Inside an HNW Cybercrime Arbitration: From Filing to Award

Full transcript

0:12 For the most critical financial disputes in America today, the courts are no longer where they get resolved. Losses involving high-net-worth families, family offices, and founders — those matters move to arbitration.

0:26 I'm Max Dilendorf, founder of Dilendorf Law Firm in New York.

0:30 We are counsel of record in 130+ Cybercrime Arbitration Cases against Verizon, T-Mobile, Coinbase, Gemini, AT&T and others. Today, I'll walk you through what actually happens inside one of these matters. Nine phases. From engagement to award.

0:49 We love taking matters to full evidentiary hearings and winning them. But trial is a tool, not a strategy. It’s the right move only if the facts support it.

1:01 Sometimes an early settlement returns more than years of fighting.

1:06 Other times, the only way an institutional respondent writes a serious check is when they understand we are ready to take it all the way — and we have done it before, against opponents who counted on us blinking. We did not.

1:22 The choice we make first. Settle or fight. We make the call early. We revisit at every phase.

1:31 Phase one. Before filing, evidence must be preserved.

1:34 In serious matters involving compromised devices, clouds and client’s networks, our forensics team performs a forensic copy of every device that touched the breach.

1:48 Hardware imaged. Metadata preserved. Chain of custody documented to hold up at hearing.

1:56 Most victims call a personal lawyer first and lose three weeks.

2:01 In that window, attackers destroy critical evidence.

2:05 Seven-figure matters collapse because work started on day twenty-one instead of day one.

2:12 If you've been hacked, the full 72-hour framework on what to do is in our next video.

2:20 Phase two. Every major institutional user agreement contains a mandatory pre-filing notice — data clouds, banks, crypto exchanges, brokerages, phone carriers. You name it. You cannot simply file. You must serve a written demand and give the company 45 to 60 day notice to respond.

2:43 The substance of that demand letter matters. It is the first formal statement of the claim, and the company's response shapes the leverage you carry into the rest of the case.

2:56 Phase three. The user agreement dictates the forum — almost always AAA, JAMS, or NAM. Each has its own filing fees, rules, and pool of arbitrators. The decisions made at filing —relief sought, discovery and procedural strategy — determine what kind of process the case will receiving for the next two years. Phase four.

3:20 This step surprises clients. Arbitrator selection is a process, not a coin flip.

3:27 Each side reviews candidates, strikes those with conflicts, and ranks the rest. The process takes weeks. Sometimes months. The arbitrator decides every procedural dispute, every discovery question, and the final award itself.

3:44 One of the most critical decisions in the case is made before the first witness is sworn.

3:50 Phase five. Once the arbitrator is appointed, we hold a preliminary hearing to set the schedule — motion practice, discovery, hearing dates.

4:02 Discovery is the most critical weapon a claimant has against an institutional respondent.

4:09 We ask the arbitrator to define scope early and broadly.

4:13 We do not accept the company's argument, for example, that arbitration limits depositions in consumer arbitration. Under federal and state law, contractual provisions that strip a claimant of meaningful discovery in a forum the company itself chose are unconscionable and unenforceable. Due process travels with the claimant.

4:35 We protect it. Phase six.

4:38 A cybercrime arbitration is ultimately won or lost on the strength of its experts.

4:44 Discovery gives you the evidence. Experts make the arbitrator understand what it means.

4:51 There is no version of a successful cybercrime matter without the right expert witnesses.

4:57 This is one of the most critical decisions in the case, and it must be made early.

5:02 We have spent years assembling a national team — retired federal cybercrime agents, computer scientists, and former enforcement officials, sourced across the United States.

5:15 When we file, we already know which experts we need and how their prior testimony holds up under cross examinations. The other side has every advantage of resources — bigger legal teams, bigger budgets, more in-house counsel.

5:31 “What they cannot have is better experts than ours. We make sure of it.” – Max Dilnedorf, Esq. Phase seven. The respondent's first move is almost always a motion to dismiss.

5:41 They want the case ended before discovery — before internal communications, security logs, and prior incident records come out. They want to win without fighting.

5:51 Our position is consistent. Dispositive motions are decided after discovery, not before.

5:58 This is not federal court. Arbitrators have wide discretion to defer. Most do.

6:04 There are no rules of federal or state procedure in arbitration. You need to understand that.

6:09 Phase eight. If the case survives motion practice and discovery, we move to final evidentiary hearing. Modern arbitrations are virtual — parties across multiple states, joined by video. It does not look like a courtroom. The standards of preparation are the same. Direct. Cross. Expert testimony. Opening and closing. The record we build is the record the arbitrator decides on. Phase nine.

6:36 After the hearing, the arbitrator issues a final award — typically within 60 to 90 days.

6:42 The prevailing party then moves to confirm the award in the court designated by the user agreement. Once confirmed, the award becomes a judgment — enforceable like any other. Then collection begins. And that is its own challenge. Future video. Nine phases. Engagement to enforcement.

7:01 Every phase has leverage points. Every decision compound into the next.

7:06 This is what 130 cybercrime arbitration cases look like. This is what it takes to bring a complex cybercrime matter to recovery for a sophisticated client.

7:18 If you are a family office, founder, or HNW individual who has been hacked — the time to engage counsel is now. The leverage you preserve in the first 72 hours determines the leverage you have at the final hearing.

7:33 Thank you so much for watching. I will see you in the next video.

A transcript of the recording, so it reads as speech rather than as prose. It explains the law in general terms and is not advice on your own situation, which turns on facts this video cannot know.