Open the wallet, and the USDT balance is still there; the transaction history does not show that the assets have been transferred out either. But when you are about to make a transfer, the system indicates that the signing authority is insufficient. Even though the mnemonic phrase and private key are in your own hands, there is simply no way to transfer the coins out.
Only upon further inquiry do you discover that the wallet's permissions have been modified by someone else. Transactions that originally required only your own signature to complete now must be authorized by another unfamiliar address.
The money has not been transferred out, yet control no longer belongs to you.
This type of situation is commonly referred to as "malicious multisignature." Unlike common virtual asset theft, the attacker does not necessarily transfer the assets immediately, but first uses the wallet permission mechanism to restrict the original holder's ability to control the assets.
The questions then arise: the coins are clearly still in the original address, so does this count as already stolen? If it was caused by someone inducing a signature, should it be characterized as theft or fraud?
For users encountering similar situations, clarifying these questions concerns not only how to report the matter to the police subsequently, but also what evidence should be prepared and whether there is still a chance to recover the assets.
01 When a wallet is subjected to malicious multisignature, who exactly has taken control?
To understand the legal issues of malicious multisignature, it is first necessary to distinguish two concepts: whether there are assets in the wallet, and who has the authority to control those assets.
Taking the TRON network as an example, its account permission management mechanism allows different addresses to be assigned signing weights and sets the signature threshold required to complete a transaction. Under normal circumstances, users can manage their accounts through private keys in their own possession, and may also voluntarily set up multi-party joint signatures for scenarios such as corporate fund management.
However, if someone without authorization modifies the wallet's Owner permission or Active permission by obtaining the private key or mnemonic phrase, or by inducing the user to sign a malicious permission-change transaction, the situation is entirely different.
For example, originally the user alone could complete a transfer, but after the permissions are modified, another unfamiliar address must jointly sign in order to operate. In more serious cases, the other party may already possess signing weight sufficient to independently modify permissions or transfer assets, while the original user can only see the account balance but cannot manage the assets alone.
From the on-chain perspective, the assets may still remain at the original address, with no transfer having occurred. But from the perspective of the actual control relationship, the original holder's ability to control the assets has already changed.
There is a detail here that is easily overlooked: a malicious multisig does not necessarily mean that the attacker is already able to transfer the assets away on their own.
In some cases, the attacker can control the wallet independently; in some cases, neither party can complete a transfer on its own; and in still other cases, only specific operation permissions are restricted. Which of these applies requires examining the account's permission addresses, signature weights, thresholds and executable operations.
Therefore, when a wallet cannot transfer funds, one cannot conclude that a malicious multisig has occurred merely on the basis of an interface prompt, and still less can one directly conclude that "all the coins have been stolen."
What truly needs to be established is: who modified the permissions? Was the modification validly authorized? Who can now control the wallet? Has the original holder been substantively excluded from control over the assets?
These facts are the starting point for the subsequent criminal-law analysis.
02 Is it theft or fraud? The key is not merely whether there was deception
In judicial practice, the illegal acquisition of virtual assets may involve the crime of theft, the crime of fraud, and crimes related to computer information systems. However, which specific charge applies cannot be determined merely on the basis of the result that "the wallet was multisigged."
The first scenario: permissions are modified without consent, and the assets are further transferred away.
Assume that the attacker, by illegally obtaining the private key, mnemonic phrase or other means, modifies the wallet permissions without authorization and subsequently transfers the assets to an address controlled by the attacker.
In such a case, if there is evidence proving that the actor had the intent of illegal possession, obtained control of the assets without the rights holder's consent and actually transferred the assets, this may give rise to a determination of the crime of theft.
However, virtual assets have data attributes and certain characteristics of property interests, and in different cases there remains controversy over the path of criminal-law protection and the method of determining the amount of the crime.
Some judicial views emphasize the property attributes of virtual assets and hold that the act of illegal taking may constitute the crime of theft; other cases evaluate the conduct from the perspective of the data security of computer information systems.
Therefore, even if the assets have already been actually transferred away, one cannot skip over the specific manner of conduct, the nature of the assets and the evidentiary circumstances and directly determine the charge.
The second scenario: inducing users through false statements to sign transactions that change permissions.
This type of scenario is more worth discussing.
For example, the perpetrator, under the pretext of account security upgrades, platform verification or ordinary transaction operations, has the user click a link, connect a wallet and confirm a signature. The user believes they are completing an ordinary operation, but what they actually sign is a transaction that modifies account permissions.
On the surface, the user did personally click the confirmation button.
But from a legal perspective, whether clicking confirm means consenting to another person obtaining control of the assets is a separate question.
An important distinction between theft and fraud lies in whether the victim disposed of property because they were deceived and formed a mistaken understanding. If the user was merely induced to complete a technical operation and had no idea that the operation would enable another person to control their assets, then whether the user had the awareness of property disposal in the sense of criminal law requires further determination.
Conversely, if the perpetrator, by fabricating facts, causes the user under a mistaken understanding to voluntarily hand over the assets or actual control thereof to the other party, this may also involve an assessment of fraud.
Therefore, the mere presence of deceptive language does not necessarily constitute fraud, nor does the fact that the user clicked a signature confirmation necessarily exclude the possibility of theft.
Especially for malicious multi-signature arrangements, whether a permission change can be assessed as property disposal and whether the perpetrator has already obtained property control in the sense of criminal law still require analysis in light of the specific facts.
The third scenario: obtaining wallet control permissions through malicious programs, technical intrusion or other means.
If the attacker also carried out acts such as illegally obtaining identity authentication information, intruding into or illegally controlling a computer information system, then where the constitutive elements and thresholds for the relevant offences are met, this may also involve the computer information system-related offences provided for in Article 285 of the Criminal Law.
However, a modification of on-chain account permissions does not mean that the actor necessarily exercised unlawful control over a computer information system within the meaning of criminal law. Whether there was technical intrusion, unlawful acquisition of system data, or other such conduct requires separate examination.
In other words, a malicious multisignature is merely a technical outcome, whereas the assessment of criminal liability requires further answers: what exactly did the actor do, by what means did the actor obtain permissions, what benefits did the actor obtain, and what consequences were caused?
03 If the coins have not yet been transferred away, does that mean there is no property loss?
This is a rather difficult issue in malicious multisignature cases.
In traditional theft cases, where property is taken from the victim's control by another person, the change in the relationship of possession of property is usually relatively intuitive.
However, digital assets are different.
Suppose a wallet was originally managed independently by the user, and later someone maliciously modified the permissions, rendering the user unable to transfer funds. At this point, the on-chain balance has not changed, and the assets have not entered a new address of the attacker.
So what exactly has the user lost?
From the perspective of actual use, the user has already lost part or even all of the asset-disposition capacity the user originally enjoyed. Even if the balance still exists, it may be impossible to carry out normal transfers, payments, or other lawful disposal operations.
However, in the assessment under criminal law, an infringement of control rights and the completion of a property crime are not necessarily equivalent as a matter of course.
Several scenarios need to be further distinguished: whether the actor has already obtained exclusive control; whether the user can still restore operations through other valid permissions; whether both parties are unable to transfer funds independently; whether the attacker has actually transferred the assets away, and whether there is further conduct of unlawful possession of the assets.
These facts will affect the determination of changes in possession of property, completion versus attempt of the crime, actual loss, and the amount involved in the crime.
Particular attention should be paid to the fact that the entire virtual currency balance displayed in a wallet cannot simply be treated directly as the amount of the crime actually suffered as a loss. The status of asset control, the actual transfers, and the basis for determining value may all require further verification.
However, this does not mean that there is no criminal risk merely because the assets have not left the original address.
If an actor, through deception, unauthorized acquisition of permissions, or other means, takes control of another person's wallet in a planned manner, even if the asset transfer has not yet been completed, it may still be necessary to analyze, in light of the relevant elements of the offense and the stage of commission, whether the actor is already suspected of a crime.
Therefore, "the coins were not transferred out" cannot directly equate to "no crime was committed," and "the wallet cannot be operated" cannot directly equate to "all assets have been stolen."
Both of these judgments are overly simplistic.
04 After a wallet is subjected to malicious multi-signature, what evidence should be prepared when reporting to the police?
When encountering malicious multi-signature, many people's first reaction is to confront the other party or to look through various community groups for someone who can remove the multi-signature.
However, from the perspective of safeguarding rights, it is more important than arguing to ascertain the changes in permissions as quickly as possible and to preserve evidence.
First, it is necessary to prove who originally controlled the wallet.
A wallet address itself cannot directly prove the real-world ownership of rights.
If one wishes to safeguard one's rights through criminal proceedings, it is necessary to organize, as far as possible, wallet creation and usage records, historical transfer records, the source of asset acquisition, transaction vouchers, and other materials capable of proving prior actual control of the wallet.
In particular, where the situation involves custody by another person on one's behalf, joint management, or an enterprise wallet, it is also necessary to distinguish who is the rights holder of the assets, who is merely a technical manager, and what scope of authorization the parties originally agreed upon.
Second, it is necessary to identify the specific records showing that the permissions were modified.
In networks that support on-chain permission queries, account permissions can be checked through the official block explorer, with particular attention to the transaction hash (TxID), time of occurrence, block record, signing addresses and weights before and after the change, and signature threshold of any transaction involving an anomalous permission change.
This information helps explain why the wallet cannot be operated and also helps establish when the anomalous state came into being.
Where conditions permit, technical personnel with the relevant professional capabilities may be engaged to assist in analyzing the permission-change process, and the original on-chain records capable of verification should be preserved, rather than only a screenshot of the balance.
Third, the manner in which the other party obtained the opportunity to operate should be reconstructed as far as possible.
If, before the incident, anyone asked to view a mobile phone, provided an operation link, offered assistance in using the wallet, or requested a signature on the pretext of security authentication, the relevant chat records, web links, materials from the transaction scene, and electronic device records should be preserved as far as possible.
It should be specifically noted here that on-chain records can usually prove that a given permission-change transaction occurred, but they cannot necessarily directly prove who in reality operated the wallet.
Linking an on-chain address to a specific person often also requires corroboration among other materials, such as device traces, chat records, transaction relationships, and evidence from the scene.
Finally, an assessment should be made as soon as possible as to whether there remains room to deal with the assets safely.
After discovering the anomaly, it is inadvisable to continue depositing funds into the suspicious wallet or paying so-called "unlock fees," and private keys and mnemonic phrases should not be readily provided to unfamiliar technical personnel.
If the account still retains lawful and valid operating permissions, feasible safe handling methods should be verified as soon as possible by trusted professionals, and the necessary evidence should be preserved at the same time. If the permissions can no longer be restored, the follow-up on-chain tracing, criminal complaints, and other remedial paths should be assessed in light of the specific circumstances.
In cases suspected of constituting a crime, preliminary materials may be taken to the public security authority to file a report. The public security authority shall receive and review the relevant report or complaint materials in accordance with law, but whether the case can be criminally docketed still depends on whether the corresponding conditions are met.
Even if the asset transfer record has not yet been completed, it is still possible to truthfully explain circumstances such as unauthorized changes to permissions, impaired control capacity, and potential asset risks, rather than describing a token transfer that has not yet occurred as a completed theft.
05 What matters more than the asset balance is who truly holds control
The reason malicious multi-signature arrangements easily cause users to overlook risk is precisely that they do not necessarily immediately change the wallet balance.
On the surface, the tokens are still there; in terms of actual operation, however, the original holder may already be unable to exercise control.
For purposes of criminal law analysis, such cases must not focus only on whether a transfer ultimately occurred; attention should also be paid to how permissions were changed, whether the control relationship has undergone a substantive change, and by what means the actor obtained control permissions.
If, after a malicious multi-signature arrangement occurs, the entire balance is directly characterized as theft loss, the actual control differences arising from different permission structures may be overlooked; conversely, if it is considered that no illegal or criminal issue exists merely because the assets were not transferred away, conduct such as the unlawful acquisition of permissions that has already occurred may also be overlooked.
For affected users, the most important thing is not to immediately label the incident as "theft" or "fraud," but first to ascertain clearly the wallet's original control relationships, the process of abnormal permission changes, the actual asset status, and the conduct of the relevant persons.
Only when the facts and evidence are sufficiently complete is it possible to further assess criminal liability, choose an appropriate path for safeguarding rights, and evaluate the realistic possibility of asset recovery.
The fact that the tokens in the wallet are still there does not mean that the risk has not yet materialized. What truly needs to be confirmed is whether the power to control the assets remains in one's own hands.
