Shanghai Court Precedent: How to View the "Theft" of Virtual Currencies by 360 Company Employees?
By Mankun Law Firm
AI summary
Cybersecurity Company's "Insider Theft" Highlights Need for Strengthened Compliance Management
Contents
Cybersecurity Company's "Insider Theft" Highlights Need for Strengthened Compliance Management
In Web3 security incidents, one of the most common scenarios involves using hacking techniques to infiltrate computer systems, stealing others' virtual wallet addresses and private keys, and subsequently transferring the virtual currencies from those wallets to achieve illegal profits. Judicial authorities often face a dilemma in such cases:Is it illegal intrusion or theft?However, there is now a "final determination" regarding such cases in China.
Reference Precedent
In February 2023, three employees of the cybersecurity enterprise 360 were prosecuted by the Xuhui District People's Procuratorate of Shanghai for suspected theft of virtual currencies and were ultimately convicted of theft. The three employees were Hong, former Deputy Director of Qihoo 360's Advanced Attack Research Institute; Zheng, Team Leader of the Weapons Group at 360 Company's Advanced Attack and Defense Laboratory; and Liu, an employee of the Advanced Attack and Defense Laboratory. By exploiting remote code execution vulnerabilities, the three illegally obtained the victim Su's virtual wallet address and private key, transferred and sold the virtual currencies, and profited more than RMB 2.5 million in total.Ultimately, the court ruled that Hong, Zheng, and Liu, with the intent of illegal possession, used technical means to intrude into another person's computer information system and secretly stole another person's virtual currencies. Given the particularly huge amount involved or other particularly serious circumstances, their actions constituted the crime of theft. Taking into account mitigating factors such as voluntary surrender and meritorious service, the court sentenced the three to fixed-term imprisonment with probation, pursuant to Article 264, Article 25(1), and Article 27 of the Criminal Law of the People's Republic of China, among other provisions.In this regard, several senior Web3 lawyers at Mankun Law Firm believe that the emergence of this precedent will provide important reference for future judgments by Chinese judicial authorities regarding the theft of virtual currencies and related cases.
Gao Mengyang
Criminal Practice Group, Mankun Law Firm
Regarding the case where 360 employees implanted Trojan programs to steal others' virtual currencies, they first had inherent advantages. As a cybersecurity company, 360 controlled the entire security protection of users' computer systems, which could create a de facto convenience and provide the possibility of insider theft. In this respect, cybersecurity companies must certainly strengthen internal audits and internal controls, especially compliance management for technical personnel with certain levels of access privileges, to prevent such incidents from occurring.From the perspective of the entire case, the conviction for theft highlights the recognition of the financial attributes of virtual currencies and provides protection for virtual assets on this basis. However, there are controversial points in the determination of theft: whether it constitutes theft of virtual currencies or illegal intrusion into computer systems, as there is an overlap of offenses. Because in this case, there was an objective situation where the integrity of another person's computer system was compromised. However, illegal intrusion into computer systems carries a significantly lighter penalty in terms of both the range of imprisonment and social evaluation compared to theft. Therefore, in this case, the judge's final characterization as theft indicates that the protection of virtual assets is relatively adequate.Finally, the court's commentary stated that the theft was carried out by infringing upon the computer system. This case may have reference significance for similar cases nationwide, which is more conducive to protecting the assets of individuals in the crypto community.
Huang Peng
Civil and Commercial Practice Group, Mankun Law Firm
In this case involving 360 Company employees illegally obtaining and stealing virtual currencies, the defense lawyers argued that "virtual currencies are not 'property' in the sense of criminal law," and therefore the case did not constitute theft but only constitutedthe crime of illegally obtaining data from computer information systems. Although the court ultimately did not adopt this view, it chose an indirect approach, stating that the argument was "not adopted because it failed to fully evaluate the nature of the defendants' subsequent acts of illegally obtaining property." This reflects the caution and conservatism of Chinese judiciary on the issue of the nature of virtual currencies. While this strategy can temporarily handle individual cases appropriately, it fails to provide clear legal guidance, which may to some extent lead to uncertainty and inconsistency in the application of law.As the investment attributes of virtual currencies are gradually recognized, legal disputes related to virtual currencies are increasing, and the legal system urgently needs to adapt to this change. Clarifying the property attributes of virtual currencies is key to resolving these disputes. Only by conducting in-depth research and clarifying the legal status of virtual currencies can crimes be effectively combated and the legitimate interests of relevant rights holders be protected, ensuring legal coherence and predictability.
Mao Jiehao
Civil and Commercial Practice Group, Mankun Law Firm
From the recent trial situations of cases involving crypto assets, it can be observed that judicial authorities have significantly deepened their understanding of blockchain technology and related activities, indicating that the adaptation of law to emerging technologies is accelerating. The handling of these cases shows that in the future, even some on-chain behaviors originally considered to be in a "gray area" may receive clearer legal interpretations and characterizations as understanding of blockchain technology becomes more comprehensive and legal concepts are updated.This progress is very important because it marks that judicial practice is gradually establishing corresponding legal frameworks after recognizing the challenges brought by new technologies. Furthermore, this helps ensure that in Web3 and related fields, the law can not only effectively sanction illegal acts but also better protect individuals and enterprises exploring and utilizing these new technologies within legal boundaries. In the future, with the continuous development and application of such technologies, it is expected that more judicial guidance and legal clarification will emerge on how to find a balance between safeguarding innovation and security, thereby providing legal guarantees and support for the healthy development of the entire digital economy.
Special Disclaimer:
This article is an original work of Mankun Law Firm and represents only the personal views of the author(s). It does not constitute legal consultation or legal advice on specific matters.
