Attorney Shao Shiwei | Legal Risk Analysis of Embezzlement in Web3 Projects: Dilemmas in Rights Protection, Obstacles to Accountability, and Judicial Trends

Frequent Occurrence of Occupational Crimes in the Web3 Industry

In the course of representing clients in criminal cases involving the Web3 industry, we have handled several typical cases of “internal personnel misappropriating company assets.” Although the following two cases have been anonymized and adapted, the issues they reflect are not uncommon in the industry.

Case One: A partner unauthorizedly used company assets for cryptocurrency trading, ultimately resulting in account deficits

The partnership comprised two partners: Partner A, who was responsible for technical development, and Partner B, who was responsible for external fundraising. The project had been in operation for many years and generated substantial profits. The partners agreed that, apart from daily expenditures such as employee salaries, only a portion of the remaining profits would be distributed monthly as living allowances, with the remainder retained in the project account.

It was not until Partner B requested a distribution of profits that Partner A disclosed that millions of yuan in project funds held in the account had already been used for cryptocurrency trading and had been entirely lost. Enraged, Partner B declared his intention to file criminal charges against Partner A for embezzlement by an employee.

In the second case, a technical employee copied the company’s quantitative trading system before resigning and used it for personal entrepreneurial activities to generate profits.

During his employment, the employee was a core developer of the quantitative trading system and was deeply involved in the research and development of the company’s quantitative strategies and trading systems, which generated significant investment returns for the company’s clients. Before resigning, the employee misappropriated the source code of the company’s trading system, subsequently formed an entrepreneurial team, and engaged in live trading using the stolen strategy to generate profits.

Upon discovering the irregularities, the company initiated criminal complaint proceedings, seeking to hold the individual accountable on a consolidated basis for the crimes of infringement of trade secrets and embezzlement by an employee.

Although the specific circumstances of these two cases differ, they both point to a prevalent phenomenon in the Web3 industry:

Under circumstances characterized byblurred team boundaries, highly concentrated technical control, and the absence of project compliance mechanisms,project assets are often susceptible to misappropriation by insiders, while the boundaries of criminal liability frequently remain unclear.

Why is it difficult to pursue accountability for embezzlement by employees in the Web3 industry?

Frankly speaking, compared with traditional industries, the number of occupational crimes in the Web3 industry is not insignificant, and the amounts involved are often higher. Why, then, do we rarely see official investigations or media reports on such cases?

In handling such cases, the most common practical issues we encounter are as follows:

1、 Domestic Policy Orientation

Since the issuance of the "September 4 Announcement" and the "September 24 Notice," the entrepreneurial environment in the Web3 industry, particularly for activities involving financial services, has remained under stringent regulatory scrutiny.
 Typical cases are intended to serve as warnings and educational references, providing certain guidance for project parties seeking to protect their rights. However, the positioning of such cases is inconsistent with the current mainstream policy orientation.

 Even though concepts such as stablecoins and real-world assets (RWA) have recently garnered significant discussion domestically, it is widely understood that these activities do not genuinely "land" or operate within mainland China.
 Therefore, it is difficult to imagine that the Supreme People's Court and the Supreme People's Procuratorate would publicly release a typical case stating that domestic police authorities helped project parties recover losses and retrieve tens of millions in virtual currencies—such a scenario indeed sounds implausible.

2Insufficient Understanding by Judicial Personnel Regarding Such Cases

For most frontline law enforcement personnel, the "crypto-related cases" they most frequently encounter typically involve "money laundering using virtual currencies" or constitute offenses such as aiding information network criminal activities or concealing crime-related proceeds.
As for what Web3 projects actually do, many officials indeed find it difficult to understand.

If you explain that your project involves building a public blockchain, developing decentralized finance (DeFi) protocols, implementing quantitative trading strategies, or managing domain names, the counterpart may completely fail to comprehend.
They do not understand the terminology, cannot grasp the business model, and thus find it even more difficult to determine the nature of the conduct.
When asked to determine whether the matter constitutes a "criminal offense" or an "internal corporate dispute," they may simply decline to act due to lack of understanding, which naturally prevents the initiation of a formal investigation.

3Project Parties Prefer Private Remedies Over Resorting to Public Authority

Because domestic authorities classify virtual currency-related business activities as illegal financial activities, project sponsors and Web3 entrepreneurs often exhibit a pronounced sense of evasiveness: servers are hosted overseas, personnel work remotely, and daily communications and collaboration rely on "self-destructing" messages.When considering filing a report with domestic authorities, their first concern is whether they themselves might be subjected to coercive measures.。

Accordingly, they tend to prioritize negotiations with the infringer and engage mutually accepted intermediaries to facilitate settlement; filing a police report is typically regarded as a last resort.

4Early-stage "compliance and risk management" considerations regarding jurisdiction have instead impeded rights enforcement.

In"Can Offshore Project Launches Evade Chinese Jurisdiction? Compliance Misconceptions That Web3 Entrepreneurs Must Not Overlook","text:t0042":"Attorney Shao noted that a compliance misconception easily overlooked by Web3 entrepreneurs and practitioners is the belief that registering a project offshore and deploying servers overseas achieves "inherent compliance." However, when they become victims seeking to file complaints and enforce their rights, they encounter a series of practical obstacles:In the article, Attorney Shao noted that a compliance misconception easily overlooked by Web3 entrepreneurs and practitioners is the belief that merely registering a project overseas and deploying servers abroad achieves “inherent compliance.” However, when becoming a “victim” and seeking to file complaints and protect their rights, they encounter a series of practical operational obstacles:

• Many Web3 projects fail to establish a formal corporate structure in their early stages, resulting in fund management falling into gray areas such as "founder-controlled wallets," "developer nominee holdings," or "agent custodianship." This raises the question of whether these assets constitute corporate property or personal property.

• If a Web3 project operates through a non-profit entity such as a British Virgin Islands (BVI) company or a foundation, can the individuals involved qualify as subjects of criminal liability under Chinese Criminal Law, for example, for the crime of occupational embezzlement?

• Partners are located abroad, and, generally, domestic public security organs do not conduct cross-border arrests. Alternatively, employees work in a distributed manner without signed labor contracts or cooperation agreements, and remuneration is paid in tokens. How should their employment status be determined, and whether their actions constitute "acts performed in the course of employment"?

Unless these practical issues are resolved, it is impossible to determine which authority has jurisdiction, let alone initiate case-filing procedures.

5Practitioners' own lack of recognition of the legitimacy of their work

The Web3 industry’s “high risk, high freedom, and high growth” are precisely what make it most attractive.

Many practitioners who have transitioned from traditional industries choose to enter Web3 for various reasons: some are drawn by the higher salaries offered, while others, having made profits from trading crypto assets, go all in.

From the cases handled by Attorney Shao, it is evident that this industry remains in a stage of unregulated, wildcat growth. We have seen quantitative trading teams entrust the management of user funds amounting to hundreds of millions of yuan to a recent college graduate, with no regulatory mechanisms in place, resulting in total losses within days. We have also encountered technical personnel who engaged in self-dealing, transferring millions worth of project assets directly into their own wallets before completely withdrawing from the team.

In reality, many individuals do not regard themselves as “company employees,” nor do they distinguish between actions falling within the scope of their job duties and those that cross legal or ethical boundaries. They prioritize returns and liquidity, focusing on how much money they can earn and how quickly they can cash out, while remaining insensitive to the boundaries of rights and responsibilities.

Under such a mindset, the risks of asset misappropriation and abuse of authority naturally become significantly higher.

Even among industry practitioners, many exhibit impetuosity and a lack of recognition of their own professional value. The screenshots speak for themselves and provide the most intuitive illustration.

(Image source: Xiaohongshu – Communications among Web3 developers regarding the industry)

Judicial Progress: Web3 Practitioners Must Not Rely on “Survivorship Bias”

1An increasing number of law enforcement agencies are leveraging blockchain technology to investigate and solve cases.

Although embezzlement cases within the Web3 industry have historically faced awkward challenges in seeking legal recourse in China, judicial personnel are gradually deepening their understanding of virtual currencies and the Web3 industry. An increasing number of judicial officers have begun proactively studying virtual currency and blockchain knowledge, applying these tools in the handling of such cases.

For example, in the aforementioned case involving Feng, a senior executive at a major short-video platform, he embezzled 140 million yuan from the company. He further transferred and concealed the illicit proceeds through eight overseas cryptocurrency trading platforms and mixing services. However, by relying on blockchain analysis to trace cross-border fund flows, law enforcement authorities ultimately secured the return of 92 bitcoins from the suspect, helping the victimized entity recover more than 89 million yuan in stolen assets.

In another case heard by the Nanshan Court in Shenzhen, the defendant was a development engineer responsible for the development and testing of a blockchain project. Taking advantage of his position, he modified the project’s code to secretly transfer tokens held by the company to a wallet under his control, cashing out approximately 1 million yuan. The court ultimately sentenced him to two years’ imprisonment.

2, virtual currency trading platforms are also gradually deepening their cooperation with domestic law enforcement agencies

As Attorney Shao mentioned in"Are Virtual Currency Transactions Truly Anonymous? How Do Public Security Organs Trace Fund Flows and Identify Suspects?", mainstream exchanges (such as Binance, OKX, and Bitget), in consideration of compliance and meeting regulatory requirements, have publicly disclosed on their official websites the rules for evidence production requests from domestic and foreign law enforcement agencies, as well as dedicated channels for cooperating with public security organs in mainland China. Law enforcement personnel may send letters of assistance via email to exchanges, requesting the production of suspects' registration information, facial photographs, wealth management information, deposit and withdrawal transactions, wallet addresses for various cryptocurrencies, fiat currency transactions, crypto-to-crypto transactions, contract trading, login IP addresses, MAC addresses, and other device information.

For example, in a case adjudicated by the Xuhui District Court involving embezzlement by a former employee of Huobi, the employee inserted a backdoor program into the virtual currency wallet software to obtain users' private keys, intending to use these keys to illegally acquire users' virtual assets. The resolution of this case was inseparable from the platform's cooperation. Justin Sun responded to the case, stating, "From the outset of the investigation into this case, our company actively cooperated with the relevant authorities in carrying out various investigative and evidence-collection efforts, assisting the police in swiftly solving the case."

Conclusion

In cases of occupational crime within the Web3 sector, we must acknowledge that human greed and the lack of control over power do not disappear simply because activities are recorded on-chain, transparent, or decentralized. They have assumed different forms, becoming more concealed, more efficient, and more difficult to address.

Although rights protection in such cases still faces many practical obstacles under the current regulatory environment, in recent years, an increasing number of judicial personnel have begun to proactively learn about blockchain technology, and platforms are gradually cooperating with case investigations.

It is foreseeable that the industry is slowly but steadily moving toward openness and transparency.
Defining behavioral boundaries and enhancing governance capabilities will be a lesson that all Web3 practitioners must eventually confront.