From the seizure of 80 million bitcoin, the criminal risk of “blacking” the virtual currency
Submitted by: Shao Shifu
19 January 2026, according to media reports[i]One network engineer was accused of stealing money from gambling websites and was charged with seizing 183 bitcoins, worth more than $80 million, in two separate police cases。
In January 2026, the case was heard in public at Henan Court。
this is a typical virtual currency & ldquo; black eat & rdquo; criminal case。In practice, similar cases have not been uncommon in recent years, and I have been exposed to and represented too many similar cases in the course of my work。
at the beginning of the case, a number of parties and family members often miscalculated the key issues of “ theft of the virtual currency ” “ whether black consumption constitutes a crime ” “ conviction or not & rdquo; and lack of clarity on the direction of the case, conviction and evidentiary issues, ultimately missing the opportunity to achieve a favourable outcome。
Based on the disclosed information on the case, and in conjunction with the criminal defence practice, this paper focuses on several issues of greatest concern to the person and family:
why “ black eat & rdquo; acts can be pursued
What are the common arguments and defence points involved in such cases
How should the parties and their families respond to the case
1virtual currency &ldquao; black eat &rdquao; basic information on theft
Background:
SHENZHEN IT MALE LI DONG (ALIAS) IS AN INTERNET INFORMATION SECURITY ENGINEER AND UNIVERSITY STUDIES SPECIALIZE IN INFORMATION SECURITY. HE THEN WORKED ON CYBERSECURITY TECHNOLOGY IN A NUMBER OF WELL-KNOWN INTERNET ENTERPRISES AND LATER SETTLED IN SHENZHEN, WHERE HE HAD RECENTLY SET UP AN INTERNET COMPANY。
About 2016, Li-dong started trading shares, coins and some bitcoin. However, the police investigation later concluded that his Bitcoin sources were different。
By capture:
in may 2024, the zhang family police relied on &ldquao; anonymous reports &rdquao; and leads to the inclusion of li dong as a suspect. subsequently, the zhang jiabong city public security bureau summoned li dong on suspicion of opening a casino and seized 103 bitcoin from his digital wallet, which was then converted to more than $4.961 million. later, li dong was placed on bail。
it was only four days since the bail was released from trial, and li dong was taken away by the governor of henan, the gae city public security bureau. according to the media, this was due to the reported &ldquo by a gaming officer of the age of zhang gu; the &rdquao sports campaign; and the gambling website, which li suspected was linked to. henan police seized 80 bitcoin (market value over $40 million), after which li dong was arrested by henan police。
(Source: Same)[i]I'm not sure
Alleged facts:
it was reported that li took advantage of the procedural loopholes on the web-based gambling server outside the country, stole technical information about more than 1.84 million chinese citizens on the gambling website, and took a high percentage of and offline proxy accounts from the agent accounts on the gambling website, replacing the bank accounts of those agents with bank accounts under their control, stealing & ldquo; and the commission funds of the agent on the gambling website。
Change of offence:
As the case progressed, Li Dong ' s charges changed several times:
Zhang's police opened an investigation into his online gambling case, but later changed his charge toCrime of illegal access to computer information systems dataI don't know。
Zhang Guo City Public Security Bureau is holding Li Dong in criminal custody for the crime of opening a casino, but since then the Zhang Guo City Public Prosecutor's Office is suspectedTheftOffences against the personal information of citizensLi Dong was prosecuted。
2Common features of such virtual currency theft cases
It is a high-technology threshold, highly hidden, non-contact crime。
There have always been many criminal cases represented by lawyers with similar backgrounds to those of Li Dong, mostly highly educated and skilled persons with master ' s degrees and even doctoral degrees. They are very familiar with their profession, but when it comes to legal risks, there is often a clear lack of awareness or a sense of luck, thus underestimating the possible consequences of behaviour。
For example, as a cyber-information security engineer, the theft of the virtual currency of the gambling website was carried out precisely on the basis of its technical advantage, which is more familiar with the block chain technology, and its legal misperception。
according to the facts of the above-mentioned case, using procedural loopholes on the web-based gaming website servers outside the country, it stole by technical means the personal information of citizens of the gambling website, and screened from the gambling website the accounts of agents with a high rate of return and a high number of downlines, replacing the bank accounts of those agents with bank accounts under their control, thus achieving the purpose of stealing “ the money of agents returning to commission on the gambling website。
Well, Li Dong may..What are the possible technical means
FIRST, HE NEEDS TO IDENTIFY GAPS IN WEB SERVERS, DATABASES OR PROXY MANAGEMENT BACKSTAGES, SUCH AS SQL INJECTIONS, LOGICAL DEFICIENCIES, UNAUTHORIZED ACCESS, ETC。
Secondly, he needs the capacity to process and analyse large-scale data. This may be achieved through technical means such as the export of databases using loopholes, the interception of web-based data packages, and the capture of management backstages。
thirdly, in order to reach its “ to select an agent account with a high percentage of returned domestic workers and a large number of downlines; in order to maximize benefits, he needed to screen the agent account, and he therefore needed a thorough understanding of the core business logic of the gaming web site, the rules for calculating return domestic workers, the flow of funds, etc。
Finally, the replacement of the agent ' s returnee account with his own account requires him to know about the bank card validation, binding process, and may use system loopholes or social engineering to circumvent security verification (e.g. SMS verification, face recognition)。
The question then arises: is it still illegal for Li Dong to acquire money that is not the legitimate property of others, but is illegal money on gambling websites? Why should they be held criminally responsible
3Why are you still being blamed for stealing the virtual currency of gambling websites
1. Virtual currency, unprotected gambling and why theft may still constitute a crime
Virtual currency, because of its characteristics such as anonymity, is widely used as a tool for money-laundering and the transfer of stolen funds such as criminal funds. In particular, among gambling sites, support for virtual currency access has gradually become the basic configuration of a large number of gambling sites。
The lawyer who had previously represented a district chain game was charged with the offence of opening a casino because the acting friend (gatherer) had been sued in court for financial loss and the court referred the case to the public security authorities。
In fact, most people know that if they are found guilty of gambling and the opening of casinos, the money is usually forfeited and the money is not protected by law。
it is against this background that, along with long-standing policy advocacy, “ virtual currency cannot be equated with french currency ” virtual currency transactions are not protected by law ” and so on, it has gradually become &ldquo in the minds of many; common sense &rdquo。
Thus, in cases involving virtual currency-type theft, fraud, illegal access to computer-based information system data, etc., many parties have a typical error zone:
Since the virtual currency itself is not protected by law, the virtual currency of others is appropriated for itself, and the other party is unable to defend its rights even if he or she reports it; it is even more unlikely that the law will criminalize it。
why “ black eat & rdquo; still criminally liable
the so-called “ black-eating & rdquo; in cases where the property in question is often of unlawful origin, such as gambling, stolen money, etc. the state has, of course, the right to pursue and confiscate them in accordance with the law。
This does not mean that any person can take possession of these property by committing a new criminal act。
if the perpetrator uses violence, threats, deception, intrusion systems, etc. to seize funds under the control of others, this constitutes a new, independent offence. the penal code does not regulate only &ldquao; property belonging &rdquao; and, more importantly, the protection of the social order。
Thus, in the present case, even if Li Dong obtained funds from gambling websites, his actions may constitute a crime and be held criminally liable under the law。
It should be stressed, however, that this does not mean that the judicial determination of the facts of the case, the choice of the charges and the calculation of the amount involved are necessarily not contested。
On the contrary, such cases tend to have more contentious space and are the focus of the efforts that lawyers can make when they intervene. The reasoning of the defence will be continued below。
4What are the key defences in virtual currency theft cases
I. JURISDICTION AND PROGRESSIVE LAW Enforcement
In the circumstances of this case, as disclosed by the media, the family raised the issue of the possible existence of territorial jurisdiction and consumable law enforcement in the case of Li as a result of his long-term residence in Shenzhen and his presence in Hunan and Henan, respectively, as well as his seizure and the realization of the amount of more than $80 million in bitcoin involved。
However, since I am not the lawyer representing the case, nor have I consulted the case file materials, it is not appropriate to make a speculative judgement on the case without complete information, and this part is not pursued。
However, only in the light of the prevalence of cases involving Web3 and virtual currency cases, among the many cases contacted and processed by Shao lawyers, there are & ldquo cases in which there is a positive state of law enforcement; &rdquo, a disaster-prone area; and a reality that cannot be avoided in such cases (relationship:Brief discussion of the phenomenon of profitable law enforcement in currency-related crime casesI don't know。
At the same time, with regard to where the case should be governed, in cases involving cybercrime and virtual currency, the issue is also the focus of frequent controversy (relationship reading:A different sentence? A study of "geographical jurisdiction" in criminal casesI'm not sure
However, family members of criminal cases should be reminded that, even if the above-mentioned dispute exists, if the case continues to be pursued by the authorities, it will be more crucial for defence counsel to return to the case itself and to find a truly valuable space for defence in terms of evidence, facts, charges, etc。
in such cases, the defence is often not exhaustive. idquo; guilt or innocence & rdquo; rather, it falls on several core issues: how the virtual monetary nature is determined, whether the offence is properly applied, whether the data in question meet the criteria for incrimination, and whether the amount involved is supported by complete evidence. these issues directly determine the course of the case and have a direct bearing on the final outcome。
Taking into account the common features of such cases, the reasoning for the defence can generally be developed in the following areas。
2. Virtual currency is data or property? Impact of different convictions on charges
This is an almost inevitable problem for lawyers when dealing with cases involving virtual currency theft, fraud, misappropriation of office, illegal access to computer information system data, etc。
because the virtual currency is recognized as “ data ” or “ property ” the offence of direct impact is applied, thus affecting the sentence that the person may face。
The maximum legal penalty for the offence of illegal access to computer information system data in the case of large amounts of money involved isSeven yearsThe maximum statutory penalty for theft, fraud and misappropriation may be metLife imprisonmentI don't know。
In judicial practice, however, there is still considerable disagreement over the determination of the nature of the virtual currency, and it is not uncommon for different cases, different regions and different case handlers to have different convictions。
It is precisely in such cases that it is important for lawyers to be able to play their role and to seek an effective space for their defence。
Is it reasonable to impose both the offence of theft and the offence of violating citizens' personal information
The Public Prosecution Service is currently prosecuting Li Dong on suspicion of theft and violation of citizens ' personal information。
However, in the light of the circumstances of the case, Li’s direct purpose in obtaining the relevant information was to screen agency accounts with a high rate of return to domestic service and a high number of downlines, thus enabling the acquisition of funds for return to domestic service on gambling sites。
In this context, counsel argues that his information is more in line with the pre-eminence and necessary means of carrying out the theft, and that it should be evaluated as a whole rather than being mechanically divided into two separate offences。
LI DONG FOCUSED ON AND OBTAINED, MAINLY, OPERATIONAL DATA FROM PROXY ACCOUNTS (E.G. ACCOUNT ID, PERFORMANCE, ETC.), THE CORE PURPOSE OF WHICH WAS TO SCREEN THE TARGET RATHER THAN TO ACQUIRE CITIZEN PRIVACY. A LARGE AMOUNT OF PERSONAL INFORMATION (E.G. MOBILE PHONE NUMBER, ADDRESS OF ORDINARY GAMBLERS) UNRELATED TO THE PURPOSE OF THE THEFT MAY HAVE BEEN OBTAINED INCIDENTALLY AT THE TIME OF BULK EXPORT, REFLECTING THE CRUDENESS OF THEIR CRIMINAL INSTRUMENTS AND NOT THE SEPARATE AND INDEPENDENT INTENT TO VIOLATE CITIZENS ' PERSONAL INFORMATION。
While it was technically possible to operate separately, legal evaluation should focus on the subjective plans and overall course of conduct of the perpetrator. A process of browsing, analysing and extracting relevant data for the purpose of theft should be considered as an overall evaluation of a continuous criminal process under criminal law, and artificial dismantling is a mechanized understanding of complex crimes。
If the prosecution intends to prove the existence of two separate crimes, it is necessary to prove that:
-
when li dong invaded the system, he was carrying &ldquao; stealing and selling data; two clear and separate intentionsWhat? Can the available evidence (e.g., its correspondence records, chat content) prove its intent to sell or to use alternative data? If that is not possible, it should be presumed that all acts serve a general intent。
-
Whether the 1.84 million pieces of information involved were actually used in situations unrelated to theft(e.g., for sale, supply, other fraud, etc.) if the prosecution can only prove “ the information has been obtained ” it cannot prove “ the information has been used independently ” then the information is always a tool and component of the crime of theft, not the fruit of an independent crime。
4. Sufficient quantity of citizen ' s personal information to establish guilt
A conviction and sentence in a criminal case must be based on proven evidence. Even if the court were ultimately found guilty, there would still be light relief for the defence against the relevant data。
with regard to offences against citizens ' personal information, the criminal code and the relevant judicial interpretations refer to “ citizen ' s personal information ” the criteria for identification are stricter and not all data can be considered as personal information of citizens within the meaning of criminal law。
A previous case by a lawyer in which a company had been charged with an offence against a citizen ' s personal informationUp to 500,000however, after a comparison of the data by the lawyer, it was found that much of the data did not meet the criteria for recognition in the criminal law sense of “ citizen ' s personal information &rdquo. on this basis, counsel expressly submitted to the prosecutor that the additional investigation should be returned and requested that the data be re-checked in accordance with the relevant identification criteria。
Following a re-evaluation and review, the public security organs have finally confirmed that the number of information capable of meeting the criteria for incriminating has failed to meet the 5,000 required by the criteria for filing a case, that the case has been dropped in accordance with the law and that the person concerned has not been held criminally responsible。
So back to the case, if “ 1.84 million messages Rdquo; a large number of items are only data on the website account number, note record, IP address, equipment information, etc., and the lack of key elements such as a direct identification of a particular natural person ' s name, ID number is in conformity with &ldquo in the meaning of criminal law; citizen ' s personal information ” there is also considerable controversy。
His defence counsel also stated that, following the intervention of the police, the mobile hard drive that stored the information was not sealed; that there were traces of numerous modifications to the electronic data; and that the view that many of the personal information in question was incomplete, such as personal information, made it an important point to dispute whether the electronic data in question could be used as evidence of conviction and sentence if the evidence was obtained in violation of due process。
Are all 5, 183 bitcoins stolen? Sources of amounts involved and chain of evidence review
According to media reports, according to his family, Li Dong started selling and owning bitcoin around 2016. Whether the 183 bitcoins seized by the police were all derived from the proceeds of their gambling website and whether there was sufficient chain of evidence to prove them was also the focus of the trial。
In the media reports, it is not clear whether the money stolen by Li Dong for the return of a gambling agent is a renminbi, a BTC or a stable currency such as USDT tada. The report refers only to stolen funds & ldquo; more than $6.44 million transferred to the purchase of 13 bank cards & rdquo; and & ldquo; the purchase of virtual currency such as bitcoin by a group。
As can be seen from this statement, the funds involved, when they enter their control, have undergone at least multiple conversions between French and virtual currency; if they also involve the purchase of bank cards, the use of cold wallet addresses, the borrowing of third-party accounts, etc., the financial link will be further lengthened and complicated。
on the other hand, according to the reports, the judicial authorities eventually seized bitcoin directly from li dong. the key question then becomes: which of these bitcoins seized can form a complete chain of evidence to prove that they are derived from the return funds of gambling websites? what could be the same as their early currency holdings, normal transactions, etc.? this has to be done by the investigating authorities, on a case-by-case basis, and cannot be based solely on “ the currency is withheld ” it is directly presumed to be “ all stolen &rdquo。
In the currency-related cases handled by Shaolin lawyers, in order to ascertain the origin of each fund and its destination, to verify that the chain of evidence relating to the amounts alleged by the investigating authorities is closed, the Shaolin lawyer ' s team usually carries out cross-checks between the money chain and the data on the chain and produces a chart of the financial flows (see figure below). Since parties often involved multiple cold wallet addresses and frequently used third-party accounts, each address and every transfer required individual verification。
(Part of the funds drawn up by the team of lawyers representing a case are on the chart)
The workload is enormous and often requires several weeks. But it is also through this type of cross-checking that it is possible to find more intuitively whether the amount of the prosecution ' s allegations can really be supported by the integrity of the chain of evidence, or whether there are issues such as breakpoints, regroupments, and expanded calculations。
In addition to this, there is a need to check the calculation methodology, the sources of evidence and the basis for the conclusions, taking into account the audit reports, forensic opinions, etc. that may be found in the case files, and to further determine whether the conclusions are reasonable。
5At the end
It is hoped that this paper will be used as a wake-up call for those who are suffering from similar problems. After all, the level of awareness and the capacity of the public security authorities to handle cases involving virtual currency are constantly increasing。
once involved, such cases tend to involve technical problems and a large amount of chain data, are more specialized and complex, and, once found guilty, tend to involve particularly large amounts of money, and the perpetrator may face imprisonment for more than 10 years. therefore, &ldquo should not be held hostage; &rdquao would not constitute a crime; “ insufficient evidence to identify &rdquao; blind optimism should be given high priority and the assistance of professional criminal lawyers should be sought in a timely manner。
[i] Network engineers are accused of stealing money from gambling websites, with 183 bitcoin_special case _news_The Paper https://www.thepaper.cn/newsDetail_forward_32414856
Special declaration: This is an original article by Sakashi and represents only the personal views of the author of this paper and does not constitute a legal advice or opinion on a particular matter。
