Introduction
The person resides in Guangdong and has traveled to and from Macau multiple times since March of this year, acquiring USDT with cash in Hong Kong dollars and then selling it through an exchange account to profit from the price difference. A few days ago, Henan police came to Guangdong to take a statement from him and informed him that the coins he acquired were proceeds of theft by others; he is currently provisionally placed under case filing on suspicion of theft.
Many friends engaged in OTC trading may encounter this situation. Today we will break it down:
I. Whether this conduct constitutes a crime at all;
II. If it does, whether it is the crime of illegal business operations, the crime of concealing or disguising criminal proceeds, or the crime of theft, and how the amount involved is determined;
III. Whether there are any issues concerning jurisdiction;
IV. What can be done at present.
I. Whether buying and selling USDT constitutes a crime at all
Virtual currency is not a prohibited item, and buying and selling it per se does not constitute a crime, but the status of a professional USDT trader is somewhat special:
(1) The boundary between occasional and habitual activity
An individual's occasional holding and trading of virtual currency does not constitute a crime; the individual merely bears the loss. However, under the Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42), conducting within China the exchange between legal tender and virtual currency, currency-to-currency exchange, buying and selling as a central counterparty, and providing information intermediation and pricing services constitute illegal financial activities and are strictly prohibited without exception.
In this case, the person concerned did not buy only occasionally, but rather acquired and sold coins on a long-term, bulk basis and made a living from the price difference. This conduct carries three adverse consequences: 1. There may be an additional charge of illegal business operations in the form of illegal foreign exchange trading; 2. The presumption of knowledge is stronger; 3. The investigative authorities' presupposition regarding his role is more unfavorable.
(2) Is this the illegal business operation crime of illegal foreign exchange trading?
The People's Court Daily article "Exploring the Uniform Application of Law in Cases Involving Virtual Currency Crimes" notes that, when determining whether using virtual currency as a medium to effect exchange between RMB and foreign currency constitutes the illegal business operation of disguised foreign exchange trading, attention must be paid to the fact that the business operation element of the illegal business operation crime is characterized by habitual conduct and profit-seeking, so as to distinguish business operations from non-business operations.
At the criminal level, the core test for establishing the illegal business operation crime of disguised foreign exchange trading is whether the actor, targeting unspecified persons, conducts RMB-foreign currency exchange as a business externally and provides foreign exchange intermediary services. Two scenarios must be distinguished here:
1. If the person is a professional U trader who externally undertakes others' foreign exchange conversion needs, completing the conversion between foreign currency and RMB for unspecified entities and earning the price difference or a service fee, this is commercial in nature and, once the amount threshold is met, may be determined to be disguised foreign exchange trading, establishing the illegal business operation crime.
2. If the person merely disposes of their own foreign currency assets, using virtual currency as an intermediary to convert them into RMB solely for personal spending, without taking external orders or providing foreign exchange services to third parties, then even if the value conversion between RMB and foreign currency is objectively completed, the core element of "treating foreign exchange as a commercial business" is lacking, and generally the illegal business operation crime of the illegal foreign exchange trading type is not constituted.
However, under the Foreign Exchange Administration Regulations(), completing the exchange between RMB and foreign currency through virtual currency outside the statutory bank channels constitutes disguised foreign exchange trading in the sense of administrative law, and carries the administrative violation risk of warning, confiscation of illegal gains, and fines.
Outward conformity does not equal satisfaction of the constitutive elements of a crime.
Returning to this case, the party is a professional U trader who has long purchased and sold virtual currency to earn the price difference. The focus of assessment is not whether the source of a single asset is Hong Kong dollars or RMB, but whether the overall conduct constitutes providing foreign exchange intermediary services to others. Merely buying low and selling high virtual currency to earn the price difference is not directly equivalent to providing RMB-foreign currency exchange services to others. Absent evidence proving that the party externally undertook foreign exchange conversion business, the element of "treating foreign exchange as a commercial business" is lacking, and from a defense perspective, the author considers that the constitutive elements of the illegal business operation crime of the illegal foreign exchange trading type are not yet satisfied.
II. If a crime is constituted, is it theft or concealment and disguise
Because theft is not among the seven categories of predicate offenses for the money laundering crime, the money laundering crime is not discussed here.
The establishment of the concealment and disguise crime presupposes the existence of predicate offense facts. Where the predicate offense facts are verified as true but the actor has not yet been brought to justice, or criminal responsibility is not pursued due to death, lack of criminal responsibility capacity, or other reasons, this does not affect the determination of the downstream offense; conversely, if the upstream theft facts themselves cannot be verified—if who the victim is, how the U was transferred away, what the on-chain path was, and how much was lost are all unclear—then the assessment of the downstream offense loses its foundation. In the discussion here, we assume that the upstream theft crime has already been established:
(1) The dividing line between the two offences lies in whether there was any prior collusion
The Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Concealing or Disguising Criminal Proceeds and Proceeds of Crime provides that where a person colludes in advance with the perpetrator of theft, robbery, fraud or forcible seizure and thereafter conceals or disguises the proceeds, that person shall be punished as an accomplice to the crime of theft or the other such crime.
In this case, if the party concerned had agreed with the coin thief before the coins were stolen that "once the coins are in hand, I will sell them to you at a low price", and knowingly promised in advance to purchase the coins while aware that the other party was about to steal them, this constitutes accomplice liability for theft; if there was no prior collusion and the party concerned only learned, or ought to have known, of the improper source at the time of purchase or afterwards and nonetheless purchased the coins, the matter should fall back within the scope of the offence of concealing or disguising criminal proceeds.
Apart from the need for evidence to prove the collusion itself, coin-related cases also raise a technical issue: the point of consummation.
Theft is an acquisitive property crime; it is consummated when the victim loses control of the property and the perpetrator actually controls it. Once an on-chain transfer of USDT is sent out, it quickly reaches the counterparty's address and the transfer of control is immediately completed; the theft is already consummated at that point, and the party concerned's purchase necessarily occurs after consummation.
A person who intervenes only after consummation cannot be an accomplice to theft unless there is evidence proving a prior agreement; the person can only be assessed as dealing with the proceeds of crime after the fact. In other words, so long as the purchase occurred later than the on-chain time of the stolen coins and there is no evidence of prior collusion, a finding of accomplice liability for theft lacks a factual basis, and this can be established by on-chain data.
When the police "provisionally characterize the matter as theft", this usually follows one of two logics: suspicion of prior collusion, or fixing the charge at its most serious at the initial stage of investigation. Although the charge may be changed at the stages of approval of arrest, review for prosecution and trial, direct filing of a case as theft is still somewhat disadvantageous.
(2) How the amount involved is determined
Under the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Concealing or Disguising Criminal Proceeds and Proceeds of Crime, the amount of criminal proceeds and proceeds of crime concealed or disguised shall be determined as at the time the act of concealing or disguising is carried out; where the price at which the property is purchased or sold on another's behalf is higher than its actual value, the purchase or sale price shall be used for calculation; and where the act is carried out multiple times, has not been subject to administrative penalty and is legally subject to prosecution, the amounts shall be accumulated.
Theft, however, is an acquisitive property crime, and the result of infringement of legal interests is fixed once the perpetrator obtains the property. Accordingly, the amount of theft should be determined by reference to the value of the property involved at the time the theft was carried out and the perpetrator actually controlled it; the virtual currency involved may be converted into RMB by reference to the publicly disclosed transaction prices on mainstream trading platforms at the time of the act, and subsequent price fluctuations of the proceeds of crime, the price at the time of seizure and the price on the date of commissioned valuation do not affect the determination of the amount of theft.
Although the rule is clear, virtual-currency-related cases face an inherent preliminary obstacle: under regulatory requirements, no entity may provide pricing services for virtual currency, and practice varies across localities as to whether price-determination institutions and appraisal institutions can issue valuation opinions; most localities decline to accept such matters on the ground that there is no lawful pricing basis, while some localities issue determination opinions by reference to quotations on overseas platforms. Consequently, many case-handling authorities also obtain overseas platform candlestick charts, transaction snapshots and historical price screenshots on their own as the pricing basis; in such circumstances, the defence may raise evidentiary objections regarding the selection of platform, the timing of price-taking (opening price, closing price, average price, lowest price) and the authenticity of the data source.
In practice, two lines of adjudicative reasoning have gradually emerged:
1. Under the statutory valuation rules, the benchmark is the fair market price of the virtual currency at the time it was controlled by the perpetrator, with the victim's purchase cost and the proceeds realized upon disposal serving as secondary references. In practice, however, case-handling authorities frequently determine the amount of the theft by directly adopting the price on the day of seizure or the day of freezing, or by working backward from the amount the defendant realized upon disposal; this approach conflicts with the statutory valuation time point for theft cases. In addition, where the same virtual currency is subsequently resold and acquired by another party, the valuation time point at the concealment or disguise stage should shift to the time of the currency receipt and transfer in that instance; the valuation benchmarks at the theft stage and the concealment or disguise stage are independent of each other and cannot share the same price and time point.
2. The principle of making the victim whole for losses should be the basis. First, where the victim's purchase cost can be verified, the victim's actual input cost should be adopted as a priority, protecting only the victim's genuine property loss and excluding speculative premiums arising from market fluctuations; if the victim established the position at a low price, the amount of the offense should be reduced accordingly. Second, where the victim's purchase cost is difficult to verify, reference will generally be made to the amount the perpetrator actually realized upon disposal; where the illicit currency was disposed of urgently, the realized price is usually lower than the fair market price. Third, where neither the cost nor the realized amount can be verified, conversion should then be made by reference to the publicly disclosed average price on mainstream trading platforms at the time of the conduct.
If neither the victim's cost nor the circumstances of disposal and realization can be verified, and there is no reliable basis for price determination, then, in accordance with the principle of resolving doubt in favor of the perpetrator, the value of that portion of the virtual currency shall not be included in the amount of the offense.
Accordingly, defense counsel must also examine two matters in their work: 1. whether the time corresponding to the price data is precisely locked to the moment the perpetrator controlled the currency, and whether the hash transfer records and on-chain block timestamps correspond one-to-one with the time point at which the price was taken; 2. whether the valuation rules are applied separately by distinguishing between charges and between upstream and downstream stages, rather than simply applying a single unified RMB amount across all defendants in the entire chain.
III. Issues Concerning Jurisdiction in This Case
Under the Basic Law of the Macao Special Administrative Region, national laws apply in Macao only if they are listed in Annex III. The Criminal Law of the People's Republic of China()is not listed in Annex III, and the act of receiving USDT in Macao itself cannot serve as a basis for jurisdiction by mainland public security authorities.
Furthermore, acts committed in Macao by mainland residents cannot automatically be handled under the nationality-based jurisdiction provided in Article 7 of the Criminal Law. Macao is undoubtedly Chinese territory, and a crime committed in Macao by a mainland resident is a crime committed within the territory of the People's Republic of China, falling within the scope of territorial jurisdiction under Article 6; it is merely that, by virtue of the special provisions of the Basic Law, Macao exercises jurisdiction itself, and therefore the provisions of Article 7 concerning crimes committed by citizens outside the territory do not apply.
This position is also reflected in relevant statements in the official discourse of the Public Prosecutions Office of the Macao Special Administrative Region. In academic theory and practice, there are differing views on whether nationality-based jurisdiction can apply to crimes committed by mainland residents in Hong Kong and Macao; some hold that Article 7 may be relied upon for prosecution, and therefore whether this argument can be accepted in an individual case remains open to discussion. At the very least, however, it shows that the jurisdictional basis in this case is not self-evidently established and requires a direct response from the case-handling authorities.
In addition, under the Provisions on the Procedures for Public Security Authorities Handling Criminal Cases, a criminal case may be under the jurisdiction of the public security authority of the place where the crime was committed or of the place where the criminal suspect resides. The place where the crime was committed includes both the place where the act was performed and the place where the result occurred, and the place where the result occurred includes the place where the criminal object was infringed, the place where the proceeds of the crime were actually obtained, and the place where they were concealed, transferred, used, or sold.
Returning to this case, there are three categories of potential connecting points for mainland jurisdiction:
(1) The place of sale. Whether this connecting point is established depends on the actual form of the sale and realization stage: on which platform the order was listed, where the operating device was located, and whether the receiving account was domestic or overseas. If the perpetrator returned to Guangdong and completed the sale and realization through operations within the mainland, then the mainland may be identified as the place of sale, establishing a jurisdictional connecting point in Guangdong; if the entire operation was conducted on overseas platforms with proceeds received into overseas accounts, then whether the place of sale is within the mainland will be open to discussion.
(2) The place where the object of the crime was infringed. If the place where the victim's property suffered loss in the upstream coin theft case is in Henan, the Henan public security authorities may obtain jurisdiction on that basis; in practice, it also frequently occurs that the upstream case is investigated by Henan, and by tracing downward along the on-chain flow of funds, the matter is thereby implicated.
(3) Jurisdiction based on place of residence. The actor's place of residence is in Guangdong; under the procedural provisions, if jurisdiction by the place of residence is more appropriate, the Guangdong public security authorities also have a basis for jurisdiction.
IV. What Should Be Done at Present
(1) Retain defense counsel as soon as possible.
During the investigation stage, only lawyers may intervene in the case in the capacity of defender and, in accordance with law, apply to modify compulsory measures.
(2) Collect and preserve evidence capable of proving subjective lack of knowledge.
A comparison table between the purchase price and the market price for the same period, all communication records with the upstream seller, the corresponding payment vouchers, and the like; "not knowing they were stolen coins" cannot rest on oral explanation alone and must be supported by evidence.
(3) Keep one's hands in check and hold the bottom line on evidence.
Do not delete chat, transfer, or on-chain records; collusion to align testimony and coordinated statements are strictly prohibited.
(4) Sort out the transaction model and solidify evidence of the transaction identity.
If possible, substantiate an evidence chain showing independent transactions and the absence of any entrusted operation by others on one's behalf, so as to sever the risk of criminalization for the crime of illegal business operations.
(5) Anchor the main line of defense and focus on distinguishing the charges.
If there was no prior collusion with the upstream party before the virtual assets at issue were stolen, the basis for finding joint liability for theft does not exist, and the case should return to the evaluative framework of concealing or disguising criminal proceeds, with sentencing accordingly reduced; on that basis, further challenge the evidentiary standard for "knowingly."
(6) Advance on two procedural tracks.
On one hand, actively seek release on bail pending trial; on the other hand, assess the room for a jurisdictional challenge and for negotiated transfer, and seek to have the case transferred to Guangdong for jurisdiction; if the evidence chain is complete and the defense points are difficult to achieve, it is also necessary to assess in advance a plea of guilty and acceptance of punishment and a plan for returning illicit gains and making compensation.
In summary,Receiving stolen coins does not equate to committing theft; the key to characterization lies in whether you and the upstream party colluded in advance, what relationship you have with the upstream party, whether you conducted reasonable review and kept corresponding records during the transaction, and whether the transaction price can be corroborated against market conditions, among other things.
