Are your virtual currencies truly secure?
Special Disclaimer:
This article is an original work by Mankun Law Firm. It reflects only the personal views of the author and does not constitute legal consultation or legal advice on specific matters. For permission to reprint this article, please contact Mankun Law Firm staff at: MankunLawFirm
Although the public attention surrounding the Mixin theft incident appears to have subsided, we continue to receive inquiries from friends seeking guidance on how to recover their losses on Mixin. Therefore, Attorney Liu believes it is necessary to discuss, from a legal perspective, the current laws and regulatory policies in China, the stance adopted in judicial practice towards virtual currencies, and how ordinary investors can better protect their rights and interests.
Background of the Incident
Mixin originated in 2017 and, considering the lifecycle typical of the crypto community, is already regarded as a long-standing project. However, on September 25, 2023, SlowMist issued a security announcement stating that in the early hours of September 23, the database of Mixin Network’s cloud service provider was subjected to a hacker attack, resulting in the partial loss of its assets, amounting to approximately $200 million. Mixin acknowledged the attack on its official Twitter account and stated that it had contacted Google and the SlowMist team to assist in the investigation.
As of now, Mixin has not disclosed the details of the attack, but a preliminary plan for compensating user losses has been established: Feng Xiaodong, the founder of Mixin, stated that Mixin would compensate users for up to 50% of their losses, with the remaining losses to be compensated in the form of bond tokens.
The majority of Mixin’s users are located in mainland China. Many are concerned about whether they can seek assistance under Chinese law after their virtual assets are stolen, which is also the most frequent question posed to Attorney Liu.
Can Chinese Law Exercise Jurisdiction?
From the perspective of Chinese law, the Mixin theft incident can be analyzed from two aspects: civil liability and criminal liability.
(I) Analysis of Civil Liability
The subjects of civil liability are the users and the Mixin platform. The users are entirely victims in this incident. As for the proportion of user losses to be borne by the platform—whether 50%, 100%, or another ratio—it primarily depends on the stipulations in the“Service Agreement” between the platform and the users, as well as the degree of recognition afforded to virtual assets in Chinese judicial practice.
According to the common legal sensibilities of ordinary people, if money is deposited into a platform and lost due to the platform’s improper custody, the platform should naturally bear full liability for compensation. However, in internet services, many platforms hold absolute dominance. For instance, in the Web2 world, the ownership of accounts such as WeChat and Douyin resides with the platform, while users possess only the right to use the software. Web3 attempts to create a decentralized world where users fully own their data; nevertheless, during the initial expansion phase of Web3, the participation of centralized institutions remains indispensable, such as major exchanges and the Mixin platform. Centralized institutions inevitably prioritize their own interests, and Mixin is no exception. In the “Disclaimer” clause of the “Service Agreement” signed upon user registration, Mixin explicitly states:
“It does not provideany express or impliedwarranties, including but not limited to warranties of merchantability, fitness for a particular purpose, title, non-infringement, andfreedom from computer virusesor other harmful substances in the code. Wedo not warrantthat any information provided by us is accurate, complete, or useful,that our serviceswill be operational, error-free,reliable, or secure...”
“You waiveany claims, complaints, causes of action, disputes... againstus, our subsidiaries, affiliates, and our and their directors, officers, employees, partners, and agents (collectively referred to as the “Mixin Parties”)
“for anyloss ofprofitsor consequential, special, punitive, indirect, or incidentaldamages related to our services; the Mixin Parties shall bear no liability...”
The overbearing nature of the aforementioned standard clauses is evident. However, Attorney Liu wishes to remind readers that:Even if users agreed to the above clauses during registration, it does not mean that courts will fully recognize the legal validity of such clauses.Standard contracts that unreasonably exclude one party’s primary obligations or restrict the other party’s primary rights have no legal effect in China.
Regarding the degree of recognition of virtual currencies in Chinese judicial practice, generally speaking, courts tend to deny the property attributes of virtual assets in civil cases, and many cases involving virtual currencies are not accepted for hearing. Therefore, even if the platform and users had agreed to the jurisdiction of Chinese courts (which, in reality, platforms generally do not), it would still be difficult for Chinese courts to accept the Mixin theft case.
(Image: Excerpts from Mixin’s “Service Agreement,” source: Mixin official website)
(II) Analysis of Criminal Liability
In terms of the nature of the act, this case constitutes a typical theft crime regardless of the country in which it occurred. Can the victims in the Mixin incident choose to report the crime to the police in mainland China? The answer is yes: According to the personality principle under China’s Criminal Law,the public security organsat the location of the victim have the authority to exercise jurisdiction over cases involving the theft of the victim’s assets.If the perpetrator(such as the hacker) is identified to be within China, the public security organs also have the authority to exercise jurisdiction over the case.
However, there are two practical issues here: First, whether the public security organs are willing to exercise jurisdiction. In practice, for cases involving rights protection related to virtual currencies, especially where the platform is hosted overseas and there are few domestic victims, the willingness of public security organs to initiate investigations is not high. Second, whether the public security organs have the capacity to exercise jurisdiction. Whether mainland Chinese public security organs can identify and solve the identity of the hacker and the methods of theft in the Mixin case is also a significant practical challenge.
How Virtual Currency Investors Can Protect Their Rights and Interests
Since issuing the “Notice on Preventing Bitcoin Risks” in 2013, China’s regulatory authorities have successively introduced multiple regulatory policy documents. The overall trend indicates an increasingly conservative and strict determination of the nature of virtual currencies. Against this backdrop, investors in virtual currencies must possess sensitivity beyond that required for conventional investments and transactions. Laws, regulations, and regulatory documents constitute red lines; crossing them not only fails to safeguard one’s property interests but may also lead to additional losses by violating Chinese laws, regulations, or regulatory requirements. When investing in platforms such as Mixin, it is essential to examine the platform’s operational model to ensure it possesses adequate security capabilities. In the current blockchain landscape in China, self-rescue and self-protection capabilities are far more effective than seeking remedies from other parties.
{loadmoduleid 245}
To submit articles or request permission for reprinting, please add WeChat ID: MankunLawFirm
