Author: Xiao Sa lawyer

Recently, a news report about an employee of a cybersecurity company stealing more than 2.5 million yuan in virtual currency has attracted attention in the cryptocurrency community. The criminal behavior of internal technicians has made people lament that the crisis is around them. However, from a legal perspective, this case involves a key issue in criminal cases related to virtual currency: whether virtual currency has the attributes of property.

Basic facts

According to the prosecution, from February 9 to 20, 2023, Hong, Yang, and Zhang, employees of a cybersecurity company, obtained the target virtual currency website permissions by analyzing and exploiting the Yapi remote code execution vulnerability, controlled the intranet server by means of lateral penetration of the intranet, implanting Trojans, etc., found the server source code, downloaded and analyzed the victim Su's virtual wallet address, private key, etc., and constructed false instructions to transfer the virtual currency in the victim's virtual wallet address. Subsequently, the three exchanged it for other virtual currencies and sold it, obtaining a total of more than 2.5 million yuan in illegal income. During this period, another employee, Zheng, forged Dash coin signatures and broadcast transactions according to Hong's instructions, and transferred 3015.9 Dash coins from the victim.

The public prosecution agency determined that his actions had violated Article 264 and Article 25, Paragraph 1, of the Criminal Law of the People's Republic of China, and that he should be held criminally responsible for the crime of theft.

The court held that the defendant, for the purpose of illegal possession, used technical means to invade other people's computer information systems and secretly stole other people's virtual currency, and the amount was particularly huge or there were other particularly serious circumstances. His actions constituted the crime of theft, and the charges brought by the public prosecutor were established. After considering the circumstances and factors such as confession of guilt and punishment, surrender, meritorious service, confession, accomplice, and repayment, the court accepted the defense's claim for suspended sentence and sentenced Hong to three years in prison for the crime of theft, suspended for four years, and fined RMB 50,000; Zheng was sentenced to three years in prison for the crime of theft, suspended for three years, and fined RMB 50,000.

Does stealing virtual currency constitute theft?

The main significance of discussing this issue is that the statutory penalty for theft is higher than that for illegal acquisition of computer information system data. If the amount of theft is particularly huge or there are other particularly serious circumstances, the offender may be sentenced to more than ten years of fixed-term imprisonment or life imprisonment, and a fine or confiscation of property; while if the circumstances of illegal acquisition of computer information system data are particularly serious, the offender shall only be sentenced to more than three years but less than seven years of fixed-term imprisonment, and a fine. The difficulty in convicting virtual currency theft and the common defense points are all on the property attributes of virtual currency. According to Article 264 of the Criminal Law, theft requires the subject of the act, the purpose of illegal possession, the act of secret theft, the object of the crime, and the circumstances of the crime, while the object of theft can only be "public and private property" protected by the Criminal Law. Therefore, if it can be proved that virtual currency is not property, it is expected that the theft will not be sentenced, but the crime of illegal acquisition of computer information system data will be sentenced, thereby reducing the sentence. The defense lawyer in this case adopted this strategy.

There has always been controversy in judicial practice as to whether virtual currency can be regarded as "property".

1 Reasons for support

a. Virtual currency is scarce

The scarcity of virtual currency is objective. Cryptocurrencies often announce an upper limit on the number of issuances. At the same time, technically, any changes to virtual currency will be recorded in the blockchain through a special, unchangeable hash, which makes each virtual currency unique rather than a type of object. If stolen, virtual currency cannot be recovered through low-cost, centralized means, and the loss caused is direct. Therefore, when virtual currency is used as the object of the crime of theft, the harm to the victim is similar to the theft of general property.

b. Virtual currency has property value

Virtual currency is a special virtual property with value and exchange value. The difference between virtual property on the Internet and tangible property in real life lies only in the time, space and form of existence. They can be converted into real property and there is no difference in property and interest.

2 Reasons for opposition

a. The physical properties of virtual currency are data

Virtual currency is essentially a set of computer codes in binary form, which is an objective attribute that cannot be ignored. On the contrary, using technical means to invade computer information systems, stealing data in computer information systems beyond the scope of authorization, stealing keys and transferring virtual currency is a typical intrusion beyond authorization and can be evaluated as intrusion into computer information systems.

b. my country's policy documents have a strict restrictive attitude towards the holding and trading of virtual currencies

The 924 Notice has clearly stipulated that virtual currency-related business activities are illegal financial activities. Any legal person, non-legal person organization or natural person who invests in virtual currency and related derivatives and violates public order and good morals will have their related civil legal acts invalid, and the losses caused by them will be borne by themselves. At the same time, relevant policy documents often pay close attention to criminal cases involving virtual currency, and it is more in line with policy needs not to consider virtual currency as property protected by the criminal law.

The value orientation of the judgment in this case

The defense attorney in this case argued that "virtual currency is not 'property' in the sense of criminal law," and therefore this case did not constitute theft but only the crime of illegally obtaining computer information system data. The court did not respond positively to this, but held in the judgment that "the defendant used technical means to invade other people's computer information systems for the purpose of illegal possession and secretly stole other people's virtual currency." Illegally invading other people's computers is a means of theft, and virtual currency is the criminal object of theft. From this perspective, this case actually recognizes the property attributes of virtual currency.

Since the 924 Notice clarified the illegality of virtual currency, civil cases involving virtual currency also need to be reviewed for validity first. In criminal law, cases with virtual currency as the object of crime also question whether it is necessary to protect virtual currency. This case recognized the property value of virtual currency, and based on the protection of the legal interests of the crime of theft, used criminal law to protect the property rights and interests of virtual currency holders (although the legality of the holding status will be evaluated separately), and also gave a negative evaluation to the use of computer information technology to commit theft, grasping the essence of theft as a crime that infringes on the property rights and interests of others.

The team of Sister Sa believes that the trial of cases involving virtual currency needs to be gradually standardized. Although the illegal status of virtual currency has led to differences in judicial practice and is policy-oriented, the general trend is still to explore and clarify the characterization of civil disputes and criminal crimes arising from virtual currency, protect the legitimate rights and interests of the parties, and promote the same sentence for the same case. Although there is still room for debate on the characterization of theft of virtual currency cases, this case properly handled the protection of the rights and interests of the victim and the prudent attitude of criminal policy towards virtual currency. In the future, the trial ideas of related cases should be further standardized.

Final Thoughts

In addition, this case also reminds network security practitioners that they should abide by professional ethics and legal bottom lines and should not engage in illegal and criminal activities. "Black eating black" will also be punished by law. Relevant practitioners should assist law enforcement agencies in combating cybercrime and maintaining network security. Web3, network security and other related practitioners have professional skills and knowledge, and should use these skills in a legitimate manner to protect network security and user privacy, data security, and property rights. The use of network security skills to conduct illegal activities not only violates the law, but also deviates from professional ethics and will be severely punished by law.