant financial losses to customers who purchased the “Wiener Doge” crypto token. The lawsuit alleges violations of the federal commodities laws and New York state cybersecurity requirements for financial companies, among other claims (Murphy v. Phantom Technologies, Inc., No. 1:25-cv-03060-MMG (S.D.N.Y. filed Apr. 14, 2025)).
Parties. Thomas Liam Murphy, Esq. is the founding partner of Murphy’s Law, a boutique crypto litigation firm. Murphy filed the complaint on behalf of himself and friends and family who held interests in the Wiener Doge token, a crypto project developed by Murphy.
Phantom Technologies, Inc. is a $3-billion-dollar crypto company headquartered in San Francisco, according to the complaint. Phantom allegedly owns and operates “the fastest-growing consumer crypto application in the world,” an all-in-one consumer crypto trading and storage application that allows individuals to create crypto wallets to store, buy, and trade cryptocurrencies.
According to the complaint, Phantom’s application facilitated $20 billion in cryptocurrency swaps in 2024, generated $130 million in fees in January 2025, and was recently valued at $3 billion, all while operating outside of any federal or state financial regulatory framework.
Also named as a defendant is Aux Cayes Fintech Co. Ltd., d/b/a “OKX”, allegedly a business entity incorporated in the Seychelles that operates one of the highest-volume cryptocurrency exchange and trading platforms in the world.
Jurisdiction. The complaint is filed in the U.S. District Court for the Southern District of New York.
Facts. According to the complaint, Murphy developed the Wiener Doge crypto token, a “meme coin,” on the Solana blockchain. Murphy traded SOL, the Solana blockchain’s native crypto token, for Wiener Doge and stored it in crypto wallets provided by Phantom.
According to the complaint, Phantom actively markets its application to retail users as a crypto wallet service that is “safe, easy, and fun” and has “best-in-class” security features. But in reality, says Murphy, Phantom is not a mere crypto wallet but instead functions as an unregulated cryptocurrency trading platform. It “routes token swaps, matches trades algorithmically, charges fees on execution, and connects users to third-party liquidity pools--performing the core functions of a trading platform without regulatory oversight.”
Murphy alleges that Phantom fails to disclose major cybersecurity risks to users. Specifically, he says Phantom has long known but fails to disclose that its browser application stores decrypted private keys in volatile memory—an architecture that exposes users to malware and key theft.
According to Murphy, a cybercriminal hacked into his personal computer on January 20, 2025, and exported his private key to his Phantom wallets from his web browser’s working memory. Without having to bypass two-factor authentication or any security defense from Phantom’s application, the hacker allegedly obtained unrestricted access to and liquidated over $500,000 in crypto funds in three of Murphy’s Phantom wallets. As a result, the value of Wiener Doge fell nearly to zero.
Murphy blames Phantom for the theft, stating that hundreds of other victims online have reported attacks using the same browser exploit.
“Phantom did not merely fail to anticipate cyberattacks—it knew exactly how users were being compromised and made a calculated decision to remain silent,” the complaint states. “The platform's architecture enables untraceable liquidation of stolen assets with no oversight, no reversibility, and no accountability.”
Murphy further alleges that Phantom aided and abetted criminal conversion and money laundering through its commercial integration with OKX. In February, OKX pleaded guilty to violating U.S. anti-money laundering laws and agreed to pay penalties totaling more than $500 million.
Claims. The complaint asserts violations relating to fraud and failure to register under the Commodity Exchange Act. The complaint also asserts violations of New York state law relating to cybersecurity requirements for financial institutions as well as deceptive trade practices and false advertising. Other claims include negligence and aiding and abetting criminal conversion and money laundering.
Relief requested. The complaint demands a jury trial and requests monetary damages, equitable restitution, and attorney fees and costs.
This is case No. 1:25-cv-03060-MMG.
Attorneys: Thomas Liam Murphy, pro se.
Companies: Phantom Technologies, Inc.
MainStory: TopStory Blockchain CommodityFutures DataBreach CyberPrivacyFeed Derivatives FinancialIntermediaries NewLawsuitsNews Swaps NewYorkNews DataPrivacy DataSecurity