In the bizarre and intricate case of the million-dollar stolen coins, only the insider is punished with three cups of wine?

Author: Xiao Za Lawyer

Recently, the Sa Jie team noticed a post by an old friend from the cryptocurrency circle on an overseas social platform, claiming that their platform (hereinafter referred to as "Platform H") had closely cooperated with the Shanghai police. Through clear and complete on-chain data, they successfully identified the "insider" criminal suspects, helping to solve a major case of stolen cryptocurrency worth millions and successfully recovering a significant amount of property loss for the victims.

Pursuing recovery for clients is undoubtedly a commendable act, but the Sa Jie team, after researching the publicly available information online, found that the punishment for the insider in this case seems to have the suspicion of "heavy lifting and light placing," with significant controversy regarding conviction and sentencing. However, this appears to be a result of the considerable divergence in the recognition of the nature of cryptocurrency assets by judicial authorities in our country (data or property or both?).

Today, the Sa Jie team will provide a detailed explanation of this bizarre case within a case in the cryptocurrency circle and interpret the trends in judicial policy development based on some recent judicial practices regarding cryptocurrency assets in our country.

Millions of Cryptocurrency Disappeared? A Bizarre Case Within a Case

In May 2023, a resident of Shanghai, Mr. Ou, opened the iToken wallet developed by Platform H in a coffee shop, wanting to see if the frequently fluctuating cryptocurrency was still "good." Upon opening the wallet, Mr. Ou was shocked to find that his wallet was "completely empty," and the cryptocurrency originally worth millions had directly "evaporated." After multiple restarts and re-logins to access the wallet, Mr. Ou finally recognized the reality: his coins had likely been lost or stolen…

Subsequently, after much confusion, Mr. Ou discovered (either through self-investigation or guidance from an expert) that someone had transferred all of his cryptocurrency away a month prior.

A Successful Criminal Complaint Driven by Multiple Parties

Through analyzing the wallet developed by Platform H (the Sa Jie team believes that at this point, relevant staff from Platform H may have already been involved, helping the victim to query and preserve the platform's internal data), Mr. Ou noticed that there was a "backdoor" program in his wallet that could automatically obtain private keys. Later, Mr. Ou used technical means to analyze this "backdoor" program and traced it back to suspicious suspect information. In August 2023, Mr. Ou went to the police station with the collected and preserved evidence to file a criminal complaint, successfully initiating a case. A few days later, the criminal suspects, Liu, Zhang 1, and Dong 2, employees of H Company, were successively brought to justice.

According to judgment (2024) Hu 0104 Criminal First 59, defendants Liu, Zhang 1, and Dong 2 were two senior front-end developers at Platform H, responsible for the development of the iToken wallet. From March to May 2023, Zhang 1 and Dong 2 developed the intent to "steal from within" and reached a criminal agreement with Liu, deciding that Zhang 1 and Dong 2 would implant a "backdoor" program in the iToken wallet in advance to illegally obtain others' wallet private keys, mnemonic phrases, and other data, which would then be uploaded to a pre-built VPS backend server database corresponding to a designated domain name, and subsequently downloaded to a local server. The specific division of labor among the three was as follows:

(1) Liu was responsible for writing the request logic code;

(2) Defendant Zhang 1 was responsible for building the VPS and database, and uploading to the iToken Android version;

(3) Defendant Dong 2 was responsible for purchasing the domain name, encrypting user private keys, and uploading to the iToken iOS version.

According to the judgment, the three illegally obtained a total of 27,622 mnemonic phrases and 10,203 private keys from iToken wallet users (data deduplicated), successfully converting these mnemonic phrases and private keys into a total of 19,487 digital wallet addresses (data deduplicated). As for how much cryptocurrency was in these wallets and their value, the judicial authorities did not disclose.

Cautious Trio Set a "Two-Year Agreement"

Liu, Zhang 1, and Dong 2 admitted in their statements that at the end of May 2023, driven by the beautiful aspiration of "earning a living while spending it," they decided to properly preserve the user private keys and the corresponding digital wallet addresses after obtaining them, and to destroy the server and database, agreeing that they could only use these private keys to illegally obtain users' virtual currency two years later.

However, strangely, after being brought to justice, all three swore that they had not violated the "two-year agreement" by stealing users' cryptocurrency in advance.

So, was there someone in the gang who secretly turned against them while pretending to be innocent? Or were there other criminals involved?

A Twisted and Bizarre Case Within a Case

According to public information, the prosecutor handling the case discovered clues during the questioning of the criminal suspects and reading the case files, suggesting that the true criminal suspect who transferred the victim's millions of cryptocurrency was someone else.

It turned out that in another wallet used by victim Mr. Ou, a backdoor program had also been implanted by Zhang 2, who had previously worked at Platform H, with criminal behavior mirroring that of Liu, Zhang 1, and Dong 2.

After being brought to justice, Zhang 2 confessed that in July 2021, he used his professional knowledge and position to write a piece of code in the client-side code to collect user private keys and mnemonic phrases. When users traded virtual currency, the code would automatically obtain the mnemonic phrases or private keys used for signing operations and send them to Zhang 2's email.

In April 2023, Zhang 2 transferred all the cryptocurrency from Mr. Ou's wallet to his own wallet address using the illegally obtained mnemonic phrases and private keys. It was identified that Zhang 2 had illegally obtained over 6,400 user private keys and mnemonic phrases.

Ultimately, the Xuhui District People's Court in Shanghai sentenced Liu, Zhang 1, and Dong 2 to three years in prison for illegally obtaining data from computer information systems, and all three were fined 30,000 yuan. Meanwhile, Zhang 2, who actually stole the victim's millions of cryptocurrency, compensated the victim for part of the loss, obtained the victim's understanding, and confessed to his crime. He was ultimately sentenced to three years in prison and fined 50,000 yuan for illegally obtaining data from computer information systems by the Xuhui District People's Court.

Insiders "Heavily Lifted" and "Lightly Placed"?

According to the publicly available judgment from the Xuhui District People's Court in Shanghai, Liu, Zhang 1, Dong 2, and Zhang 2, who actually stole the victim's millions of cryptocurrency, were all sentenced to three years in prison for illegally obtaining data from computer information systems. However, there is controversy over whether this charge is appropriate.

Discrepancies in Judicial Authorities' Views and Attitudes Towards Cryptocurrency Assets

The Sa Jie team conducted case searches and data analysis on the China Judgments Online. Since 2018, there have been approximately 60 publicly available criminal judgments related to cryptocurrency assets by judicial authorities in our country that are worth referencing. There are two distinct viewpoints in our courts regarding the characterization of cryptocurrency assets and whether they can be the object of property crimes.

1. Cryptocurrency assets are not property. Judges holding this view believe that according to the definition of "property" in traditional civil law of the continental legal system, "property" must be tangible, and intangible assets like cryptocurrency cannot be the object of property crime cases. [Reference cases: (2023) Hu 0106 Criminal First 112, (2020) Min 0305 Criminal First 82, (2019) Su 1282 Criminal First 227, etc.]

2. Cryptocurrency assets are property. Judges holding this view believe that although cryptocurrency assets are data, they possess the core attributes of property and have certain value, thus should be considered property. Therefore, they fall within the protective scope of criminal law and can be the object of property crimes. [Reference cases: Supreme People's Court Criminal Trial Reference No. 138, (2021) Jing 0105 Criminal First 1302, (2021) Hu 0109 Criminal First 750, etc.]

The Sa Jie team found that among the judges who hold the view that "cryptocurrency assets are not property," most believe that cryptocurrency assets are a form of "data," and that the act of stealing or otherwise infringing upon cryptocurrency assets is essentially modifying, deleting, or destroying computer information or illegally obtaining data from computer systems, which should be prosecuted as crimes of illegally obtaining data from computer information systems.

However, in recent years, with the advancement of technology and the evolution of judicial concepts, the viewpoint that "cryptocurrency assets are not property" has gradually decreased, and a large number of cases have essentially recognized that cryptocurrency assets possess property attributes and can be the object of property crimes.

For example, in the fraud case of Feng (case number 2023-04-1-222-006) included in the People's Court case database, it is clearly stated in the judgment that "virtual currency has property attributes in the sense of criminal law and can be the object of property crimes."

Inability to Properly Evaluate the Crimes of the Four Individuals for Illegally Obtaining Data from Computer Information Systems

Returning to the case of the million-dollar cryptocurrency theft, the Sa Jie team believes that the court's recognition of the property attributes of cryptocurrency assets in this case differs from mainstream views and that there is insufficient understanding of the suspects' actions.

The so-called "crime of illegally obtaining data from computer information systems," according to Article 285, Paragraph 2 of our Criminal Law, refers to the act of violating national regulations, invading computer information systems other than those specified in the previous paragraph, or using other technical means to obtain data stored, processed, or transmitted in that computer information system, or illegally controlling that computer information system.

The Sa Jie team believes that cryptocurrencies like Bitcoin meet the characteristic requirements of "property" in criminal law. Professor Zhang Mingkai argues that property in the sense of criminal law should meet three aspects of characteristics: manageability, transferability, and value. Manageability refers to the victim's ability to manage, i.e., the victim's right of possession or ownership over the property; transferability refers to the ability of the perpetrator to transfer the victim's property; and value refers to the property having both use value and exchange value.

With the advancement of blockchain technology and its derivatives, cryptocurrency assets have actually acquired the characteristic requirements of "property" in criminal law, which is also why, in current judicial practice in our country, cryptocurrency assets are regarded as objects of property crimes.

Occupational Embezzlement More Accurately Evaluates Their Criminal Behavior

In fact, this case can be classified as either theft or occupational embezzlement, and the Sa Jie team believes that convicting them of occupational embezzlement would more accurately evaluate the subjective intent and objective actions of the four defendants.

According to Article 271 of the Criminal Law, occupational embezzlement refers to the act of personnel from companies, enterprises, or other units illegally taking possession of property belonging to their unit for personal use in significant amounts.

Liu, Zhang 1, Dong 2, and Zhang 2 were all former employees of Platform H, and during their tenure, they illegally obtained others' property by using their positions to implant "backdoor" programs in user wallets to ultimately steal users' cryptocurrency assets.

Some may argue that since users store cryptocurrency in wallets, can this constitute "property of the unit" as defined in Article 271 of the Criminal Law? In fact, users storing funds in the wallet developed by H Company creates a legal relationship similar to custody or safekeeping. In other words, the "property of the unit" as defined in Article 271 of the Criminal Law not only refers to property owned by the unit but also includes property held by the unit, meaning that property owned by others but under the unit's possession and management should also be regarded as property of the unit. There are already cases supporting that employees stealing user property held in trust by the company constitutes occupational embezzlement.

For example, in judgment (2014) Lujiang Criminal First No. 00287, a courier employed by a company mistakenly took six Xiaomi 3 smartphones that did not belong to his delivery area while picking up sorted packages at the Hefei branch. However, he neither delivered the package to his unit nor to the recipient, keeping it for himself. The court ultimately ruled that he constituted occupational embezzlement.

It is worth mentioning that based on the amount involved in this case, occupational embezzlement has three sentencing ranges: imprisonment of less than three years, imprisonment of three to ten years, and imprisonment of more than ten years or life imprisonment, which is much heavier than the crime of illegally obtaining data from computer information systems (maximum seven years). According to relevant judicial interpretations, the amount involved in Zhang 2's occupational embezzlement has reached the "huge amount" standard, and if the amounts obtained by the four individuals are added together, the total amount of funds involved could reach an immeasurable level.

In Conclusion

The Sa Jie team believes that this million-dollar cryptocurrency theft case not only reveals the complexity and risks in the field of cryptocurrency assets but also exposes the discrepancies in our country's legal characterization of cryptocurrency assets. Although the judicial authorities successfully solved the case in cooperation with Platform H and recovered part of the victims' losses, the controversy over conviction and sentencing highlights the necessity for the law to keep pace with the times. With the development of blockchain technology and the increasing maturity of the cryptocurrency market, we look forward to future laws being able to more accurately define the legal attributes of cryptocurrency assets, providing clearer and more unified guidance for judicial practice.