A long-term resident of Guangdong who works as a USDT dealer has, since May 2026, made multiple trips to and from Macau, purchasing USDT with cash in Hong Kong dollars and then selling it through exchange accounts to earn the price difference. Recently,police from Henan came to Guangdong and located him to take a statement, informing him that some of the USDT he had previously purchased was proceeds of theft by others, and that an investigation is currently being conducted in the direction of suspected theft.
The coins were purchased in Macau, and at the time of the transaction he did not know there was any problem with their source, so why would he be suspected of theft? Even if the coins received were stolen, a distinction should still be drawn between theft and the offense of concealing or disguising criminal proceeds; and on what basis do the Henan police have jurisdiction over a transaction that took place in Macau?
These questions appear independent, but in fact they concern different legal assessments along the same transaction chain:the relationship between the upstream theft and the downstream purchase, the subjective knowledge of a professional USDT dealer, the nature of cross-border transactions, and the determination of the amount of the offense and territorial jurisdiction. For persons engaged in OTC transactions on a long-term basis, once they receive USDT whose source involves a crime, whether they bear criminal liability and what kind of liability they bear often depends on these specific facts.
I. Does receiving stolen USDT constitute the offense of theft?
Distinguishing the offense of theft from the offense of concealing or disguising criminal proceeds (hereinafter referred to as the "concealment offense") is the issue that most needs to be clarified in this case.
Under Article 7 of the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Concealing or Disguising Criminal Proceeds and Proceeds of Crime, which took effect on August 26, 2025, where a person conspires in advance with a perpetrator of theft, robbery, fraud, snatching or the like to conceal or disguise criminal proceeds and their proceeds, and this constitutes a crime, the person shall be punished respectively as an accomplice to the corresponding upstream crime.
This means that a USDT dealer, even without directly carrying out the coin theft, may be found to be an accomplice to theft because he formed a common criminal intent with the theft perpetrator in advance and agreed to provide a channel for disposing of the stolen property.
For example, before carrying out the theft, the coin thief has already agreed with the USDT dealer on the purchase price and the method of converting the coins into cash, and the USDT dealer, knowing that the other party intends to steal another person's USDT, still promises to purchase and transfer the coins after the theft is completed. In this situation, the subsequent coin-receiving conduct cannot simply be understood as an independent transaction; rather, it should be assessed in light of the prior conspiracy and the specific roles of both parties in the crime to determine whether it constitutes accomplice liability for theft.
However, if the USDT dealer came into contact with the coin seller only after the theft had already been completed, and there was neither a prior purchase agreement nor any participation in the upstream theft, then finding him to be an accomplice to theft merely because he purchased the relevant USDT after the fact clearly lacks a corresponding factual basis.
Cases involving virtual currency have a technical feature worth leveraging on this issue: on-chain transactions can help reconstruct the timing and path of asset transfers.
Theft is a crime of acquisition-type property offense, and the determination of consummation generally requires considering whether the victim lost control of the property and whether the perpetrator actually obtained control of the property. For USDT theft carried out through wallet transfers, the transaction hash, block confirmation time, receiving address of the funds, and subsequent transfer records can provide important evidence for determining when control over the assets shifted.
In this case, focus should be placed on verifying when the stolen USDT entered an address controlled by the upstream offender, when the party established contact with the coin seller, and when the two parties completed the purchase.If the purchase occurred after the upstream theft was consummated, and there is no other evidence proving that the party participated in the crime beforehand, then the mere act of purchasing and selling the stolen coins is insufficient to establish accomplice liability for theft.
Of course, on-chain timing can only prove the sequence of asset transfers; it cannot directly prove whether the two parties had prior collusion. Investigative authorities may still rely on chat records, historical transactions, fund flows, the relationship between the parties, and other evidence to determine whether the party participated in the theft arrangement in advance.
Therefore,The defense on the theft charge in this case should focus not only on proving that the coin purchase occurred after the theft, but also on examining whether there is evidence proving shared criminal intent and participation in the conduct.
If the above evidence is insufficient, the finding of accomplice liability for theft should be called into question.
II. If one did not know the coins were stolen, can one still be liable for the crime of concealment and disguise?
Ruling out accomplice liability for theft does not mean that the crime of concealment and disguise is automatically established.
The establishment of the crime of concealment and disguise requires both verifiable facts of an upstream crime and proof that the perpetrator knew or should have known that the relevant property was proceeds of crime, and carried out corresponding acts of concealment and disguise.
Article 2 of the 2025 judicial interpretation on the crime of concealment and disguise clarifies that "knowingly" as provided in Article 312 of the Criminal Law includes knowing or should have known. In making a specific determination, a comprehensive review should be conducted in light of factors such as the information to which the perpetrator was exposed, the circumstances under which the perpetrator handled the proceeds of crime, the type and amount of the assets, the method of transfer, abnormal circumstances of the transaction, as well as occupational experience and the relationship with the upstream offender.
For professional OTC merchants who have long engaged in OTC trading and are familiar with market conditions and trading procedures, such experience may indeed affect the investigating authorities' assessment of their subjective knowledge.However, professional experience can only serve as one factor in a comprehensive assessment and cannot directly substitute for proof of subjective knowledge.
In practice, the transaction price is often an important point of entry.
If the purchase price is significantly lower than the normal market rate for the same period, the seller cannot reasonably explain the source of the coins, or there are abnormal circumstances in the transaction process such as frequent changes of wallet addresses, requests for rapid splitting and transfer, or deliberate evasion of identity verification, the investigating authorities may on that basis suspect that the party knew the relevant USDT was problematic.
Conversely, if the transaction price is broadly consistent with the market rate for the same period, the parties negotiated, paid and delivered the coins in the normal course, there was no abnormal communication before the transaction, and there was no arrangement to help others conceal the source of funds, then these facts can likewise serve as important grounds for rebutting subjective knowledge.
However, a normal price cannot be equated with a bona fide transaction. Subjective knowledge in the crime of concealing or disguising criminal proceeds must be assessed against the complete transaction background and cannot be concluded merely from whether the price was high or low.
In this case, the offline transaction was conducted in Hong Kong dollars in cash, and cash delivery lacks the direct and complete records of a bank transfer, which objectively increases the difficulty of reconstructing the facts. In the defense, it is necessary to use materials such as the parties' chat records, the source of the cash, the transaction venue, entry and exit records, the times the wallet received the coins, and exchange sale records to reconstruct the true circumstances of each transaction as far as possible.
There is another issue that cannot be overlooked: whether the upstream theft has been verified.
Under Article 10 of the above judicial interpretation, the crime of concealing or disguising criminal proceeds presupposes the existence of the facts of the upstream crime. The fact that the upstream offender has not yet been brought to justice, or is not to be held criminally liable for statutory reasons, does not as a matter of course affect the determination of the downstream crime. However, if the facts of the upstream theft itself have not yet been sufficiently proved, or it cannot be proved that the USDT purchased by the party actually originated from that theft case, then the determination of the downstream crime likewise faces evidentiary obstacles.
In coin-related cases, it is particularly necessary to examine the completeness of on-chain fund tracing. The mere fact that a certain amount of USDT passed through a wallet address suspected of involvement in a crime does not permit, without further analysis, the direct characterization of assets in all subsequently linked addresses as criminal proceeds.
In addition, if the party did not know when initially receiving the coins that the assets were connected to a crime, but after learning of the relevant circumstances continued to carry out transfer, sale or other acts of concealment or disguise, the subsequent conduct must also be assessed separately.
Therefore, with respect to this case,Absent prior collusion, this is an important defense avenue for excluding accomplice liability for theft; and whether the offense of concealing or disguising criminal proceeds is constituted still requires further examination of the facts of the upstream crime, the correspondence of assets, subjective knowledge, and the specific transaction conduct.
The case cannot be redirected to the offense of concealing or disguising criminal proceeds merely because the evidence of theft is insufficient, and it cannot be presumed that the party necessarily knew the coins received were proceeds of crime merely because the party is a professional USDT merchant.
III. Does long-term buying and selling of USDT constitute suspected illegal business operation?
In addition to theft and the offense of concealing or disguising criminal proceeds, the transaction model in this case, in which the party engaged in long-term acquisition and sale of USDT to earn price spreads, may also involve examination for the offense of illegal business operation.
On February 6, 2026, the People's Bank of China and seven other departments issued the Notice on Further Preventing and Addressing Risks Relating to Virtual Currencies and Other Matters (Yin Fa [2026] No. 42), which makes clear that virtual currencies do not have a legal status equivalent to fiat currency, and that business activities conducted in mainland China such as exchanging fiat currency for virtual currency, exchanging virtual currency for virtual currency, buying and selling virtual currency as a central counterparty, and providing related information intermediation and pricing services constitute illegal financial activities that are strictly prohibited.
It is necessary to distinguish that the prohibition of a certain type of business activity under regulatory policy and the determination of a specific crime under criminal law are not entirely the same legal question. Whether the offense of illegal business operation is constituted still requires judgment in light of the nature of the specific transactions, the business conduct, and the statutory elements for criminal liability.
For OTC transactions, particular attention should be paid in practice to circumstances involving the use of virtual currencies to buy and sell foreign exchange in a disguised form.
According to the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Illegally Engaging in Fund Payment and Settlement Business and Illegally Buying and Selling Foreign Exchange, conduct such as buying and selling foreign exchange by speculation or buying and selling foreign exchange in a disguised form in violation of state regulations, which disrupts financial market order and is serious in nature, may constitute the offense of illegal business operation.
In cases involving the use of virtual currencies for cross-border fund conversion, the focus of judgment should be on the business actually engaged in by the actor.
If a USDT merchant undertakes foreign exchange conversion requests from unspecified clients, uses USDT as an intermediary medium to assist others in completing exchanges among Hong Kong dollars, US dollars, and renminbi, and earns price spreads or service fees therefrom, this may involve criminal risk of buying and selling foreign exchange in a disguised form.
However, if the actor uses its own funds to purchase USDT and then decides on its own when to sell, earning price spreads through buying and selling assets, and neither undertakes foreign exchange conversion business externally nor provides domestic and foreign currency exchange services to third parties, then the mere existence of multiple buying and selling transactions and a profit-making purpose is not yet sufficient to directly determine that the actor constitutes the illegal business operation offense in the form of illegal buying and selling of foreign exchange.
This distinction does not mean that the business activities of professional USDT merchants are naturally lawful. Mainland China has clear regulatory restrictions on virtual currency-related business, and specific conduct may also involve other legal risks. However, for purposes of criminal characterization, not all virtual currency transactions can be directly equated with illegal buying and selling of foreign exchange.
This case has another unusual feature: the individual concerned used Hong Kong dollar cash in Macau to acquire USDT.
What currency did he ultimately sell the USDT for? Was the sale completed in Macau, or was it carried out after returning to Guangdong? Was the final proceeds in RMB, Hong Kong dollars, or US dollars? Did the funds enter a domestic bank account or an offshore account? These facts will directly affect the assessment of his trading model.
Particular attention should be paid to the fact that Macau operates an independent legal system, and the mainland's regulatory provisions on business activities relating to virtual currencies cannot be applied directly and without distinction to local transactions in Macau. If the transactions involve mainland business operations, mainland customers, or the exchange between RMB and foreign currencies, further review in light of the specific facts is required.
On the facts currently known, although the individual concerned has long engaged in the acquisition and sale of USDT, it cannot yet be concluded, merely on the basis of his status as a professional USDT merchant and the price-spread profit, that he has committed the crime of illegal business operations in the form of illegal foreign exchange trading. In the defense, the true business model should be reconstructed through actual transaction records, payment and collection methods, counterparties, and the destination of funds.
IV. How should the amount of USDT involved in the case be calculated?
The amount involved is another issue that may directly affect conviction and sentencing.
If the conduct is ultimately assessed as complicity in theft, or if the review shifts to the crime of concealing or disguising criminal proceeds, the case-handling authorities must clarify the quantity, source, and value of the USDT involved. However, the criminal amounts for the two offenses cannot simply be calculated using the same method.
For the crime of concealing or disguising criminal proceeds, Article 6 of the 2025 judicial interpretation already provides: the amount of criminal proceeds and the proceeds derived therefrom that are concealed or disguised shall be determined as of the time the act of concealment or disguise is carried out; where the price at which the property is acquired or sold on behalf of another is higher than its actual value, the amount shall be calculated based on the acquisition or sale price. Where the relevant acts are carried out multiple times, have not been subject to administrative penalties, and are subject to prosecution in accordance with law, the amounts of the relevant criminal proceeds and the proceeds derived therefrom shall be calculated cumulatively.
The valuation rules for the crime of theft are different.
Under Article 4 of the Interpretation on Several Issues Concerning the Application of Law in Handling Criminal Cases of Theft, where there is valid price evidence for the stolen property, the amount shall be determined on the basis of that valid price evidence; where there is no valid price evidence, or where a determination based on the price evidence is clearly unreasonable, a valuation agency shall be commissioned to conduct a valuation in accordance with the relevant provisions.
However, virtual currencies do not have the status of legal tender, and there is no uniformly recognized mechanism in the mainland for determining the price of virtual currencies, which gives rise to a degree of controversy in judicial practice regarding the valuation of virtual currencies involved in cases.
For example, on June 7, 2026, Procuratorate Daily reported a Bitcoin theft case in Qingdao. The defendant used wallet mnemonic words in his possession to steal 107 bitcoins from another person and subsequently realized a profit of more than RMB 660,000. After reviewing the relevant valuation issues, the case-handling authorities determined the amount of the theft based on the actual proceeds realized from disposing of the stolen property, and the case was ultimately convicted and punished as the crime of theft.
This case shows that, where virtual currency lacks the usual basis for determining a statutory price, judicial authorities may determine the amount of the crime based on evidence such as the proceeds actually realized. However, whether this method can be adopted in a specific case still needs to be judged in light of the transaction facts and evidentiary conditions, and the approach taken in an individual case cannot be directly understood as a uniform pricing rule.
In practice, various evidence may also be involved, such as the victim's actual purchase cost, asset losses, relevant transaction records and market prices. What different data can prove, and whether it is sufficient to determine the amount of the crime, need to be analyzed separately; it cannot simply be assumed that the victim's purchase cost takes priority, or that the market quotation of an overseas trading platform at a certain point in time can be directly used as the amount of the theft.
Particular attention should be paid to the correspondence between the time of price determination and the stage of the conduct.
Determining the amount in the crime of theft usually requires attention to the value of the property involved at the time the perpetrator obtained control of it and the corresponding evidence; the crime of concealing or disguising criminal proceeds, however, has clear pricing rules for the time when the act of concealing or disguising is carried out. If the same USDT is first stolen and then transferred multiple times, the time of price determination and the applicable rules for different stages of the crime are not necessarily the same.
In this case, in addition to examining the price itself, it should also be verified whether the USDT involved accurately corresponds to the upstream stolen assets, whether the receipt records and sale records can be matched one by one, and whether the investigating authorities have conflated transactions from different sources, double-counted, or substituted all transaction flows for the amount of the crime involved.
For professional USDT merchants, an account may simultaneously contain a large number of transactions involving different customers, different times and different sources. Even if some of the USDT is proven to be criminal proceeds, all receipt and sale flows cannot be counted into the amount of the crime without verification transaction by transaction.
If reliable evidence is lacking as to the source, quantity, value or calculation method of the relevant assets, defense counsel should raise specific objections concerning the authenticity, relevance and probative value of the evidence.The amount of the crime must be established on the basis of facts that can be verified, and cannot be inferred merely from unverified market screenshots or general fund flows.
V. Receiving USDT in Macau: Can Henan Police Exercise Jurisdiction?
Another peculiarity of this case is that the transaction took place in Macau, the party concerned had long resided in Guangdong, yet it was Henan police that intervened in the investigation.
Under Article 18 of the Basic Law of the Macao Special Administrative Region of the People's Republic of China, national laws do not apply in the Macao Special Administrative Region except those listed in Annex III to the Basic Law. The mainland Criminal Law is not listed in Annex III, and Macau has an independent criminal legal system and judicial jurisdiction system.
Therefore, with respect to the act of receiving USDT that occurred locally in Macau, the mainland Criminal Law cannot simply be applied directly to evaluate it merely because the actor is a mainland resident.
This involves the question of the application of criminal law between different legal jurisdictions under "One Country, Two Systems." As to acts committed by Mainland residents in Macao, whether and how Mainland criminal law applies is subject to differing views in doctrine and practice, and no conclusion can be reached by simply applying the general rules of personal jurisdiction over crimes committed abroad.
However, the Macao transaction itself cannot of course serve as a basis for the jurisdiction of the Mainland public security authorities, nor does it mean that the Mainland public security authorities necessarily lack the power to investigate the entire case.
Under Articles 15 and 16 of the Provisions on the Procedures for Public Security Authorities Handling Criminal Cases, criminal cases are in principle under the jurisdiction of the public security authority of the place where the crime was committed. The place where the crime was committed includes the place where the criminal act occurred and the place where the criminal result occurred, the latter further including the place where the object of the crime was infringed, the place where the proceeds of the crime were actually obtained, concealed, transferred, used or sold, and so on. If it is more appropriate for the public security authority of the place of residence of the criminal suspect to exercise jurisdiction, that authority may also exercise jurisdiction in accordance with law.
In this case specifically, several possible jurisdictional connecting points need to be examined separately.
First, the connection between the upstream theft case and Henan.
If the victim is located in Henan and the relevant criminal act or criminal result occurred in Henan, the Henan public security authorities may have a jurisdictional basis over the upstream theft case. That the police, through on-chain tracing of funds, discovered the relevant USDT flowing to a Macao over-the-counter (OTC) crypto trader and thereupon investigated that trader is not difficult to understand from an investigative logic standpoint.
However, the fact that the upstream theft case is under the jurisdiction of the Henan public security authorities still requires separate examination as to whether the downstream receipt of the coins constitutes a crime and whether it should be under the jurisdiction of the Henan public security authorities. It cannot simply be assumed that all subsequent transactions fall within the jurisdiction of the Henan public security authorities merely because the USDT involved originated from a theft case investigated in Henan.
Second, the actual place where the party concerned sold the USDT.
If, after receiving the coins in Macao, the party concerned returned to Guangdong to operate the exchange account and sell the USDT involved for cash, then the facts concerning the relevant place of operation, the receiving account, the destination of the funds and so on require further examination.
If the relevant acts constitute a crime and were committed in the Mainland, a corresponding Mainland jurisdictional connecting point may arise. Conversely, if the trading operations, fund settlement and other steps all occurred abroad or in Macao, the basis for Mainland criminal jurisdiction would require fuller justification.
Here, the place where the criminal act occurred cannot be mechanically determined solely on the basis of the place of registration of the exchange, the platform to which the account belongs or the location of the receiving account; analysis should also be conducted in light of the actual operational circumstances and the suspected charge.
Third, the place of residence of the party concerned.
The party concerned has long resided in Guangdong. If the relevant procedural requirements are met and jurisdiction by the Guangdong public security authority is more appropriate, the possibility of transferring the case may also be lawfully assessed.
Therefore, the jurisdictional dispute in this case cannot be resolved by simply answering whether Henan can exercise jurisdiction. Rather, it requires a separate examination of the basis for jurisdiction in light of the upstream theft facts, the downstream suspected criminal conduct, the asset flow path, and the party's actual residence.
For defense counsel, if there are issues of insufficient jurisdictional basis or improper application of procedure, these should be raised in accordance with law after the relevant facts are ascertained, and it should not be concluded directly that the mainland public security authority lacks jurisdiction merely because the transaction occurred in Macau.
VI. What needs to be done most urgently at present?
For the party concerned, the most important thing at present is to ascertain as soon as possible the stage at which the case currently stands and the specific basis on which the Henan police have determined that the party is suspected of theft.
If the party has so far only been questioned for a statement and no criminal compulsory measure has been taken, it should first be confirmed whether the party has been listed as a criminal suspect, the filing status of the relevant case, and the specific facts under police investigation. If criminal proceedings have already commenced, a professional criminal defense lawyer should intervene as soon as possible to determine the defense strategy on the basis of an understanding of the case.
The evidence in this case can be organized along three lines.
One line concerns the relationship with the upstream theft perpetrator.The focus is to verify whether the two parties knew each other, when they established contact, whether there had been prior transactions, and whether there was any prior agreement regarding the purchase and liquidation of the USDT involved. This evidence bears directly on the determination of accomplice liability for theft.
Another line concerns the specific transaction process.This includes the source of the Hong Kong dollar cash, the transaction price, chat records, the timing of payment and receipt of the crypto assets, the transaction venue, the relevant wallet addresses, and the subsequent sale of USDT through exchanges. These materials are used to reconstruct the transaction background and to examine whether there are abnormal factors sufficient to prove subjective knowledge.
A further line concerns the on-chain flow of the USDT involved.It should be verified whether the upstream stolen address, the fund transfer path, the party's actual receiving address and subsequent sale records can be accurately matched to the upstream theft case, and whether there are issues such as commingling determinations or double counting.
In this process, the party should preserve the original evidence in full, should not delete chat records or transaction records, or dispose of assets related to the case without authorization, and must not contact counterparties to collude on testimony or align statements, so as to avoid making transaction facts that could otherwise be clearly explained more complicated.
The defense strategy should also not be limited prematurely to a single charge.
If there is insufficient evidence to prove that the party conspired in advance with the upstream thief or engaged in other joint criminal conduct, the focus should be on examining whether accomplice liability for theft is established; if the investigating authority considers proceeding under the charge of concealment or disguise of criminal proceeds, further examination should be conducted as to whether subjective knowledge, the facts of the upstream crime and the specific acts of concealment or disguise are proven.
As for the risk of illegal business operations that may be involved in long-term OTC trading, an independent analysis should be conducted from the aspects of the actual business model, counterparties, settlement methods and the application of mainland law, so as to avoid equating occupational status directly with the elements of a crime.
After the case enters different procedural stages, issues such as release on bail pending trial, jurisdictional objections, determination of the amount of the crime, return of illicit gains and compensation, and admission of guilt and acceptance of punishment may also be lawfully assessed based on the evidence. However, whether to choose the relevant procedures or leniency arrangements should be based on a full understanding of the facts and evidence of the case.
Returning to this case, the fact that the Henan police are currently investigating on the basis of suspected theft does not mean that the party will ultimately be found to have committed theft.When the purchase occurred, whether there was prior conspiracy with the upstream counterparty, whether during the transaction the party knew or should have known of the criminal origin of the USDT, and in which jurisdiction the relevant conduct actually occurred may all affect the final legal assessment.
In criminal cases involving virtual assets, on-chain fund flows can show which addresses the assets passed through, but cannot by themselves show that every recipient had criminal intent. Professional USDT merchants may face stricter risk review because of their trading model, but specific criminal liability still needs to be assessed by returning to the elements of the crime and the evidence itself.
Receiving stolen USDT does not equal participation in theft; and ruling out the crime of theft does not mean that the crime of concealment or disguise of criminal proceeds is necessarily established.
If the timing of the actor's participation, subjective knowledge and transaction background are ignored, and a criminal characterization is made solely on the basis of fund flows, conduct of different natures may be conflated. Fully reconstructing these facts and lawfully distinguishing the criminal liability of each stage is precisely the focus of defense work in such cases.
