At the end of September this year, the Ministry of State Security published an article on its official WeChat account, noting that if a private key is kept by an individual, it is the sole credential for controlling virtual assets, and there is no channel for reporting it lost or recovering it; once the private key is lost, leaked, or stolen, the holder will lose control over the virtual assets.
Indeed, whoever obtains the private key is 'able' to move the coins; but being 'able' to move them and having the 'right' to move them are two different things.
On seeing the title, everyone's first reaction may be occupational embezzlement, but in practice this still requires analysis of the specific circumstances:
Can the embezzled virtual assets be characterized as 'property of the entity'?
On June 9, 2025, the Supreme People's Court released typical criminal cases promoting the development of the private economy, one of which was the case of Shi Mouyu for accepting bribes as a non-state functionary and occupational embezzlement.
Shi Mouyu was an employee of a certain online network technology company. From June to December 2016, in the virtual currency business carried out by the company in cooperation with another company, he took advantage of his position to convert part of the virtual currencies into cash through multiple company accounts and transfer the proceeds into personal bank accounts under his control, unlawfully possessing 3.66 million yuan of company property. The Beijing Haidian District People's Court sentenced him at first instance to six years for occupational embezzlement and nine years for accepting bribes as a non-state functionary, and, after joinder of punishments for multiple crimes, decided to execute twelve years, while also ordering him to return and compensate 3.66 million yuan.
He appealed, and the Beijing First Intermediate People's Court ruled to reject the appeal and uphold the original judgment.
In its analysis of the case, the Supreme People's Court stated: he 'misappropriated the property of his entity by converting virtual currencies into cash, infringing the property rights and interests of a certain network company.' Virtual currencies in a company's accounts are 'property of the entity'; this is currently the most direct official position.
However, there is another view: a theoretical article published on the official website of the Supreme People's Procuratorate in January 2023, entitled 'Accurately Characterizing Crimes of Illegally Obtaining Virtual Currency with Typological Thinking,' set out three approaches in practice: some case-handling authorities tend to characterize the conduct as the crime of illegally obtaining computer information system data, so as to avoid the dispute over whether virtual currency is property under criminal law; some advocate handling it as the crime of destroying computer information systems, indirectly addressing the problem of excessively light sentencing; and still others treat it as traditional theft, but face the difficulties of excessively heavy punishment and inconsistent standards for calculating the amount involved. The position of the article is that the criminal-law nature of virtual currency cannot be determined in a one-size-fits-all manner and must be judged concretely in light of the form of the carrier, the type of function, the application scenario, and the manner of realizing value.
Therefore, the first thing to determine is what these virtual currencies count as in this case. If they are treated only as data, they may be unrelated to property crimes and fall within computer-related crimes; however, in practice there are also numerous judgments characterizing the conduct as theft. The two paths coexist, which is precisely why characterization must come first.
Does the actor have lawful official authority to dispose of the coins?
The crime of occupational embezzlement under Article 271 of the Criminal Law presupposes 'taking advantage of one's position.'
This virtual currency was already within the scope of your authority, and a signature from you would have been enough to transfer it out; or were you merely in this position, close to it, and able to reach it? Familiarity with the environment and convenient conditions facilitating access to property arising from one's work relationship do not constitute an 'employment-related convenience.'
The former is called an 'employment convenience,' while the latter is called a 'work convenience'; merely exploiting a work convenience does not constitute the crime of occupational embezzlement.
Qualitative distinctions across four categories of practical scenarios
I. Custody of multi-signature private keys under formal authorization, or responsibility for asset transfers.
Finance heads, co-founders, and operations personnel who manage wallets all fall into this role.
Their defining feature is that even if they had not transferred the coins out that day, they would have had the authority to transfer them out in the first place, which comes closest to occupational embezzlement.
However, if the funds were only used temporarily with an intent to return them, the conduct may still be characterized as the crime of misappropriating funds, which is a lighter tier.
II. Technical personnel acting beyond their authority.
Operations and maintenance staff, developers, and auditors hold no authorization to dispose of assets; they rely on system permissions, vulnerabilities, backdoors, or backups they privately retained.
They have no authority to dispose of the assets, only the technical ability to access them, and mere technical access does not fall within 'exploiting an employment-related convenience,' so it does not constitute occupational embezzlement.
Private keys and mnemonic phrases obtained by intruding into systems or through other technical means may fall under Article 285, Paragraph 2 of the Criminal Law, the crime of illegally obtaining computer information system data.
The value of this direction lies not only in its 'leniency' but also in its statutory maximum penalty. Under Article 285, Paragraph 2, where the circumstances are serious, the penalty is not more than three years; where the circumstances are especially serious, the penalty is not less than three years and not more than seven years. Under the judicial interpretations of the Supreme People's Court and the Supreme People's Procuratorate, illegal gains of 5,000 yuan or more, or economic losses of 10,000 yuan or more, meet the threshold, and five times that amount constitutes 'especially serious circumstances.' Although the threshold is low, the seven-year ceiling is also low. Whether 100,000 or 10 million was transferred out, the maximum is seven years, far lighter than the crime of theft.
3. During the handover period upon departure, a private key file was found on an old computer.
It does not look like "taking advantage of one's position"; the person had already left the company. Nor does it look like "technical intrusion"; the file was already in his possession. At this point, it is most readily categorized as "secret theft," that is, the crime of theft.
However, the question is whether he remained in an authorized status after leaving. If the company did not complete the handover when he departed, did not revoke his permissions, and still had him "holding the assets on behalf of the company" on the books, then it can be argued that this was not "secret theft."
4. Customer service or operations staff direct client transactions to wallets designated by themselves or by acquaintances.
In characterizing this category, the first question is "whose account the money entered first": if client funds first arrived in the company account and were then transferred out by him, the funds involved are the company's money, a typical path of occupational embezzlement; if the client, at his instruction from the outset, paid the money directly into a wallet he designated and the money never entered the company account at any point, the nature is more akin to diverting business into one's own pocket, and whether this can be established as a crime is itself disputed.
In addition, if during the process he also accepted benefits from clients or third parties, this would separately give rise to the crime of accepting bribes as a non-state functionary, with punishment for multiple crimes combined.
Four core facts that should be clarified once a case is involved
1. What these virtual assets are.
Are they "property of the entity" or "computer information system data"? This single determination decides whether the case proceeds as a property crime or a computer crime, and the maximum penalties under these two pathways differ greatly.
2. Is there any documentary evidence proving "authority to dispose"?
This directly determines which sentencing bracket applies: occupational embezzlement involving a "relatively large amount" carries a term of not more than three years, while a "particularly huge amount" carries a term of not less than ten years.
Do not expect to explain "I was originally authorized to deal with it" by word of mouth; it must be shown through job descriptions, permission records, approval workflows, multisignature lists and signature records.
Specifically, this includes job responsibility clauses, records of permission activation and revocation, signature nodes in approval workflows, the list of signatories and signature history for multisignature wallets, and handover forms upon departure; such materials are most vulnerable to after-the-fact supplementation: permissions can be suspended at any time, but records that are missing cannot be restored once lost, so the earlier they are preserved, the better.
III. What has been left on-chain and in the systems? Do not assume that the on-chain environment is anonymous and that nothing can be done about you.
On-chain transaction records, together with device identifiers, network IP addresses, and other traces left through fiat currency exchange, trading platforms, and payment interfaces, may all be used to trace the actual user behind a wallet address. Do not harbor any false hope.
IV. The order and timing of restitution and compensation, voluntary surrender, and pleading guilty and accepting punishment.
Voluntary surrender is a statutory circumstance for leniency; pleading guilty and accepting punishment carries statutory leniency; restitution of illicit gains and compensation directly affect sentencing:
For voluntary surrender, the most typical scenario is voluntarily appearing before the authorities and truthfully confessing after the crime but before being questioned or subjected to compulsory measures; for restitution of illicit gains and compensation, it is best to complete them before public prosecution is initiated, and the earlier the better; for pleading guilty and accepting punishment, it is best to wait until the lawyer has reviewed the case file and clarified the nature of the coins and the amount bracket before signing, because signing too early may lock in both the dispute over characterization and the amount bracket.
Lawyer's Observations
I. Genuine disagreements over characterization exist in this type of case. The handling paths in practice are not uniform: for the same act of taking another person's coins, some cases are characterized as occupational embezzlement, some as the crime of illegally obtaining computer information system data, and some are prosecuted as theft. Therefore, the first task is to determine the nature of the virtual assets in the case.
II. The documentary evidence in hand is more important than your statements. Job descriptions, permission records, approval workflows, handover forms and the like determine whether you "had the authority to act" or "merely had access," and they also determine the final sentencing bracket.
III. Do not use the fact that the company's own business involves coins as a defense. Some people think: the company's own business involves coins, this asset was never clean to begin with, the law does not protect it, so even if I took it, it does not amount to a crime. First, wrongdoing against wrongdoers is still a crime; second, using "the company's assets are the product of illegal financial activities" as a defense amounts to indirectly admitting that you participated in illegal financial activities, and the legal assessment may be more severe.
