On January 19, 2026, according to media reports,[i]a network engineer was accused of stealing funds from a gambling website and was successively placed under case investigation by police in two jurisdictions, with 183 bitcoins seized, worth as much as more than RMB 80 million.
In January 2026, this case was publicly heard in a Henan court.
This is a typical virtual asset "black-on-black" criminal case.In practice, similar cases have not been uncommon in recent years, and in the course of handling cases I have also encountered and represented multiple cases with circumstances similar to this one.
Many parties and their family members, in the early stage of a case, often misjudge key issues such as "theft of virtual assets," "whether black-on-black conduct constitutes a crime," and "whether the charge is established," and lack a clear assessment of the direction of the case, the determination of charges, and evidentiary issues, ultimately missing the opportunity to pursue a favorable outcome.
Based on the case information that has been disclosed and combined with criminal defense practice, this article addresses several issues of greatest concern to parties and their family members:
Why is "black-on-black" conduct also subject to accountability?
What disputes over charges and key defense points do such cases usually involve?
How should parties and their family members respond in such cases?
I Author of this article: Attorney Shao Shiwei
1
Basic Facts of the Virtual Currency "Black-on-Black" Theft Case
Case Background:
Li Dong (pseudonym), an IT professional in Shenzhen, is a network information security engineer who majored in information security at university. He successively worked in network security technology roles at several well-known internet companies, later settled in Shenzhen, and in recent years has been an entrepreneur running an internet company.
Roughly from 2016 onward, Li Dong began trading stocks and crypto, and came to hold some Bitcoin. However, police investigations later concluded that the source of his Bitcoin was otherwise.
Arrest Process:
In May 2024, based on a lead from an "anonymous report," the Zhangjiajie police identified Li Dong as a criminal suspect. The Zhangjiajie Municipal Public Security Bureau subsequently summoned Li Dong on suspicion of operating a gambling house, and seized 103 Bitcoin from his digital wallet, later liquidating that portion of Bitcoin for an amount of more than RMB 49.61 million. Li Dong was thereafter released on bail pending trial.
Only four days after being released on bail pending trial, Li Dong was again taken away by the Changge Municipal Public Security Bureau of Henan Province. According to media disclosures, this was because gambling participants with Changge household registration reported that "Kaiyun Sports" was a gambling website, and Li Dong was suspected of being connected to that gambling website. The Henan police seized 80 Bitcoin from him (with a market value of more than RMB 40 million), and Li Dong was thereafter arrested by the Henan police.
(Image source: Tong[i]）
Alleged Facts:
According to reports, Li Dong exploited program vulnerabilities in the servers of an overseas online gambling website and, through technical means, stole the personal information of more than 1.84 million Chinese citizens from that gambling website; and from the agent accounts of the gambling website, he selected agent accounts with high commission rebate ratios and numerous downline members, replaced the rebate bank accounts of those agent accounts with bank accounts under his own control, and stole the "agent rebate funds of the gambling website."
Changes in Charges:
As the case progressed, Li Dong's charges changed multiple times:
The Zhangjiajie police opened an investigation against him on a charge of online gambling, but later changed the charge tothe crime of illegally obtaining computer information system data。
The charge on which the Changge Municipal Public Security Bureau criminally detained Li Dong was the crime of running a casino, but thereafter the Changge Municipal People's Procuratorate, on suspicion ofthe crime of theft, and the crime of infringing on citizens' personal information, instituted a public prosecution against Li Dong.
2
Common features of this type of virtual currency theft case
This is a non-contact crime with a high technical threshold and a high degree of concealment.
Over the years, in many criminal cases handled by Attorney Shao, the clients' backgrounds have been similar to Li Dong's: most were well-educated technical professionals, some holding master's degrees and even doctoral degrees. They are highly familiar with their own fields, but when it comes to legal risks, they often show a clear lack of awareness or harbor wishful thinking, thereby underestimating the consequences their conduct may bring.
For example, the party in this case, as a network information security engineer, precisely on the basis of his technical advantage of being relatively familiar with blockchain technology, while at the same time holding an erroneous legal understanding, carried out the theft of virtual currency from gambling websites.
According to the aforementioned facts of the case, he exploited a program vulnerability in the servers of overseas online gambling websites, obtained citizens' personal information from those gambling websites through technical means, and screened out from the gambling websites agent accounts with high commission rebate ratios and many downline members, then replaced the rebate bank accounts of those agent accounts with bank accounts under his own control, thereby achieving the purpose of stealing "the agent rebate funds of the gambling websites."
Then, Li Dong mayWhat possible technical means were employed?
First, he needed to discover vulnerabilities in the website servers, databases, or agent management backend, such as SQL injection, logic flaws, unauthorized access, and the like.
Second, he needed the capability to process and analyze large-scale data. This may be achieved through technical means (such as exploiting vulnerabilities to export databases, intercepting network data packets, or compromising the management backend) and other technical means.
Third, in order to achieve his goal of "selecting agent accounts with high commission rebate ratios and many downline users" to maximize his interests, he needed to screen agent accounts; therefore, he needed a thorough understanding of the gambling website's core business logic, including its agent hierarchy, commission rebate calculation rules, and fund flows.
Finally, replacing the agents' commission rebate accounts with his own accounts required him to understand the bank card verification and binding procedures, and he may have exploited system vulnerabilities or social engineering to bypass security checks (such as SMS verification and facial recognition).
The question then arises: what Li Dong obtained was not another person's lawful property, but illegal funds in a gambling website. Does such conduct still constitute a violation of law? And why would he be held criminally liable?
3
Why is stealing virtual currency from a gambling website still subject to accountability?
1. Virtual currency and gambling funds are not protected, so why may theft still constitute a crime
Due to characteristics such as anonymity, virtual currency is widely used by the black and gray industries as a tool for money laundering and for transferring criminal proceeds and other illicit funds. Especially on gambling websites, supporting virtual currency deposits and withdrawals has gradually become a standard feature of a large number of gambling websites.
Lawyer Shao previously represented an agent of a certain blockchain game who was accused of the crime of operating a casino. The case arose because the agent's friend (a gambler) suffered financial losses and filed a lawsuit in court, and the court transferred the case to the public security organ.
But in fact, most people know that once held accountable for the crime of gambling or the crime of operating a casino, the relevant gambling funds are usually confiscated in accordance with law, and the gambling funds themselves are not protected by law.
It is against this background, combined with long-standing policy publicity, that statements such as "virtual currency cannot be equated with legal tender" and "virtual currency transactions are not protected by law" have gradually become "common knowledge" in the minds of many people.
Therefore, in cases involving theft of virtual currency, fraud, illegally obtaining computer information system data, and similar offenses, many parties hold a typical misconception:
Since virtual currency itself is not protected by law, even if someone appropriates another person's virtual currency and the other party reports it to the authorities, the other party cannot vindicate their rights; still less can the law convict on that basis.
2. Why does 'black-on-black' conduct still give rise to criminal liability?
In so-called 'black-on-black' cases, the property involved often comes from unlawful sources, such as gambling funds or proceeds of crime. The State of course has the right to recover and confiscate such property in accordance with law.
However, this does not mean that anyone may appropriate such property by committing new criminal acts.
If a perpetrator takes funds under another person's control by violence, threats, deception, intrusion into systems, or other means, that already constitutes a new and independent unlawful act. What the criminal law regulates is not merely 'ownership of property'; more importantly, it protects social order.
Therefore, in this case, even if the funds obtained by Li Dong originated from gambling websites, his conduct may still constitute a crime, and he may be held criminally liable in accordance with law.
It must be emphasized, however, that this does not mean the judicial authorities' findings of fact, choice of charges, or calculation of the amounts involved are necessarily free from dispute.
On the contrary, such cases often leave considerable room for dispute, and this is precisely where lawyers can focus their efforts after becoming involved. The relevant defense approaches will be further developed below.
4
In virtual currency theft cases, what key room for defense exists?
1. Issues of jurisdiction and profit-driven law enforcement
According to the circumstances of this case as disclosed by the media, because Li Dong had long resided in Shenzhen while the case-handling authorities were located in Hunan and Henan respectively, and because there were circumstances such as the seizure and liquidation of the Bitcoin involved amounting to more than RMB 80 million, Li Dong's family raised issues suggesting that the case may involve problems of territorial jurisdiction and profit-driven law enforcement.
However, because I am not the lawyer acting in that case and have not reviewed the case file materials, it would be inappropriate to make speculative judgments about the case in the absence of complete information; therefore, this part will not be elaborated upon.
However, looking only at the general situation of cases involving Web3 and virtual assets, among the several cases that Lawyer Shao has handled and worked on, profit-driven law enforcement is indeed a "disaster area" in such cases and is also an unavoidable practical issue in such cases (related reading:A Brief Discussion of the Phenomenon of Profit-Driven Law Enforcement in Criminal Cases Involving the Crypto Community）。
At the same time, the question of which locality should have jurisdiction over a case is likewise a focal point of frequent disputes in cases involving cybercrime and virtual assets (related reading:Different Judgments in Similar Cases? Research on the Issue of "Territorial Jurisdiction" in Criminal Cases）
However, family members of criminal defendants should be reminded that even if the above disputes exist, if the case-handling authorities continue to advance the case, then for defense counsel the more critical task remains returning to the case itself and seeking genuinely valuable room for defense from the aspects of evidence, facts, charges, and so on.
Specifically in such cases, defense is often not an empty discussion of "guilty or not guilty," but must come down to several core issues: how the nature of virtual assets is determined, whether the charges applied are appropriate, whether the data involved meets the threshold for constituting a crime, and whether the amount involved is supported by complete evidence. These issues directly determine the direction of the case and also directly affect the final disposition.
In light of the common characteristics of such cases, the relevant defense approaches can generally be developed from the following aspects.
2. Are virtual assets data or property? The impact of different determinations on charges
This is an issue that lawyers almost inevitably face when handling cases of virtual asset theft, fraud, embezzlement by employees, illegal acquisition of computer information system data, and the like.
This is because whether virtual assets are determined to be "data" or "property" will directly affect the application of charges and thus affect the sentence the defendant may face.
Where the amount involved is relatively large, the statutory maximum penalty for the crime of illegally acquiring computer information system data isseven years, while the statutory maximum penalty for theft, fraud, and embezzlement by an employee may reachlife imprisonment。
However, in judicial practice, significant disagreement remains over the characterization of virtual assets, and it is not uncommon for similar cases to be decided differently across different cases, different regions, and different case-handling personnel.
This is precisely where lawyers can play a role and secure meaningful room for effective defense in such cases.
Lawyer Shao has previously discussed this issue in some detail, so this article will not elaborate further; those interested may refer to the following articles:
In a Virtual Asset Theft Case, How Should the Value of the Assets Involved Be Determined?
3. Is it reasonable to impose concurrent punishment for the crimes of theft and infringement of citizens' personal information?
At present, the procuratorial authority has initiated a public prosecution against Li Dong on suspicion of the crime of theft and the crime of infringing citizens' personal information.
However, viewed in light of the circumstances of the case, Li Dong's direct purpose in obtaining the relevant information was to screen agent accounts with high commission-rebate ratios and large numbers of downline members, so as to achieve possession of the rebate funds of the gambling website.
Against this background, Lawyer Shao is of the view that his conduct in obtaining the information is more consistent with a preliminary step and necessary means serving the commission of the act of theft, and should be evaluated as a whole, rather than mechanically split into two independent crimes.
What Li Dong focused on and primarily obtained was the business data of agent accounts (such as account IDs and performance figures); his core purpose was to screen targets, not to obtain citizens' privacy. A large volume of personal information unrelated to the purpose of theft (such as the mobile phone numbers and addresses of ordinary gamblers) may have been obtained incidentally during bulk export, which reflects the crudeness of his criminal tools rather than a separate and independent intent to infringe citizens' personal information.
Although the operations could technically be separated, legal evaluation should focus on the actor's subjective plan and the overall course of conduct. A course of conduct involving browsing, analyzing and exporting relevant data for the purpose of committing theft should be regarded in criminal law as one continuous criminal process to be evaluated as a whole; artificial dissection amounts to a mechanical understanding of complex criminal conduct.
If the prosecution intends to prove that Li Dong harbored two independent criminal intents, it is necessary to adduce evidence proving:
-
that when Li Dong intruded into the system, he already harbored two clear and separate intents, namely "to steal money and also to steal data to sell for money";whether the existing evidence (such as his communication records and chat contents) can prove an intent to sell or otherwise use the data. If it cannot, it should be presumed that all conduct served one overall intent.
-
whether the 1.84 million pieces of information involved were actually used in contexts unrelated to theft(such as being sold, provided to others, or used for other fraud, etc.). If the prosecution can only prove that "the information was obtained" but cannot prove that "the information was used independently," then such information remains a tool and component of the crime of theft throughout, rather than independent proceeds of crime.
4. Whether the quantity of citizens' personal information is sufficient to establish the crime
Conviction and sentencing in criminal cases must be based on reliable and sufficient evidence. Even if the court ultimately finds the defendant guilty, there remain viable defense arguments for seeking a lighter or mitigated sentence with respect to the data involved in the case.
With respect to the crime of infringing on citizens' personal information, the Criminal Law and the relevant judicial interpretations set relatively strict criteria for determining what constitutes 'citizens' personal information'; not all data can be recognized as citizens' personal information within the meaning of the Criminal Law.
In a case previously handled by Attorney Shao in which a company was accused of the crime of infringing on citizens' personal information, the public security authority initially alleged that the volume of infringing information involved in the casewas as high as 500,000 records, but after Attorney Shao screened and compared the data, it was found that a large quantity of the data did not meet the criteria for determining 'citizens' personal information' within the meaning of the Criminal Law. On that basis, Attorney Shao expressly proposed to the prosecutor that the case should be returned for supplementary investigation and requested that the data be re-examined in accordance with the relevant determination criteria.
Following re-appraisal and duplicate checking, the public security authority ultimately confirmed that the quantity of information meeting the criminalization threshold did not reach the 5,000-record filing threshold, the case was lawfully withdrawn, and the individual was not held criminally liable.
Accordingly, returning to the present case, if a large portion of the so-called '1.84 million records of information' consists merely of website account numbers, betting records, IP addresses, device information and similar data, while lacking key elements such as names and ID numbers capable of directly identifying specific natural persons, then whether such data constitutes 'citizens' personal information' within the meaning of the Criminal Law is likewise highly disputed.
Defense counsel also raised the points that, after the police became involved, the mobile hard drive storing the information was not sealed; that the electronic data bore traces of multiple modifications; and that much of the relevant personal information was not complete personal information. Accordingly, if the evidence-collection process violated statutory procedures and the integrity of the data was compromised, whether the electronic data involved in the case may be used as evidence for conviction and sentencing is a significant point of dispute in this case.
5. Are all 183 bitcoins proceeds of crime? Review of the source of the amount involved and the chain of evidence
According to media reports and as described by his family members, Li Dong began trading cryptocurrency around 2016 and owned bitcoins. Whether the 183 bitcoins seized by the police all originated from his theft from gambling websites, and whether there is a sufficient chain of evidence to prove this, are also focal points of the trial.
The media reports do not specify whether the agency commission rebate funds that Li Dong stole from the gambling website were in RMB, BTC, or stablecoins such as USDT (Tether). The reports state only that he 'transferred more than 6.44 million yuan of the stolen funds to purchase 13 bank cards' and 'used a certain group to purchase bitcoins and other virtual assets'.
This wording indicates that, after the funds involved entered his sphere of control, they underwent at least multiple conversions between fiat currency and virtual assets; if the matter also involved purchasing bank cards from others, using cold wallet addresses, or borrowing third-party accounts, the fund trail would be further lengthened and become more complex.
On the other hand, according to the account in the report, the judicial authorities ultimately directly seized the Bitcoin held in Li Dong's name. The key question then becomes: among the seized Bitcoin, which portions can form a complete chain of evidence proving that they indeed originated from the rebate funds of the gambling website? And which portions may be commingled with his early holdings of the coins, ordinary transactions, and other such circumstances? This must be verified transaction by transaction and matched item by item by the case-handling authorities; it cannot be presumed merely from the fact that 'coins were seized' that 'all of it is proceeds of crime.'
In the coin-related cases handled by Attorney Shao, in order to ascertain the source and destination of each sum of funds and to verify whether the chain of evidence for the case-related amounts alleged by the case-handling authorities is complete, Attorney Shao Shiwei's team typically conducts cross-verification of fund flows against on-chain data and prepares fund-flow charts (as shown below). Because the parties involved often have multiple cold wallet addresses and frequently use third-party accounts, each address and each transfer must be verified one by one.
(Part of the fund-flow chart prepared by Attorney Shao's team in a case it handled)
This work is extremely heavy and often requires several weeks of effort. Yet it is precisely through this transaction-by-transaction verification that one can more intuitively identify whether the case-related amounts alleged by the prosecution can truly be fully supported by the chain of evidence, or whether there are problems such as breaks in the chain, commingling in aggregation, or inflated calculations.
In addition, it is necessary to combine the audit reports, judicial appraisal opinions, and other materials that may appear in the case file, verify their calculation methods, sources of evidence, and bases for conclusions one by one, and further determine whether the relevant conclusions can withstand scrutiny.
5
Closing Remarks
It is hoped that this article will sound a warning to parties who harbor similar wishful thinking; after all, public security organs' level of understanding and case-handling capability in cases involving virtual assets are continuously improving.
Once involved in a case, because such cases often involve technical issues and large amounts of on-chain data, are highly specialized and complex, and, once a guilty finding is made, often involve particularly huge case-related amounts, the person involved may face fixed-term imprisonment of more than ten years. Therefore, one must not harbor blind optimism such as 'it will not constitute a crime' or 'the evidence is insufficient and cannot be clarified'; one should attach great importance to the matter and promptly seek the help of a professional criminal defense lawyer.
[i] Network engineer accused of stealing gambling website funds; police in two jurisdictions successively opened cases and seized 183 Bitcoin_No. 1 Special Project_The Paper https://www.thepaper.cn/newsDetail_forward_32414856
Recommended Reading
