How should employees of a cybersecurity company be sentenced for stealing virtual currency?

Author: Xiao Za lawyer

Recently, a news report about an employee of a certain cybersecurity company stealing virtual currency and obtaining over 2.5 million yuan has attracted attention in the cryptocurrency community. The criminal behavior of internal technical personnel is alarming, as it highlights that crises can occur close to home. However, from a legal perspective, this case involves a key issue related to criminal cases concerning virtual currency: Does virtual currency have the property of assets?

Basic Case Facts

According to the prosecution, from February 9 to 20, 2023, employees Hong, Yang, and Zhang of a certain cybersecurity company exploited a Yapi remote code execution vulnerability to gain access to the target virtual currency website. They controlled the internal network servers through lateral penetration and Trojan implantation, and after locating the server source code, they downloaded and analyzed the victim Su's virtual wallet address, private key, etc., and constructed false commands to transfer the virtual currency from the victim's wallet address. Subsequently, the three exchanged it for other virtual currencies and sold them, obtaining a total illegal income of over 2.5 million yuan. During this period, another employee, Zheng, forged Dash coin signatures and broadcast transactions under Hong's instructions, transferring 3015.9 Dash coins from the victim. The prosecution determined that their actions violated Articles 264 and 25(1) of the Criminal Law of the People's Republic of China and should be held criminally liable for theft as accomplices.

The court held that the defendants, with the intent of illegal possession, used technical means to invade others' computer information systems and secretly stole others' virtual currency, which constituted theft due to the particularly large amount or other particularly serious circumstances. The charges brought by the prosecution were established. After considering factors such as confession, voluntary surrender, meritorious conduct, honesty, being an accomplice, and restitution, the court accepted the defense's request for probation, sentencing Hong to three years in prison with a four-year probation and a fine of 50,000 yuan; Zheng was sentenced to three years in prison with a three-year probation and a fine of 50,000 yuan.

Does Stealing Virtual Currency Constitute Theft?

The main significance of discussing this issue lies in the fact that the statutory penalty for theft is higher than that for illegally obtaining data from computer information systems. Theft with particularly large amounts or other particularly serious circumstances can result in more than ten years of imprisonment or life imprisonment, along with fines or confiscation of property; whereas the crime of illegally obtaining data from computer information systems, in particularly serious circumstances, only carries a sentence of three to seven years of imprisonment and fines. The difficulty in convicting theft of virtual currency and common defense points revolve around the property attribute of virtual currency. According to Article 264 of the Criminal Law, theft must meet the requirements of the subject of the act, the purpose of illegal possession, the act of secret theft, the object of the crime, and the circumstances of the crime, and the object of theft can only be "public and private property" protected by the law. Therefore, if it can be proven that virtual currency is not property, there is hope to avoid a theft conviction and instead be convicted of illegally obtaining data from computer information systems, thereby reducing the penalty. In this case, the defense lawyer adopted this strategy. There has always been controversy in judicial practice regarding whether virtual currency can be regarded as "property."

1. Reasons Supporting

a. Virtual currency has scarcity.

The scarcity of virtual currency is objective; cryptocurrencies often announce a cap on the total issuance. Additionally, any changes to virtual currency are recorded on the blockchain through special, immutable hashes, making each virtual currency unique rather than fungible. If stolen, virtual currency cannot be restored through low-cost, centralized means, resulting in direct losses. Therefore, when virtual currency is the object of theft, the harm to the victim is similar to that of general property theft.

b. Virtual currency has property value.

Virtual currency is a special virtual asset with value and exchange value, and the difference between virtual assets in the network and tangible assets in real life lies only in the different time and space of existence. They can be converted into real property, and there is no difference in terms of property nature and benefit nature.

2. Reasons Opposing

a. Virtual currency is data in physical attributes.

Virtual currency essentially exists as a set of computer codes in binary form, which is an objective attribute that cannot be ignored. Conversely, using technical means to invade computer information systems and exceed authorized boundaries to steal data from these systems, including stealing keys to transfer virtual currency, is a typical act of unauthorized intrusion, which can be evaluated as an invasion of computer information systems.

b. China's policy documents impose strict restrictions on the holding and trading of virtual currency.

The 924 notice has clearly stated that activities related to virtual currency are considered illegal financial activities. Any legal entity, non-legal entity, or individual investing in virtual currency and related derivatives, which violates public order and good customs, will have their related civil legal actions deemed invalid, and any resulting losses will be borne by them. At the same time, criminal cases involving virtual currency are often closely monitored by relevant policy documents, which do not consider virtual currency as property protected by criminal law, aligning more with policy needs.

Value Orientation of the Case Judgment

The defense lawyer in this case argued that "virtual currency is not 'property' in the sense of criminal law," and therefore the case does not constitute theft but only the crime of illegally obtaining data from computer information systems. The court did not respond directly to this but stated in the judgment that "the defendant, with the intent of illegal possession, used technical means to invade others' computer information systems and secretly stole others' virtual currency." The illegal invasion of others' computers was a means of theft, and virtual currency was the object of theft. From this perspective, the case effectively recognized the property attribute of virtual currency. Since the 924 notice clarified the illegality of virtual currency, civil cases involving virtual currency also need to undergo validity reviews first. In criminal law, cases where virtual currency is the object of the crime also raise questions about whether there is a need for protection of virtual currency. This case acknowledged the property value of virtual currency, protecting the property rights of virtual currency holders from the perspective of the interests protected by theft law (although the legality of the holding status will be evaluated separately), and also provided a negative evaluation of the behavior of stealing using computer information technology, capturing the essence of theft as a crime that infringes on others' property rights.

The Sa Jie team believes that the trial of cases involving virtual currency needs to be gradually standardized. Although the illegal status of virtual currency leads to divergences in judicial practice and has policy implications, the overall trend remains to explore and clarify the characterization of civil disputes and criminal offenses arising from virtual currency, protect the legitimate rights and interests of parties, and promote consistent judgments in similar cases. Although there is still room for debate regarding the characterization of theft of virtual currency cases, this case has properly handled the protection of the victim's rights and the cautious attitude of criminal policy towards virtual currency. In the future, the trial thinking of related cases should be further standardized.

In Conclusion

Additionally, this case also serves as a reminder to cybersecurity professionals to adhere to professional ethics and legal boundaries, and not to engage in illegal activities, as "black eating black" will also face legal sanctions. Relevant practitioners should assist law enforcement agencies in combating cybercrime and maintaining cybersecurity. Web3, cybersecurity, and other related practitioners possess professional skills and knowledge and should use these skills in legitimate ways to ensure cybersecurity and protect users' privacy, data security, and property rights. Engaging in illegal activities using cybersecurity skills not only violates the law but also deviates from professional ethics and will face severe legal penalties.