With the rapid development of the Web3 industry, an increasing number of entrepreneurs, practitioners, and investors are entering the Web3 space, giving rise to new business models. However, under the stringent domestic regulatory environment established by instruments such as the September 24 Notice, Web3 and virtual currencies remain in a regulatory gray area within mainland China whenever they involve financial transaction activities. Consequently, most project entities are incorporated overseas to mitigate domestic legal risks.
In actual operations, Web3 projects often involve critical aspects such as on-chain asset management authority, private key custody, fund flow arrangements, and profit distribution mechanisms. Once disagreements arise among team members regarding fund handling, exercise of authority, or business decisions, internal management disputes may gradually escalate into allegations at the criminal level, such as whether there has been improper appropriation of project assets, abuse of authority, or the use of information advantages to obtain illegitimate benefits.
When disputes arising in the Web3 industry involve criminal offenses:
For the project party (the complainant):
Is it permissible to file a criminal complaint with public security organs in mainland China?
Will filing the report lead to reverse liability against the complainant because the project itself involves “virtual currencies or on-chain financial attributes”?
For the accused party (the alleged infringer):
In the face of criminal accusations from the project party, how should one assess whether the accusations are substantiated?
Which evidence may be pivotal to the final determination of the case? Which aspects offer potential avenues for defense?
From the perspectives of procedural law and evidentiary rules, this article outlines core issues that Web3 project parties may encounter when filing criminal complaints in mainland China, including the qualifications of the reporting entity, the identification of the victimized entity, jurisdiction, and the legality of evidence. This analysis is provided to assist relevant parties in evaluating and preparing before making decisions, thereby reducing uncertainty in subsequent proceedings.
I. Author: Attorney Shao Shiwei
As a complainant, if you wish to initiate a criminal complaint within the mainland of the People’s Republic of China (PRC) to hold the infringer accountable, you must first establish a prerequisite: the infringer is located within the mainland PRC. If the infringer is in the Hong Kong Special Administrative Region or overseas, even if the domestic public security organs accept the case for investigation, there is a high probability that no further action will be taken. For the reasons, please refer to the article “Can Chinese Public Security Organs Conduct Cross-Border Arrests for Telecommunications and Online Fraud Committed Abroad?,” which will not be reiterated here. This is also why, for many overseas Web3 projects that engage in exploitative practices, domestic users’ reports to the police are often futile, as the individuals involved are typically located overseas.
Under this premise, we now proceed to the main discussion. For the complaining party, the following issues must first be addressed:
What materials must be submitted when reporting the case? To which public security organ should the complaint be filed? If a report is made to the public security organs, will they determine that our party is engaged in illegal business activities and instead initiate an investigation against us?
1
Who is qualified to file a complaint as the “victim entity”?
For Web3 project operators, if project personnel are involved in accepting commercial kickbacks from counterparties, embezzling or misappropriating project funds by taking advantage of their positions, or if project funds are subject to fraud, theft, or similar offenses, which entity should file the report as the victim entity? This depends on whether the Web3 project operator has established a physical corporate entity within the PRC, and shall be discussed on a case-by-case basis.
Generally, Web3 platform operators often establish their project entities in jurisdictions such as Hong Kong, Singapore, or the Cayman Islands. Meanwhile, considering factors such as labor costs and ease of communication and management, they may recruit employees within the PRC.
For larger-scale platforms, such as virtual currency exchanges, it is common to cooperate with domestic third-party companies, whereby the domestic third-party outsourcing company signs labor contracts with employees and pays social insurance contributions. However, many Web3 project operators have the actual controller, or a third party designated by the actual controller, establish a company independently, using that company as the entity to hire employees, pay social insurance contributions, and disburse salaries.
In such circumstances, identifying the appropriate entity to file the report becomes key to whether the case will be accepted for investigation.
If the Web3 project operator registered overseas actually suffers losses, can a domestic entity file a complaint as the victim entity?
By reference to traditional criminal cases, if a foreign-invested enterprise is the victim entity and has subsidiaries, branch offices, or representative offices within the PRC, such subsidiaries, branch offices, or representative offices may jointly file a complaint together with the foreign-invested enterprise as victim entities.
Therefore, if a Web3 platform can demonstrate that its domestically incorporated entity has a certain degree of affiliation with the platform, the domestic entity should be able to jointly act as the victim entity and file a criminal complaint.
However, in many Web3 projects, although the project entity is established overseas, it establishes labor relationships with domestic employees solely through third-party human resources outsourcing companies. This gives rise to a practical issue: Can the cooperating company file a criminal complaint as the "victim entity"?
From the perspective of legal relationships, third-party outsourcing companies typically do not directly participate in the management of project funds, nor do they enjoy the rights to control or benefit from the assets involved in the case. Consequently, their standing is often difficult to recognize as that of a victim entity. If a report is filed in their name, there may be a risk of challenges based on the lack of direct losses or a foundational right.
Nevertheless, in judicial practice, there are instances where the cooperating company acts as the reporting entity, with its staff submitting materials on its behalf. While this approach has indeed facilitated the initiation of investigative procedures in certain cases, it also provides the defense with a point of contention regarding whether the reporting entity aligns with the entity holding the actual interests.
For Web3 project operators, another key issue must be addressed: Whether the platform itself can be recognized as a "victim entity" under the Chinese legal framework.
Certain Web3 business models, such as on-chain prediction markets, derivatives trading, and on-chain token liquidity matching, have clear regulatory statuses in some countries and regions. However, in mainland China, because virtual currency-related businesses are included within the "scope of key prevention and prudent regulation," judicial authorities often consider two aspects when determining whether a platform possesses "lawful rights and interests":
-
Whether the entity's qualifications comply with legal requirements (i.e., whether it holds compliance qualifications for operations within mainland China);
-
Whether the business activities involved fall within areas prohibited or restricted by domestic laws.
Therefore, if the platform's core business constitutes a prohibited scope of operation in mainland China, its legal basis for acting as a "victim entity" will be constrained, and the corresponding path for filing a complaint will become more complex.
This does not mean that all Web3 businesses are unable to obtain victim status. If the nature of the platform's business does not touch upon areas explicitly prohibited domestically, and if it can demonstrate actual harm and a connection to asset rights and interests, it may still be recognized by judicial authorities as a victim entity.
2
Will filing a report conversely trigger risks for the Web3 project operators themselves?
This is one of the primary concerns for project operators when considering filing a criminal complaint.
In light of domestic policy provisions such as the September 24 Notice, activities related to virtual currencies are characterized as illegal financial activities. Therefore, if a project initiator reports the case to the police, an assessment of the legality of the project itself is required; otherwise, it will not only be difficult to be recognized as a "victim entity" under Chinese law, but may even expose the initiator to criminal liability.
However, illegal financial activities are not equivalent to criminal offenses, or specific criminal charges. The level of business risk still needs to be comprehensively assessed based on factors such as whether the business is conducted towards users in mainland China and whether it absorbs funds from domestic users.
Precisely because many project initiators are uncertain about this point, some individuals exploit their concerns regarding "domestic risks" to commit extortion under the pretext of "exposure," "rights protection," or "reporting."
For example, reports have mentioned [i] that on October 16, 2023, Billy Wen, founder of Negentropy Capital, stated on the X platform that his fund had been extorted by a so-called rights-protection gang after participating in the investment of a Web3 project the previous year. He reported the case to the Longgang Police in Shenzhen, and the case was accepted for investigation. The suspect, Wu Moumou, is alleged to have attempted extortion involving 50,000 USDT (totaling more than 300,000 yuan). Wu Moumou claimed that he was instigated by a prominent Twitter influencer named BitRun, who provided fabricated materials for false rights protection, and that the extortion was carried out online. The court is scheduled to hear and pronounce judgment on the case in the near future.
It is evident that, even under a backdrop of prudent regulation, not all project initiators find themselves without recourse for rights protection. As long as they can clarify the basis of their rights and interests and conduct a preliminary assessment of the legality risks of their business, they may still obtain support from judicial authorities.
3
Where to Report to the Public Security Bureau? — Determination of Jurisdiction
Where should one report to the public security bureau, and which public security bureau has jurisdiction over the case? For the reporting party, if this issue is not determined beforehand and a report is made rashly, the following situations may arise:
-
The public security bureau refuses to accept the case on the grounds of "lack of jurisdiction"
-
Mutual referral and shirking of responsibility among public security bureaus in different regions
-
Even if the case is accepted for investigation, the defense may later raise objections based on "improper jurisdiction," affecting the course of the case
Therefore, clarifying jurisdiction is the first step in determining whether the path for rights protection is feasible.
In China's territorial jurisdiction for criminal cases, jurisdiction based on the place where the crime was committed is the principle, while jurisdiction based on the defendant's place of residence is the exception. At the same time, there are also provisions regarding jurisdiction in special circumstances, such as cybercrimes.
Under the basic rules of territorial jurisdiction, if a Web3 project initiator files a criminal complaint, at least part of the locus delicti must be within the territory of the People’s Republic of China. How should the locus delicti be understood? In Web3 scenarios involving on-chain assets, permission management, and cross-jurisdictional personnel collaboration, the locus delicti is not limited to offline physical locations but includes any of the following places where relevant acts occur:
-
The place where project funds or digital assets are transferred or controlled
-
The place where private keys or account permissions are operated
-
The place where asset losses ultimately materialize
-
The place where proceeds of crime are obtained, concealed, or used
In other words, on-chain operations ultimately manifest at certain nodes in the real world, whether through individuals, devices, or fund flows. These “points of manifestation” themselves constitute the scope potentially subject to territorial jurisdiction under domestic judicial practice.
For criminal offenses such as theft and fraud, complaints are generally filed with the criminal investigation departments of the public security organs at the place where the theft or fraud was committed, or where the transfers (of fiat currency or cryptocurrencies) were made or received.
For criminal offenses such as bribery by non-state functionaries, occupational embezzlement, and misappropriation of funds, if the Web3 project initiator has branch offices within China, reports may be filed with the economic crime investigation departments of the public security organs at the location of such branch offices. For Web3 project initiators without branch offices in China, reports may be filed with the economic crime investigation departments at the place where the crime was actually committed or where the suspect resides.
4
Extraterritorial Evidence and On-Chain Forensics: Is Notarization and Authentication Required?
The business operations, account systems, asset management, and communication and collaboration of Web3 projects often take place on overseas servers, on-chain systems, or cross-border communication tools. Therefore, when filing criminal complaints, a practical issue frequently arises:
Can such evidence be used directly in China? Is notarization and authentication mandatory?
Pursuant to the Criminal Procedure Law, if a Web3 project initiator collects materials related to the facts underlying the criminal complaint, including documentation authorizing agents (such as employees or lawyers), such documents must undergo notarization and authentication. If they are in a foreign language, Chinese translations must also be attached.
Interpretation of the Supreme People's Court on the Application of the Criminal Procedure Law of the People's Republic of China (effective March 1, 2021; Judicial Interpretation [2021] No. 1).
Article 77: With respect to evidentiary materials obtained from outside the territory, the people's procuratorate shall, together with the case file, submit explanations concerning the source of the materials, the provider, the person who collected them, and the time of collection. Upon review by the people's court, if such evidentiary materials are capable of proving the facts of the case and comply with the provisions of the Criminal Procedure Law, they may be admitted as evidence, except where the provider or a bilateral treaty concluded between China and the relevant country expressly restricts the scope of use of such materials. Evidentiary materials whose source is unknown or whose authenticity cannot be confirmed shall not serve as the basis for determining the case.
Where a party and its defender or litigation agent submit evidentiary materials obtained from outside the territory, such materials shall be notarized by a notary public in the country where they originated, authenticated by the central foreign affairs authority of that country or an authority authorized by it, and then legalized by the embassy or consulate of the People's Republic of China in that country; alternatively, the certification procedures stipulated in relevant treaties concluded between the People's Republic of China and that country may be fulfilled, except where China and that country have an agreement providing for mutual exemption from legalization.
Article 78: Where evidentiary materials submitted by the prosecution or the defense involve a foreign language or script, Chinese translations shall be appended.
It should be noted that, in practice, the core standards applied by Chinese judicial organs when reviewing extraterritorial evidence are the authenticity and legality of the evidence, rather than a rigid, one-size-fits-all formalistic approach. Notarization and legalization are important means of ensuring the authenticity of extraterritorial evidence, but they are not the only means. Moreover, even for evidentiary materials that have undergone notarization and legalization, the court must still review and determine whether to admit their probative content after hearing the opinions of both parties and conducting cross-examination during trial.
In addition, Web3 criminal cases often involve electronic data. As defense counsel, greater emphasis will be placed on presenting defense arguments addressing the four core dimensions of electronic data—legality, authenticity, integrity, and relevance—with the aim of excluding illegally obtained evidence or undermining its probative value.
5
Concluding Remarks
In practice, influenced by policies such as the September 24 Notice, Chinese judicial organs generally adopt a relatively prudent and conservative stance toward Web3 projects as a whole.
Furthermore, because most Web3 project entities are established overseas and often lack a physical presence within China, issues such as the identification of the reporting party, the qualification of victimized entities, and the assessment of business attributes are inherently contentious. Consequently, if project sponsors seek to enforce their rights through domestic criminal proceedings after suffering infringement, they must indeed contend with additional preliminary determinations and procedural costs.
This does not mean, however, that the Web3 sector exists in a legal vacuum.
For example, Huobi employees were convicted and sentenced for the crime of illegally obtaining computer information system data after stealing users' private keys; similarly, the individual surnamed Wu referenced in this article was subjected to investigation and prosecution for extortion. These cases demonstrate that when conduct itself crosses the boundaries regulated by criminal law, judicial organs will still intervene and initiate the corresponding procedures.
In other words, whether conduct violates the law depends primarily on the nature of the conduct itself, not on industry labels. The emergence of such cases alone should suffice to alert practitioners to the associated risks.
[i] Negentropy Capital Discloses Extortion by a “Rights-Defense Syndicate” Linked to Web3 Projects, Allegedly Instigated by BitRun, a Prominent Twitter Influencer | Tencent News
