Author: Lawyer Shao Shiwei

On January 19, 2026, according to media reports [i], a certain network engineer was accused of stealing funds from a gambling website, and police from two locations subsequently filed cases and seized 183 bitcoins, valued at over 80 million yuan.

In January 2026, this case was publicly heard in a court in Henan.

This is a typical criminal case of "black eats black" in virtual currency. In practice, similar cases have been quite common in recent years, and I have encountered and represented several cases with similar circumstances during my work.

Many parties involved and their families often misjudge key issues at the early stages of the case, such as "theft of virtual currency," "whether black eats black constitutes a crime," and "whether the charges are valid," lacking a clear understanding of the case's direction, charge determination, and evidence issues, ultimately missing the opportunity to seek favorable outcomes.

This article is based on disclosed case information, combined with criminal defense practice, focusing on several questions that parties involved and their families are most concerned about:

Why are "black eats black" actions also subject to accountability?

What types of charges and defense points are typically involved in such cases?

How should parties involved and their families respond in the case?

1. Basic Situation of Virtual Currency "Black Eats Black" Theft Case

Case Background:

Li Dong (pseudonym), an IT man from Shenzhen, is a network information security engineer who studied information security in college. He has worked in network security technology for several well-known internet companies and later settled in Shenzhen, where he started an internet company in recent years.

Since around 2016, Li Dong began trading stocks and cryptocurrencies, acquiring some bitcoins. However, police later investigated and believed that his bitcoins had another source.

Arrest Process:

In May 2024, police in Zhangjiajie listed Li Dong as a suspect based on "anonymous tip-off" clues. Subsequently, the Zhangjiajie Public Security Bureau summoned Li Dong on suspicion of operating a casino and seized 103 bitcoins from his digital wallet, later liquidating this portion of bitcoins for over 49.61 million yuan. Afterward, Li Dong was released on bail.

Just four days after being released on bail, Li Dong was taken away by the Public Security Bureau of Changge City, Henan Province. Media reports revealed that this was due to a report from gambling personnel from Changge claiming that "Kyun Sports" is a gambling website, and Li Dong was suspected of having connections to this gambling website. The Henan police seized 80 bitcoins from him (market value exceeding 40 million yuan), and Li Dong was subsequently arrested by the Henan police.

(Image source: same as [i])

Accusations:

According to reports, Li Dong exploited program vulnerabilities in the servers of overseas online gambling websites to steal personal information of over 1.84 million Chinese citizens and replaced the bank accounts of high-commission, multi-downline agent accounts with bank accounts he controlled, thereby stealing "the agent commission funds of the gambling website."

Changes in Charges:

During the progress of the case, Li Dong's charges changed multiple times:

The Zhangjiajie police initially filed a case against him for online gambling, but later changed the charge to illegal acquisition of computer information system data.

The Changge City Public Security Bureau detained Li Dong on the charge of operating a casino, but later the Changge City Procuratorate prosecuted him for theft and infringement of citizens' personal information.

2. Common Characteristics of Such Virtual Currency Theft Cases

This is a high-tech, high-concealment, non-contact crime.

Many criminal cases represented by Lawyer Shao have involved parties with backgrounds similar to Li Dong, often well-educated technical professionals, some with master's or even doctoral degrees. They are very familiar with their professions but often have significant cognitive deficiencies regarding legal risks or harbor a sense of luck, underestimating the consequences of their actions.

For example, in this case, as a network information security engineer, Li Dong's technical advantage based on his familiarity with blockchain technology, combined with legal misconceptions, led him to commit theft of virtual currency from gambling websites.

According to the aforementioned case facts, he exploited program vulnerabilities in the servers of overseas online gambling websites to steal citizens' personal information and selected high-commission, multi-downline agent accounts from the gambling website, replacing these agents' commission bank accounts with his own controlled bank accounts to achieve the goal of stealing "the agent commission funds of the gambling website."

So, what possible technical means might Li Dong have employed?

First, he needed to discover vulnerabilities in the website's server, database, or agent management backend, such as SQL injection, logical flaws, unauthorized access, etc.

Second, he needed the ability to process and analyze large-scale data. This could be achieved through technical means (such as exploiting vulnerabilities to export databases, intercepting network data packets, breaching management backends).

Third, to maximize his interests by "selecting high-commission, multi-downline agent accounts," he needed to filter agent accounts, thus requiring a thorough understanding of the gambling website's agent hierarchy, commission calculation rules, and fund flow core business logic.

Finally, replacing the agents' commission accounts with his own required knowledge of bank card verification and binding processes, and possibly exploiting system vulnerabilities or social engineering to bypass security checks (such as SMS verification, facial recognition).

So the question arises: since the funds Li Dong obtained were not others' legal property but illegal funds from the gambling website, does such behavior still constitute a violation of the law? Why is he still held criminally liable?

3. Why is Theft of Virtual Currency from Gambling Websites Still Subject to Accountability?

1. Why Theft of Virtual Currency and Gambling Funds May Still Constitute a Crime Despite Not Being Protected

Due to the anonymity and other characteristics of virtual currency, it is widely used by the black and gray industries as a tool for money laundering and transferring criminal funds. Especially in gambling websites, supporting virtual currency deposits and withdrawals has gradually become a basic configuration for many gambling sites.

Lawyer Shao previously represented a case where an agent of a blockchain game was accused of operating a casino, which arose because a friend (gambler) of the agent sued in court due to financial losses, and the court transferred the case to the public security organs.

However, most people know that once held accountable for gambling crimes or operating a casino, the related gambling funds are usually legally confiscated, and the funds themselves are not protected by law.

In this context, combined with long-standing policy propaganda, the notions that "virtual currency cannot be equated with legal currency" and "virtual currency transactions are not protected by law" have gradually become "common knowledge" in many people's minds.

Therefore, in cases involving theft of virtual currency, fraud, illegal acquisition of computer information system data, etc., many parties often fall into a typical misconception:

Since virtual currency itself is not protected by law, taking others' virtual currency for oneself means that even if the other party reports it, they cannot protect their rights; legally, it is even impossible to convict based on this.

2. Why is "Black Eats Black" Still Subject to Criminal Liability?

In so-called "black eats black" cases, the property involved often comes from illegal sources, such as gambling funds, stolen money, etc. In this regard, the state certainly has the right to recover and confiscate it according to the law.

However, this does not mean that anyone can commit new criminal acts to claim these properties as their own.

If a perpetrator uses violence, threats, deception, or system intrusion to seize funds controlled by others, it constitutes a new, independent illegal act. Criminal law regulates not only "property ownership" but also the protection of social order.

Therefore, in this case, even if the funds Li Dong obtained came from a gambling website, his actions may still constitute a crime and be subject to criminal liability according to the law.

However, it should be emphasized that this does not mean that there will be no disputes regarding the judicial authority's determination of the facts of the case, the choice of charges, and the calculation of the amount involved.

On the contrary, such cases often have significant room for dispute, which is also a key area where lawyers can exert their efforts. Relevant defense strategies will be further elaborated in the following text.

4. What Key Defense Spaces Exist in Virtual Currency Theft Cases?

1. Jurisdiction and Profit-driven Law Enforcement Issues

From the information disclosed by the media regarding this case, since Li Dong has long resided in Shenzhen, while the case-handling units are located in Hunan and Henan, and there are also issues such as the seizure and liquidation of involved bitcoins amounting to over 80 million yuan, Li Dong's family raised concerns about possible jurisdictional and profit-driven law enforcement issues.

However, as I am not the attorney representing this case and have not reviewed the case files, it is inappropriate to make speculative judgments without complete information, so this part will not be elaborated.

Nevertheless, from the general situation of cases involving Web3 and virtual currency, in many cases I have encountered and handled, profit-driven law enforcement is indeed a "disaster area" for such cases and an unavoidable reality (related reading: A Brief Discussion on Profit-driven Law Enforcement Phenomena in Criminal Cases Involving the Cryptocurrency Sector).

At the same time, regarding which jurisdiction should handle the case, this is also a frequently disputed focal issue in cases involving cybercrime and virtual currency (related reading: Same Case, Different Judgment? A Study on the "Jurisdictional Issues" in Criminal Cases).

However, it is important to remind the families of those involved in criminal cases that even if there are disputes as mentioned above, if the case-handling agency continues to advance the case, then for defense lawyers, what is more critical is to return to the case itself and seek truly valuable defense space from the aspects of evidence, facts, and charges.

Specifically for such cases, defense often does not merely discuss "guilty or not guilty," but must focus on several core issues: how to determine the nature of virtual currency, whether the application of charges is appropriate, whether the data involved meets the standards for conviction, and whether there is complete evidence to support the amount involved. These issues directly determine the direction of the case and significantly impact the final outcome.

Combining the common characteristics of such cases, relevant defense strategies can generally be developed from the following aspects.

2. Is Virtual Currency Data or Property? The Impact of Different Determinations on Charges

This is a question that lawyers almost inevitably face when handling cases involving theft of virtual currency, fraud, embezzlement, illegal acquisition of computer information system data, etc.

Whether virtual currency is recognized as "data" or "property" will directly affect the application of charges, thereby influencing the potential sentence the party may face.

In cases involving large amounts, the statutory maximum penalty for illegal acquisition of computer information system data is seven years, while the statutory maximum penalties for theft, fraud, and embezzlement may reach life imprisonment.

However, in judicial practice, there are still significant differences regarding the determination of the nature of virtual currency, and it is not uncommon for different cases, regions, and case handlers to have different judgments on the same case.

This is precisely where lawyers can play a role in such cases, striving for effective defense space.

3. Is it reasonable to impose penalties for both theft and infringement of citizens' personal information?

Currently, the procuratorial authority has prosecuted Li Dong for theft and infringement of citizens' personal information.

However, considering the circumstances of the case, Li Dong's direct purpose in obtaining the relevant information was to filter agent accounts with high commission rates and many downlines, thereby achieving possession of the gambling website's commission funds.

In this context, Lawyer Shao believes that his act of obtaining information is more aligned with a preparatory step and necessary means for committing theft, and should be evaluated as a whole rather than mechanically split into two independent crimes.

Li Dong primarily focused on and obtained the business data of agent accounts (such as account IDs, performance data, etc.), with the core purpose being to filter targets rather than to obtain citizens' privacy. A large amount of personal information unrelated to the theft purpose (such as ordinary gamblers' phone numbers and addresses) may have been obtained incidentally during bulk exports, reflecting the roughness of his criminal tools rather than an independent intent to infringe on citizens' personal information.

Although technically separable, the legal evaluation should focus on the perpetrator's subjective plan and overall behavioral process. A process of browsing, analyzing, and exporting relevant data for the purpose of committing theft should be regarded as a continuous criminal process under criminal law, and artificial disaggregation is a mechanistic understanding of complex criminal behavior.

If the prosecution intends to prove that Li Dong had two independent criminal intents, it is necessary to provide evidence to demonstrate:

• Did Li Dong harbor two clear and separate intentions of "wanting to steal money and wanting to steal data to sell" when he invaded the system? Can existing evidence (such as his communication records, chat content) prove his intent to sell or use the data for other purposes? If not, it should be presumed that all actions served a single overarching intent.

• Were the 1.84 million pieces of information actually used in contexts unrelated to theft (such as selling, providing to others, or for other frauds)? If the prosecution can only prove that "the information was obtained" but cannot prove that "the information was used independently," then this information remains a tool and component of the theft crime, rather than an independent criminal fruit.

4. Is the quantity of citizens' personal information sufficient to establish a crime?

The conviction and sentencing in criminal cases must be based on sufficient and reliable evidence. Even if the court ultimately finds Li Dong guilty, there are still opportunities to argue for a lighter sentence regarding the relevant data involved.

For the crime of infringing on citizens' personal information, the criminal law and related judicial interpretations have strict standards for defining "citizens' personal information," and not all data can be recognized as citizens' personal information in the legal sense.

In a previous case handled by Lawyer Shao, a company was accused of infringing on citizens' personal information, with the public security agency initially alleging that the company had infringed upon as many as 500,000 pieces of information. However, after Lawyer Shao conducted a data screening and comparison, it was found that a large amount of the data did not meet the legal definition of "citizens' personal information." Based on this, Lawyer Shao clearly requested the prosecutor to return the case for further investigation and to re-examine the data according to relevant identification standards.

After re-evaluation and deduplication, the public security agency ultimately confirmed that the number of pieces of information meeting the standards for conviction did not reach the 5,000 pieces required for filing a case, leading to the case being dismissed according to the law, and the parties involved were not held criminally liable.

Therefore, returning to this case, if a large portion of the so-called "1.84 million pieces of information" consists only of website accounts, betting records, IP addresses, device information, etc., and lacks key elements that can directly identify specific natural persons, such as names and ID numbers, there is considerable debate over whether it meets the legal definition of "citizens' personal information."

The defense attorney also pointed out that after police intervention, the external hard drive storing the information was not sealed; there were multiple traces of modification on the electronic data; and many of the relevant personal information were not complete personal information. Thus, if the evidence collection process violated legal procedures and the integrity of the data was compromised, whether the involved electronic data can be used as evidence for conviction and sentencing is a significant point of contention in this case.

5. Are all 183 bitcoins considered stolen property? Examination of the source of the involved amount and evidence chain

According to media reports and information from his family, Li Dong began trading cryptocurrencies around 2016 and owned bitcoins. Therefore, whether all 183 bitcoins seized by the police originated from his theft of funds from the gambling website and whether there is sufficient evidence chain to prove this is a key focus of the trial.

The media reports did not clarify whether the funds Li Dong stole from the gambling website's agent commission were in RMB, BTC, or stablecoins like USDT. The reports only mentioned that he "transferred over 6.44 million yuan to purchase 13 bank cards" and "used a certain group to buy bitcoins and other virtual currencies."

From this statement, it can be seen that the involved funds, after entering his control, underwent multiple conversions between fiat currency and virtual currency; if it also involved purchasing other people's bank cards, using cold wallet addresses, or borrowing third-party accounts, the funding chain would become even longer and more complex.

On the other hand, according to the reports, the judicial authority ultimately directly seized the bitcoins under Li Dong's name. Therefore, the key question becomes: which of the seized bitcoins can form a complete evidence chain proving that they indeed originated from the gambling website's commission funds? Which may be confused with his early holdings or normal transactions? This must be verified item by item by the case-handling agency, and it cannot be directly presumed that "all seized coins" are "stolen property" just because they were seized.

In cases involving cryptocurrencies handled by Lawyer Shao, to clarify the source and flow of each fund and verify whether the evidence chain for the amount involved as alleged by the case-handling agency is closed, the Shao Shiwei lawyer team typically conducts cross-checks of the funding chain and on-chain data, and creates flow charts of fund movements (as shown below). Since the parties often involve multiple cold wallet addresses and frequently use third-party accounts, each address and each transfer needs to be verified one by one.

(Part of the funding flow chart created by Lawyer Shao's team in a certain case)

This work is substantial and often requires several weeks of time. However, it is precisely through this meticulous verification that one can more intuitively discover whether the amount alleged by the prosecution is truly supported by a complete evidence chain or if there are issues such as broken links, aggregation confusion, or inflated calculations.

In addition, it is also necessary to cross-check the calculation methods, evidence sources, and conclusion bases of any audit reports or judicial appraisal opinions that may appear in the case files, further assessing whether the relevant conclusions can withstand scrutiny.

5. In Conclusion

I hope this article can serve as a wake-up call for those who harbor similar notions of luck, as the current level of understanding and case-handling ability of public security agencies regarding virtual currency cases is continuously improving.

Once involved in such cases, which often involve technical issues and a large amount of on-chain data, the complexity and professionalism are high, and if found guilty, the amounts involved are often particularly large, with perpetrators potentially facing more than ten years of imprisonment. Therefore, one should not harbor a blind optimism of "it won't constitute a crime" or "there's insufficient evidence to clarify," but should take it seriously and seek the help of professional criminal lawyers in a timely manner.

[i] Network engineer accused of stealing funds from gambling website, police from two locations successively filed cases and seized 183 bitcoins Yihua Project The Paper https://www.thepaper.cn/newsDetailforward32414856

Special Statement: This article is an original piece by Lawyer Shao Shiwei, representing only the author's personal views and not constituting legal consultation or legal opinions on specific matters.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。