One carries a maximum sentence of life imprisonment, while the other carries a maximum sentence of seven years.
Special Disclaimer: This article is an original work by Attorney Shao Shiwei. It reflects only the personal views of the author and does not constitute legal advice or a legal opinion on any specific matter. For article reprints, legal consultations, or business exchanges, please add: sswls66
On July 15, 2024, the official WeChat account of the Xuhui District People’s Procuratorate in Shanghai published a case involving the theft of a virtual currency wallet.
In judicial practice, there has been significant controversy over whether cases involving the theft of virtual currencies should be characterized as the crime of theft or the crime of illegally obtaining data from computer information systems.
It is one thing for different courts to hold differing views; however,can the same court actually render inconsistent judgments in similar cases?
By Attorney Shao Shiwei
01
Basic Facts
On a certain day in May 2023, Ou opened a virtual currency wallet application developed by Company A and discovered that virtual currencies worth millions had disappeared from the account.
Through analysis of the program, Ou noted the presence of a backdoor program within the virtual currency wallet application that automatically obtained virtual currency wallet addresses and private keys, and thereby traced suspicious user information.
According to the case description released by the authorities, the public security organssuccessively arrested two batches of individuals。
First, three employees of Company A—Liu, Zhang Jia, and Dong—were brought to justice. The three began collaborating in March 2023, stealing users’ private keys, mnemonic phrases, and other information. By the end of May, after securely storing the stolen information, they destroyed the servers and databases, agreeing to use these private keys two years later to access users’ virtual currencies. Upon verification, all three confessed that they had not breached the “two-year agreement” and had not accessed the users’ virtual currencies ahead of schedule.
(Image source: “Who Moved His Virtual Currencies Worth Millions,” same below)
Through further investigation, Zhang Yi was brought to justice. Zhang Yi had also been employed by Company A, and he had implanted backdoor programs into other virtual wallet software used by the victim, Ou. In April 2023, Zhang transferred the victim’s virtual currencies to his own wallet address and subsequently converted them into other assets.
Ultimately, the Xuhui District People’s Court held that the three employees of Company A—Liu, Zhang Jia, and Dong—as well as Company A’s former employee Zhang Yi, were all guilty of the crime of illegally obtaining computer information system data, and each was sentenced to three years’ imprisonment.
02
Analysis
1. Does the absence of profit still constitute this offense?
Upon reviewing the judgment in this case (Case No.: 2024 Hu 0104 Xing Chu 59), it is noted that Dong’s defense counsel argued that the defendant’s conduct constituted discontinuation of a crime, which is clearly incorrect.
Under the legal provisions governing the crime of illegally obtaining computer information system data, the objective actus reus of this offense consists of:obtainingdatastored, processed, or transmitted in such computer information systems, ortothe computer information systemand exercise unlawful control over it.
Liu, Zhang Jia, and Dong unlawfully obtained more than 27,000 mnemonic phrases and more than 10,000 private keys, successfully converting them into more than 19,000 digital wallet addresses. Under the applicable judicial interpretations, these acts meet the threshold for “particularly serious circumstances.”
Article 1 of the Interpretation of the Supreme People’s Court and the Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Endangering the Security of Computer Information Systems provides that unlawfully obtaining data from a computer information system or unlawfully controlling a computer information system shall be deemed “serious circumstances” as stipulated in Paragraph 2 of Article 285 of the Criminal Law if any of the following circumstances exists: (1) obtaining ten or more sets of identity authentication information for online financial services such as payment and settlement, securities trading, or futures trading; (2) obtaining five hundred or more sets of identity authentication information other than those specified in item (1); (3) unlawfully controlling twenty or more computer information systems; (4) deriving illegal gains of RMB 5,000 or more, or causing economic losses of RMB 10,000 or more; or (5) other circumstances constituting serious circumstances. The threshold for “particularly serious circumstances” is: (1) where the quantity or amount reaches five times or more the standards prescribed in items (1) through (4) of the preceding paragraph; …
2. Theft or the Crime of Unlawfully Obtaining Data from a Computer Information System?
In another judgment rendered by the Xuhui District People’s Court, Attorney Shao previously cited a case in an earlier article (→ Virtual Currency Theft Cases: How to Determine the Value of the Coins Involved?):
Case No.: (2023) Hu 0104 Xing Chu No. 856. Facts: Yang Mou, by analyzing and exploiting a remote code execution vulnerability in Yapi, obtained access to the target virtual currency website. He then controlled internal network servers through lateral movement within the intranet and by implanting trojan horses, located the server source code, downloaded and analyzed it to identify one virtual wallet address and the corresponding private key belonging to the victim, Su Mou, and constructed fraudulent instructions to transfer the virtual currencies from the victim’s virtual wallet address. Subsequently, he converted the virtual currencies into other virtual currencies and sold them, thereby obtaining illegal gains totaling more than RMB 2.5 million. Judgment: Yang Mou was convicted of theft and sentenced to ten years and six months’ imprisonment.
However, in the judgment in the 360 employee case, the Xuhui District People’s Court held in its reasoning that “the defense counsel’s argument that the conduct did not constitute theftbut only constituted the crime of unlawfully obtaining data from a computer information systemwas not accepted,because it failed to adequately assess the nature of the defendant’s subsequent acts of unlawfully obtaining property.”
After all, the maximum penalty for theft is life imprisonment, whereas the maximum penalty for the crime of illegally obtaining data from computer information systems is seven years. From the perspectives of both defense strategy and precedents in similar cases, it is unproblematic for defense counsel to argue that the defendant committed a computer-related offense carrying a lighter sentence.However, the logic of the judgment in this case is as follows: if the virtual assets were disposed of after the fact, the conduct constitutes theft; if they were not disposed of, it constitutes the crime of illegally obtaining data from computer information systems. Attorney Shao believes thatthis reflects a misunderstanding of the crime of illegally obtaining data from computer information systems.。
Examining the judicial interpretation of the crime of illegally obtaining data from computer information systems, one provision states that “(4) illegal gains of RMB 5,000 or more, or economic losses caused of RMB 10,000 or more” constitute one of the criteria for “serious circumstances” under this offense. From this, it can be inferred thatthis offense already encompasses the perpetrator’s subsequent disposal conduct.
In the case discussed earlier in this article, after Zhang Yi illegally obtained Ou’s virtual assets, he immediately converted them into other digital properties or virtual currencies—this conduct already amounted to liquidation. If we follow the understanding adopted in the judgment of the 360 employee case, should such conduct also be characterized as theft rather than a computer-related offense?
03
Concluding Remarks
Which criminal charge should apply in such cases remains uncertain. Until China provides a clear legal characterization of matters related to virtual assets,disparate outcomes in similar cases are likely to persist for an extended period.
For example, Li Hui, a Level-1 Prosecutor in the Second Procuratorial Department of the Haidian District People’s Procuratorate in Beijing, stated that “where the amount involved is particularly large, characterizing the conduct as a computer-related offense would result in disproportionately lenient sentencing, and whether such characterization serves the purpose of punishment warrants further scrutiny [1].” This view suggests inferring the applicable charge from the amount involved, such that, for instance, cases involving amounts exceeding one million yuan would all be classified as theft punishable by more than ten years’ imprisonment.
Yu Haisong, Director of the Criminal Division of the Research Office of the Supreme People’s Court, stated that “in the absence of clear underlying legal bases, the fact that something has property attributes does not necessarily mean it constitutes ‘property’ under criminal law, and property offenses need not necessarily be applied to the relevant conduct [2].” This view holds that although Chinese regulatory policies characterize Bitcoin and other virtual assets as property, regulatory policies are not statutory provisions; therefore, property offenses (such as theft) need not necessarily apply.
From the victim’s perspective, seeking relief is indeed difficult. In the case mentioned at the beginning of this article, based on reports from the official WeChat account, it can be inferred that after victim Ou discovered in May that his virtual assets had been stolen, he likely reported the matter to the police immediately. However, due to insufficient evidence, the case filing was impeded. It took three months for him to collect evidence on his own (or through a third-party company), after which he reported the matter to the public security bureau again, leading to the subsequent developments.
As lawyers specializing in the cryptocurrency sector, we frequently receive consultations from users seeking legal recourse for stolen virtual assets. However, due to differing interpretations of virtual assets by judicial authorities across regions and the technical challenges faced by public security organs in evidence collection, few cases are successfully filed for investigation. Even when a case is filed, instances where suspects are apprehended and victims recover their financial losses are exceedingly rare. Therefore, users must strengthen their own risk awareness and safeguard their assets.
————————————————
[1] Case Analysis by Procuratorate | Examination of Criminal Issues in the Bitcoin Sector and Judicial Responses https://mp.weixin.qq.com/s?__biz=MzA5NTE0Nzk4NA==&mid=2655640492&idx=1&sn=8cc9eb4c3eafb9b52d62d98449958270&chksm=8bfeb913bc893005e6a0840059207f5ac36dccf6bd82df5a53d4bcb017cc39bff4f48c50917b&scene=27
[2] Focus on Virtual Assets! The Second Criminal Practice Forum on Preventing and Mitigating Financial Risks Held https://baijiahao.baidu.com/s?id=1705249635522939774&wfr=spider&for=pc
Recommended Reading
How to Determine the Value of Involved Coins in Virtual Asset Theft Cases?
