Three million yuan in the company's accounts was transferred by the finance staff, acting on the instructions of the actual controller, to the controller's personal bank card, and was then used to purchase Bitcoin through a personal trading account.The employee responsible for technical operations created the wallet and completed the transfer of the coins as instructed, but the mnemonic phrase ultimately remained in the sole possession of the actual controller; internally, the company neither registered the wallet address nor established any multi-person approval or backup mechanism.
Six months later, the price of Bitcoin fell, and the actual controller withdrew from the company's operations. Only then did the other shareholders discover that the company had not only failed to adopt a complete investment resolution, but that its financial books recorded only an outward transfer of funds with an unclear purpose, and that the company was unable even to independently query, control or transfer the Bitcoin in the wallet.
Was this simply a failed corporate investment, or did someone, in the name of "investment," dispose of company assets without authorization?What liability, respectively, should be borne by the actual controller who proposed the coin-purchase plan, the finance staff responsible for the transfer, and the employee who carried out the wallet operations?
In cases of this kind, it is first necessary to distinguish between two entirely different types of "loss": one is where the Bitcoin still belongs to the company and only a book loss has arisen from a decline in market price; the other is where, although the assets remain on-chain, the company is no longer able to obtain the mnemonic phrase, determine where the assets go, or require the relevant personnel to complete a handover.
The former primarily concerns investment decisions and corporate governance, whereas the latter may further fall within the scope of review for criminal risks such as misappropriation of funds and occupational embezzlement.
A one-off corporate purchase of coins is not automatically equivalent to operating a virtual currency business
In February 2026, the People's Bank of China and seven other departments issued the Notice on Further Preventing and Addressing Risks Relating to Virtual Currencies and Related Matters, again making clear that Bitcoin, Ether(), Tether and other virtual currencies do not have the same legal status as legal tender; within the territory, conducting exchanges between legal tender and virtual currencies, exchanges between virtual currencies, token issuance and financing, and providing information intermediation, pricing and other services for virtual currency transactions constitute illegal financial activities and are strictly prohibited in accordance with the law. (People's Bank of China)
A one-off purchase by a domestic company using its own funds should not be mechanically equated, in terms of conduct patterns and liability assessment, with the long-term provision of exchange, matching, payment or transaction intermediation services to customers.The former primarily concerns how a company disposes of its own assets, whereas the latter may directly give rise to risks of illegal financial business and illegal business operations.
However, “not suitable for mechanical equivalence” does not mean that a company using its own funds to purchase Bitcoin has already become an asset allocation path recognized by regulators. In actual practice, a company may still face multiple risks, including trading channels, payment settlement, civil validity, financial booking, tax treatment, and asset custody.
In particular, when a company cannot complete a transaction through its own accounts and systems and must transfer funds into a personal bank card, personal trading account, and personal wallet, the issue is no longer merely “whether it can buy coins,” but whether the company can prove that the funds used to purchase Bitcoin were genuinely authorized, that the purchased assets have entered the company’s books, and that they have always remained in a state the company is able to control.
Can a single oral instruction from the actual controller represent the company in making an investment decision?
In some small Web3()companies, the founder, legal representative, and actual controller are often the same person, and day-to-day operations are habitually decided through WeChat groups, oral arrangements, or private chat messages.
However, “the boss decided to buy coins” does not necessarily equal “the company has made a valid investment decision.”
The current Company Law provides that a company has independent legal person property, and the company’s articles of association are binding on shareholders, directors, supervisors, and senior management; directors, supervisors, and senior management owe duties of loyalty and diligence to the company, and although an actual controller does not serve as a director, if the actual controller actually executes company affairs, the corresponding duties should also apply. The law also clearly provides that relevant persons may not misappropriate company property, misappropriate company funds, or deposit company funds in accounts opened in an individual’s name or another person’s name. (Shandong Provincial Court)
Whether an investment should be decided by the shareholders’ meeting, the board of directors, a company director, or the manager needs to be determined in light of the company type, the articles of association, existing authorization, and the investment amount. For an investment that occupies a large amount of the company’s working capital, has significant price volatility, and must also be completed through personal accounts, it is usually difficult to fully prove, merely on the basis of a single oral instruction from the actual controller, that all executing personnel obtained lawful and sufficient authorization.
To determine whether a company genuinely made a decision to buy coins, focus may be placed on reviewing the arrangements in the company’s articles of association regarding investment authority, whether there are resolutions of the shareholders’ meeting, the board of directors, or a company director, whether the use of funds underwent financial approval, whether other shareholders and management personnel were aware, and whether the purchased virtual assets entered the company’s asset ledger.
It should be noted that imperfect approval procedures may first give rise to corporate governance, labor discipline, or civil compensation issues, and do not automatically constitute a criminal offense. Criminal liability still requires further proof that the relevant personnel had the intent to use company property without authorization, illegally possess company property, or, while knowing that another person was committing the above acts, still provided substantial assistance.
Why does risk rise rapidly after company funds enter a personal wallet?
Whose wallet the Bitcoin enters does not automatically determine who ultimately owns the asset. If the purchase funds came from the company, the transaction was genuinely authorized, and the purpose of the purchase was to hold the asset for the company, then even if for technical reasons a certain employee or responsible person temporarily operates it on the company’s behalf, the relevant assets may still belong to the company.
The issue is that on-chain addresses are not automatically labeled “this Bitcoin belongs to a certain company.” A blockchain explorer()can only show how many assets a given address received and when transfers occurred; it cannot directly prove who in the real world controls the wallet behind it or the legal ownership of the assets.
If the company has not registered the wallet address, the mnemonic phrase is held only by the actual controller personally, the assets have not been entered into the financial books, other directors and shareholders cannot check the balance, and the company cannot complete transfers on its own, then this so-called “company asset” has in fact already left the company’s effective control.
A more complex situation is where the responsible person subsequently, on the grounds of “adjusting positions,” “participating in DeFi()” or “staking for appreciation,” or “lending to a business partner,” continues to transfer the Bitcoin to multiple addresses. If every on-chain operation lacks company approval, business contracts and reconciliation records, it will be difficult for the company to determine whether the conduct in question constitutes normal investment management or an individual’s unauthorized disposal of company property.
In determining whether the company still controls the assets, four questions should be answered with focus: whether the company possesses complete and accurate wallet addresses; whether it has independent authority to query and transfer the assets; whether any transfer of coins requires company approval; and whether, when the responsible person leaves or changes position, the wallet, devices and keys can be handed over in full.
Whether the company can actually control the assets is more important than who nominally “holds them on behalf of” the company.
Investment losses, internal violations and occupational crimes should be assessed on separate levels
A loss incurred after the company purchased Bitcoin does not necessarily mean that the decision-makers or executing personnel have committed a crime. Commercial investment inherently involves market fluctuations, and criminal law does not guarantee that every corporate investment will be profitable.
What truly needs to be distinguished is whether the conduct in question constitutes a normal investment failure, a breach of internal corporate duties, or has already entered the realm of criminal risk such as misappropriation of funds or occupational embezzlement.
Under the Criminal Law(), where a staff member of a company, enterprise or other unit, by taking advantage of his or her position, illegally takes unit property into his or her own possession and the relevant threshold is met, the crime of occupational embezzlement may be constituted; where such a person, by taking advantage of his or her position, misappropriates unit funds for personal use or to lend to others and the relevant amount, time or use conditions are met, the crime of misappropriation of funds may be constituted. (Shenzhen United Front Work Department)
The two cannot be distinguished simply on the basis of whether the actor claims that he or she 'will repay later.' Investigating authorities will usually also examine whether the company genuinely consented to the purchase of the coins, whether the assets entered the company's books, whether the actor concealed the wallet and balance, whether the actor used the assets for personal investment without authorization, whether the actor refused to complete the handover of keys, and whether the actor had a genuine willingness and ability to repay.
If the Bitcoin remains intact in a company wallet that has been registered, the company can check the balance at any time and can complete transfers through multi-signature, then even if there are defects in the investment approval, the matter is closer to an issue of corporate governance and duties of diligence.
Conversely, if company funds entered a personal account and the Bitcoin purchased was then transferred to a wallet whose address the company does not know and whose mnemonic phrase the company cannot obtain, and the actor further continues to transfer assets or refuses to complete the handover, then even if the actor initially claimed to be 'investing on behalf of the company,' it is still necessary to further examine whether the actor has already formed an intent to unlawfully use or unlawfully possess company property.
The actual controller, finance personnel and wallet operators do not bear responsibility with the same focus
In the same transaction, there are obvious differences in the positions, authority and actual degree of participation of different personnel, and they cannot be assessed in the same way merely because they all work at the company.
Where the actual controller also serves as a director, senior manager or legal representative, he or she may also bear duties of loyalty, duties of diligence and liability for damages based on his or her corporate office. Even if the person is merely a shareholder, he or she cannot arbitrarily transfer company assets into a personal account or personal wallet merely because 'the company is his or her own.'
Finance personnel who fail to carefully verify approvals may violate company rules, but merely 'having executed a transfer' or 'having conducted lax review' is usually insufficient to directly establish the commission of an occupational crime. It is also necessary to examine whether they knew that the actual controller was using or unlawfully possessing company property without authorization, whether they participated in fabricating payment purposes, splitting funds, concealing wallets or subsequent transfers, and whether they obtained abnormal benefits therefrom.
Conversely, if finance personnel merely receive a normal fixed salary, execute payments in accordance with their ordinary authority, did not participate in investment decisions, wallet management or profit distribution, and did not know that the relevant persons were preparing to appropriate company assets, all of these facts should be fully examined in the determination of responsibility.
In a case we previously handled, it was precisely by organizing the evidence around the client's position and authority, the basis for payment, the actual scope of participation, the compensation structure and knowledge of the subsequent flow of assets, and submitting complete defense opinions on that basis, that we ultimately achieved the favorable result of non-prosecution.
As for wallet operators, similarly, they cannot be directly deemed to control company assets merely because they created an address or executed a coin transfer. If they merely provided technical operations in accordance with instructions, did not hold the complete mnemonic phrase, and had no authority to decide where the assets went, their responsibility is clearly different from that of a person who keeps keys for a long period, independently executes coin transfers and participates in concealing assets.
After a dispute arises, the most important thing is not to first calculate the loss in coin price
When shareholder disputes, the person in charge withdrawing from operations or inaccessible wallets have already arisen within the company, the company should not first focus solely on calculating losses based on coin price, and even less should it rush to backdate resolutions, alter accounts or require relevant personnel to align their statements.
First, bank statements, payment approvals, personal trading account records, purchase orders, wallet addresses and on-chain transaction hashes should be secured in order to confirm exactly how much bitcoin the company purchased at the time, whether the assets still exist, and whether any subsequent transfer has occurred.
Subsequently, the relevant personnel should be required to complete the handover of accounts, devices, keys and backup materials, and it should be verified whether the company has the ability to independently control the assets. If the relevant personnel claim that the wallet has been lost, the platform has been shut down, or the assets have been stolen by hackers, further verification of device records, login information, security incident reports and police reports should be conducted.
After confirming the status of the assets, and in light of the company's articles of association, the original approvals, financial booking and actual use, a determination should then be made as to whether the case is a dispute over investment decisions, internal damage to company property, or whether criminal leads have already emerged, such as unauthorized transfer, refusal to return, or fabricated losses.
For the company, proving that "RMB 3 million was invested at the time" is only the first step.More importantly, it must prove how much bitcoin that RMB 3 million purchased, which wallet that bitcoin once entered, who now controls it, and why it cannot be returned to the company.
Lawyer's Observation
Where a company uses funds to purchase bitcoin, the greatest danger is not price volatility itself, but the absence of a closed loop among company decision-making, payment channels, wallet control and financial records.
For an investment that was genuinely authorized and over which the company retained control throughout, even if it ultimately results in a loss, the relevant personnel cannot be found to have committed a crime based on the outcome alone. However, where company funds bypass approvals and enter personal accounts, and the virtual assets purchased are entirely controlled by an individual, the so-called "investment failure" may conceal the unauthorized use of company funds or the unlawful misappropriation of company assets.
A loss incurred by a company from buying coins is not in itself a crime; it is the company's loss of control over the assets that is the key point at which liability may escalate.
For project teams, what truly needs to be established is not a retroactively signed "coin purchase resolution", but a set of systems capable of continuously answering the following questions: why the company is investing, who has the authority to decide, who may transfer funds, how wallet addresses are registered, who holds the private keys, and why no single person can transfer the company's coins away on their own.
/ END.
*This article is an original article of Mankun Law Firm and represents only the personal views of the author. It does not constitute legal consultation or legal advice on any specific matter. For reprinting and legal consultation, please add our customer service: mankunlawyer
