An anonymous email was sent to the company's mailbox, in which the sender claimed to be an "overseas hacker"and claimed to have obtained the company's core R&D materials, and demanded that the company pay Bitcoin to a designated address andUSDT, otherwise the relevant documents would be made public。
In such a situation, companies are most likely to focus on external attacks: whether the servers have been breached, where the overseas IP entered from, and whether the hackers exploited system vulnerabilities. However, in this case in Shenzhen, the so-called "overseas hacker" was not overseas at all; the person who actually copied the R&D materials and sent the extortion emails was an internal employee of the company.
According to a report by the Procuratorate Daily, an employee of a Shenzhen company, Jia, burdened by more than RMB 400,000 in online lending debt, exploited loopholes in the company's data management to download and copy a total of 43 folders of confidential R&D materials of the company, and, by using an anonymous email account to pose as an overseas hacker, threatened to disclose the core technical materials and successively demanded 0.88 Bitcoin, 0.8 Bitcoin and 90,000 USDT. The company did not pay the ransom and chose to report the matter to the police. Jia was ultimately sentenced to three years and three months in prison and fined RMB 10,000 for attempted extortion.
What truly warrants the vigilance of technology companies and Web3 project teams in this case is not merely that the employee used BTC and USDT to demand ransom, but how the accounts and permissions that the company originally used for normal work became a channel for moving out core data in bulk in the absence of restrictions and early warnings.
This is not a typical "hacker intrusion", but abuse of internal permissions
External hackers entering a company's systems usually need to bypass security defenses through phishing emails, exploitation of vulnerabilities, password cracking or malicious programs. Internal employees are different: they themselves possess legitimate accounts, office devices and a certain level of data access permissions.
This means that even if traditional security systems do not detect abnormal logins, that does not mean data has not been taken away. When an employee uses their own account to access a file server and download project materials, at the system level it may look completely normal. What truly needs to be identified is whether the scope of their access, the volume of downloads and the destination of the files have clearly exceeded the needs of their position.
For example, an employee responsible only for a certain R&D module downloads the complete materials of multiple projects within a short period of time; a person who has already submitted their resignation exports historical documents in a concentrated manner late at night; an ordinary business person suddenly accesses a code repository unrelated to their position; and after files are downloaded, they are copied to personal cloud drives, removable hard drives or private email boxes. These behaviors, when they appear individually, do not necessarily directly mean a crime, but when multiple abnormal characteristics overlap, it indicates that the company needs to immediately verify whether permissions are being abused.
What companies truly need to monitor is not only "whether strangers have entered the system", but also whether internal accounts are using their existing permissions in a manner clearly deviating from normal business.
BTC and USDT are merely extortion tools and cannot be used to determine the identity of the attacker
In this case, the perpetrator demanded that the company pay Bitcoin and USDT, but this does not mean that anyone who accepts payment in virtual assets is located overseas, nor can one determine solely from a wallet address that the person belongs to a professional hacker group.
In cases of this kind, BTC and USDT serve the functions of a property demand and an instrument for receiving funds. The perpetrator may have chosen virtual assets because they believed that a wallet address does not directly reveal a real-name identity, that transfers can be completed across regions, or that such assets are harder for a company to identify at the first opportunity than a traditional bank account. However, these characteristics do not change the criminal nature of the conduct itself, nor do they prove that the perpetrator holds an overseas identity.
After a company receives extortion information of this kind, it should not conduct on-chain inquiries focused solely on the wallet address; it should also preserve the anonymous email account, the original email text, the complete email headers, the sending time, attachments, wording habits, and the document samples displayed by the other party. Even if internal employees use overseas email accounts, proxy networks, and newly created wallets, they may still leave clues connected to their real identities in file access records, device traces, and communication details.
The Criminal Lawprovides that demanding public or private property by means of threat or coercion, where the applicable conditions are met, may constitute the crime of extortion; where the perpetrator has already begun to commit the crime but fails to accomplish it for reasons beyond their will, the act may be determined to be an attempted crime. Therefore, the fact that a company has not actually paid BTC or USDT does not mean that the related extortion conduct falls outside the scope of criminal evaluation.
"Core R&D materials" cannot be directly equated with trade secrets in the legal sense
News reports frequently use expressions such as "core materials," "confidential documents," or "trade secrets," but in law these concepts are not entirely the same.
Under the current Anti-Unfair Competition Law, a trade secret should be technical information, business information, or other commercial information that is not known to the public, has commercial value, and for which the rights holder has taken corresponding confidentiality measures. In other words, the fact that a document is very important to a company does not automatically mean that it already constitutes a trade secret in the legal sense; the company must also explain the specific content of the information, its non-public nature, its commercial value, and what confidentiality measures were taken before the incident.
If so-called core R&D materials could be downloaded in a single instance by an ordinary employee without approval, the documents bore no classification markings, account permissions were not adjusted over the long term, copying and external transmission were unrestricted, and the company had no confidentiality system or access records, then in subsequently proving that it had taken "corresponding confidentiality measures," the company may face greater evidentiary pressure.
However, whether the materials can ultimately be recognized as trade secrets and whether the extortion conduct is established are two different questions. Even if some materials do not meet the criteria for recognition as trade secrets, so long as the perpetrator uses the company materials already obtained to create fear, threatens public disclosure, leakage, or harm to the company's interests, and demands property, the related conduct may still be evaluated independently.
Internal extortion can occur usually not because of a single permissions problem
That an insider can complete the sequence of "downloading materials—removing them from the system—making anonymous threats—demanding ransom" often indicates that multiple consecutive breakpoints exist in the company's data security chain.
The first gap is excessive permissions. The materials employees can access clearly exceed what their roles and projects require, and after role changes or project completion, the original permissions are not revoked in a timely manner.
The second gap is uncontrolled downloading. The system allows users to download complete directories in bulk within a short period, without triggering approval, rate limiting, or anomaly alerts.
The third gap is uncontrolled outbound transmission. Corporate files can easily be transferred to personal email accounts, cloud drives, removable hard drives, or private devices, rendering watermarks and endpoint controls ineffective.
The fourth gap is insufficient logging. Although the enterprise can see account logins, it cannot accurately reconstruct which files an employee downloaded, to which devices they were copied, and when the relevant operations occurred.
The Data Security Law requires data processors to establish and improve full-process data security management systems, adopt corresponding technical and organizational measures, conduct risk monitoring, and promptly handle data security defects, vulnerabilities, or incidents when discovered. For enterprises, this does not mean imposing unlimited surveillance on employees; rather, they should establish a permission system that is explainable, capable of early warning, and traceable, centered on objective operations directly related to work.
Web3 project teams must also incorporate wallet and contract permissions into the same management framework
For ordinary technology companies, the targets of internal extortion may mainly be source code, research and development documents, customer lists, and business data; for Web3 project teams, the core assets employees can access often also include deployment accounts, administrator private keys, node keys, multisignature permissions, API keys, and contract upgrade permissions.
If an enterprise protects only documents but does not simultaneously manage wallets and on-chain permissions, what employees take away may be more than research and development materials. A person with technical permissions may simultaneously control the code repository, cloud servers, and administrator wallets; once their accounts are not tiered and key operations do not require multi-person approval, a data breach may further escalate into contract upgrades, modification of project parameters, or transfer of assets.
For Web3 project teams, data security and asset security should not be managed by two completely separate teams. Code, cloud services, wallets, and multisignature arrangements together constitute project control, and any link that falls outside corporate governance may become leverage for insiders to exert pressure.
After receiving an extortion message, the first step is to determine where the data left from
After an enterprise receives an anonymous extortion email, the first issue to resolve is not guessing which country the other party is from, nor immediately bargaining with the extortionist, but confirming whether the materials the other party displays are authentic, which data has already been copied, and whether the existing system permissions remain secure.
The enterprise should first preserve the original email text, complete email headers, attachments, and the wallet address provided by the other party, while isolating potentially affected accounts and devices and preserving file access, download, copy, and outbound transmission logs. Without assessment, it is inadvisable to immediately reinstall computers, delete accounts, or clean servers, as doing so may destroy electronic data capable of reconstructing the course of conduct.
Internal investigations should also not identify targets merely on the basis of lifestyle information such as whether an employee is in debt or has recently shown unusual emotional states. Financial pressure cannot directly prove that a particular employee committed a crime; enterprises should base their investigations on objective evidence such as account permissions, device records, file access and outbound transmission paths, and gradually narrow the scope of the investigation.
At the same time, it is also necessary to verify whether there is a continuing risk that code repositories, cloud servers, administrator accounts, API keys and wallet permissions may remain under control. For Web3 projects, data having already been copied and on-chain permissions having already been lost are two issues at different levels; the risk that administrator permissions remain in the hands of an anomalous individual must not be ignored merely because no token transfer has occurred for the time being.
If an incident simultaneously involves R&D materials, trade secrets, on-chain permissions and leads concerning employee criminal conduct, the enterprise needs legal, information security, human resources and management to jointly establish a unified handling mechanism, so as to avoid different departments conducting separate inquiries, repeatedly operating devices, or creating mutually contradictory internal records.
Lawyer's Observations
The most striking element of this case is that the perpetrator demanded BTC and USDT; however, the lesson enterprises truly need to draw is not which type of virtual asset the extortionist chose.
The so-called "overseas hacker" was merely a cover used by the perpetrator to conceal his true identity, and BTC and USDT were merely the method of property demand he chose. What truly enabled the entire extortion scheme to be carried out was that an employee was able to use a normal account to obtain R&D materials beyond what the position required, while the enterprise failed to promptly detect the anomaly when the materials were downloaded in bulk and taken out of the system.
What enterprises truly need to guard against is not only how external parties may breach the system, but whether internal personnel can use legitimate permissions to carry out unrestricted data access, copying and transfer.
For technology enterprises and Web3 project parties, data, code, servers, wallets and contract permissions have together come to constitute the enterprise's core assets. Effective internal control is not about guessing who the attacker is after a extortion email appears, but about ensuring that whenever anyone accesses, downloads, transmits externally or transfers core assets, there is a clear basis for permission, an approval mechanism, operation records and anomaly alerts.
