Guido Malato v. DigitalOcean LLC

CourtDistrict Court, S.D. New York
DecidedMarch 11, 2026
Docket1:25-cv-02319
StatusUnknown

This text of Guido Malato v. DigitalOcean LLC (Guido Malato v. DigitalOcean LLC) is published on Counsel Stack Legal Research, covering District Court, S.D. New York primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Guido Malato v. DigitalOcean LLC, (S.D.N.Y. 2026).

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK GUIDO MALATO, Petitioner, 25 Civ. 2319 (KPF) -v.- OPINION AND ORDER DIGITALOCEAN LLC,

Respondent. KATHERINE POLK FAILLA, District Judge: Petitioner Guido Malato claims to have lost nearly $6 million worth of Bitcoin that he maintained on a server provided by Respondent DigitalOcean, LLC (“DigitalOcean”), as a result of an October 2021 hack of DigitalOcean’s internal network. More than two years after the hack, in December 2023, Mr. Malato brought an arbitration against DigitalOcean (the “Arbitration”) before the American Arbitration Association (“AAA”); one year later, on December 20, 2024, arbitrator J. Franklin McCreary (the “Arbitrator”) issued a final award (the “Award”) finding in favor of DigitalOcean on all claims. Mr. Malato has filed a motion for summary judgment to vacate that Award, and DigitalOcean has filed a cross-motion for summary judgment to confirm the Award. For the reasons set forth in the remainder of this Opinion, the Court denies Mr. Malato’s motion and grants DigitalOcean’s motion. BACKGROUND1 A. Factual Background 1. The Parties and Their Relationship Mr. Malato is a citizen of Brazil who, during the relevant time period, was the owner of Cryptal Digital LLC, a Florida limited liability company, and

GMalato Serviços e Negocios Digitais LTDA, a Brazilian limited liability

1 The facts set forth in this Opinion are drawn from the parties’ submissions in connection with their cross-motions for summary judgment. The Court primarily sources facts from Petitioner’s Statement of Undisputed Material Facts filed pursuant to Local Civil Rule 56.1 (“Pet. 56.1” (Dkt. #10-1)); Respondent’s Response to Petitioner’s Statement of Undisputed Material Facts (“Resp. 56.1”) and Respondent’s Counterstatement of Additional Material Facts (“Resp. Counter-56.1”), both of which are contained in docket entry 18, as well as the exhibits thereto (“Resp. Ex. [ ]” (Dkt. #18-1, 18-2)); the Arbitrator’s Final Award dated December 20, 2024 (the “Award” (Dkt. #11- 1)); DigitalOcean’s Terms of Service during the relevant time period (“TOS” (Resp. Ex. B); the Expert Report of the Boaventura Consulting Expert Group (“Boaventura Report” (Dkt. #11-2); the Expert Report of Todd Renner, dated October 29, 2024 (“Renner Report” (Dkt. #11-3)); the Rebuttal Expert Report of Erico Manfredi and Fabrizio Alves (“Rebuttal Report” (Dkt. #11-4)); the Declaration of Guido Malato (“Malato Decl.” (Dkt. #11-5)); and the Declaration of Adrianne Cherpak (“Cherpak Decl.” (Resp. Ex. A)). Citations in this Opinion to a party’s Rule 56.1 Statement incorporate by reference the documents and testimony cited therein. See Local Rule 56.1(d). Where a party’s Rule 56.1 Statements are not followed by citations to admissible evidence, the Court does not consider them. See Local Rule 56.1(d) (“Each statement by the movant or opponent under Rule 56.1(a) and (b), including each statement denying and controverting any statement of material fact, must be followed by citation to evidence that would be admissible and set forth as required by Fed. R. Civ. P. 56(c)”). Similarly, where facts stated in a party’s Rule 56.1 Statement are supported by testimonial or documentary evidence, and not contested by the other party, or contested with only a conclusory statement by the other party, the Court considers such facts to be true. See Local Rule 56.1(c), (d); Biberaj v. Pritchard Indus., Inc., 859 F. Supp. 2d 549, 553 n.3 (S.D.N.Y. 2012) (“A nonmoving party’s failure to respond to a Rule 56.1 statement permits the court to conclude that the facts asserted in the statement are uncontested and admissible.” (internal quotation marks omitted) (quoting T.Y. v. N.Y.C. Dep’t of Educ., 584 F.3d 412, 418 (2d Cir. 2009))). Petitioner elected not to respond to Respondent’s Counterstatement of Additional Material Facts, and the Court therefore considers the statements presented in that Counterstatement to be true. For ease of reference, the Court refers to Petitioner’s memorandum of law in support of his motion for summary judgment as “Pet. Br.” (Dkt. #11); to Respondent’s amended memorandum of law in support of its cross-motion for summary judgment and in opposition to Petitioner’s motion as “Resp. Br.” (Dkt. #20); to Petitioner’s reply memorandum and opposition to Respondent’s motion as “Pet. Reply” (Dkt. #23); and to Respondent’s reply memorandum as “Resp. Reply” (Dkt. #26). company. (Pet. 56.1 ¶¶ 1, 4). Mr. Malato’s business in Cryptal Digital LLC involved managing digital assets for clients in Brazil; he claimed that while his business had been stable for a period of years, vicissitudes in the

cryptocurrency markets in October 2021 had “severely damag[ed] the Petitioner’s business and eviscerated the company’s investment positions.” (Id. ¶ 6). DigitalOcean is a “cloud infrastructure provider offering services that allow customers to create and operate virtual machines (also known as ‘Droplets’) that those customers can use for a variety of purposes, such as hosting a website or blog, developing or testing software, storing data, and more.” (Pet. 56.1 ¶ 2). Mr. Malato signed up for a DigitalOcean account on

January 15, 2016. (Resp. Counter-56.1 ¶ 2). In or about October 2021, Mr. Malato maintained 65.93 bitcoins, which he later estimated to have a value of approximately $6.87 million, on a Droplet maintained by DigitalOcean. (Pet. 56.1 ¶ 7). In signing up for an account with DigitalOcean, Mr. Malato accepted the company’s then-current Terms of Service, which, according to DigitalOcean, “made clear that DigitalOcean would provide its customers with cloud-hosting Services, but the responsibility for protecting data stored on DigitalOcean’s

Services would lie with the customer.” (Resp. Counter-56.1 ¶¶ 2-3; see also TOS; see generally Renner Report ¶¶ 66-69 (discussing “shared responsibility model” adopted by major cloud providers, including DigitalOcean, pursuant to which “DigitalOcean customers … are responsible for securing the data stored on DigitalOcean services”)). In particular, Mr. Malato agreed with DigitalOcean that: a. He was responsible for safeguarding his Droplet, including through “maintain[ing] appropriate security… which may include the use of encryption technology” ([TOS] § 4.6); b. He was using DigitalOcean’s services at his own risk and subject to a disclaimer of any warranty relating to DigitalOcean’s services being “secure” (id. § 9.1); c. Any potential liability would be limited “to the fullest extent permitted by law ... [including for] any indirect, incidental, special, consequential or punitive damages ... arising out of or relating to [Malato’s] access to or use of, or inability to access or use, the Websites and Services or any materials or content on the Websites and Services ... [Malato] agree[s] [DigitalOcean] will have no liability for any data that may be destroyed, lost or otherwise rendered inaccessible, whether because [Malato] failed to backup [his] data or for any other reason.” (id. § 10.1); d. DigitalOcean could not be found liable for any indirect, incidental, special, consequential or punitive damages arising out of or relating to his access or use of the Services; that any aggregate liability for any claims arising out of or relating to the TOS or the Services is limited to the amount Malato paid DigitalOcean for the Services at issue in the month prior to the event or circumstance giving rise to the claim; and that this limitation of liability was “an essential element of the basis of the bargain between” the parties (id. §§ 10.1-10.3); and e.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Rich v. Spartis
516 F.3d 75 (Second Circuit, 2008)
VIDAL v. Girard's Executors
43 U.S. 127 (Supreme Court, 1844)
Twin City Pipe Line Co. v. Harding Glass Co.
283 U.S. 353 (Supreme Court, 1931)
A. C. Frost & Co. v. Coeur D'Alene Mines Corp.
312 U.S. 38 (Supreme Court, 1941)
Muschany v. United States
324 U.S. 49 (Supreme Court, 1945)
Anderson v. Liberty Lobby, Inc.
477 U.S. 242 (Supreme Court, 1986)
Irwin v. Department of Veterans Affairs
498 U.S. 89 (Supreme Court, 1991)
Daubert v. Merrell Dow Pharmaceuticals, Inc.
509 U.S. 579 (Supreme Court, 1993)
First Options of Chicago, Inc. v. Kaplan
514 U.S. 938 (Supreme Court, 1995)
Hall Street Associates, L. L. C. v. Mattel, Inc.
552 U.S. 576 (Supreme Court, 2008)
Kaytor v. Electric Boat Corp.
609 F.3d 537 (Second Circuit, 2010)
Adrian v. Town of Yorktown
620 F.3d 104 (Second Circuit, 2010)
Florasynth, Inc. v. Alfred Pickholz
750 F.2d 171 (Second Circuit, 1984)
Schwartz v. Merrill Lynch & Co.
665 F.3d 444 (Second Circuit, 2011)

Cite This Page — Counsel Stack

Bluebook (online)
Guido Malato v. DigitalOcean LLC, Counsel Stack Legal Research, https://law.counselstack.com/opinion/guido-malato-v-digitalocean-llc-nysd-2026.