On January 19, 2026, according to media reports [i] , a network engineer was accused of stealing funds from a gambling website. Police in two different locations filed cases and seized 183 bitcoins, worth more than 80 million yuan.
Author: Lawyer Shao Shiwei
On January 19, 2026, according to media reports [i] , a network engineer was accused of stealing funds from a gambling website. Police in two different locations filed cases and seized 183 bitcoins, worth more than 80 million yuan.
In January 2026, the case was publicly heard in a Henan court.
This is a typical criminal case involving cryptocurrency "double-crossing". In practice, similar cases have been quite common in recent years, and I have encountered and represented many similar cases during my work.
Many parties involved and their families often misjudge key issues in the early stages of a case, such as "theft of virtual currency," "whether double-crossing constitutes a crime," and "whether the charges are valid." They lack a clear understanding of the case's direction, the determination of charges, and the issues of evidence, ultimately missing the opportunity to strive for a favorable outcome.
Based on disclosed case information and combined with criminal defense practice, this article focuses on several issues of greatest concern to the parties involved and their families:
Why is it possible to hold perpetrators accountable for "double-crossing"?
What are the typical charges and key defense points involved in such cases?
How should the parties involved and their families respond in a case?
Basic Information on a Cryptocurrency "Black-on-Black" Theft Case
Case background:
Li Dong (pseudonym), an IT professional in Shenzhen, is a network information security engineer. He majored in information security in college. He worked for several well-known internet companies in network security technology before settling in Shenzhen and starting his own internet company in recent years.
Around 2016, Li Dong began trading stocks and cryptocurrencies, acquiring some Bitcoin. However, later police investigations concluded that his Bitcoin originated from another source.
The arrest process:
In May 2024, Zhangjiajie police, acting on an anonymous tip, listed Li Dong as a criminal suspect. Subsequently, the Zhangjiajie Municipal Public Security Bureau summoned Li Dong on suspicion of operating a casino and seized 103 Bitcoins from his digital wallet. These Bitcoins were later converted into cash, amounting to over 49.61 million yuan . Li Dong was subsequently released on bail pending trial.
Just four days after being released on bail, Li Dong was taken away again by the Changge City Public Security Bureau in Henan Province. According to media reports, this was because gamblers from Changge reported that "Kaiyun Sports" was a gambling website, and Li Dong was suspected of having connections to it. Henan police seized 80 Bitcoins from him (with a market value exceeding 40 million yuan) , and subsequently, Li Dong was formally arrested by Henan police.
Facts of the Accusation:
According to reports, Li Dong exploited a vulnerability in the server of an overseas online gambling website to steal the personal information of more than 1.84 million Chinese citizens. He then selected agent accounts with high commission rates and many downlines from the gambling website's agent accounts and replaced the commission bank accounts of these agent accounts with bank accounts under his control, thus stealing the "agent commission funds of the gambling website."
Change in charges:
As the case progressed, Li Dong's charges changed several times:
Zhangjiajie police opened an investigation into him for online gambling, but later changed the charge to illegally obtaining data from a computer information system .
The Changge City Public Security Bureau criminally detained Li Dong on charges of operating a casino, but the Changge City Procuratorate subsequently prosecuted Li Dong on charges of theft and infringement of citizens' personal information .
Common characteristics of this type of cryptocurrency theft case
This is a high-tech, highly concealed, non-contact crime.
Many of the criminal cases handled by Attorney Shao's firm have involved clients with backgrounds similar to Li Dong's—mostly well-educated technical professionals, some with master's or even doctoral degrees. While they are highly knowledgeable in their fields, they often demonstrate a significant lack of understanding of legal risks or harbor wishful thinking, thus underestimating the potential consequences of their actions.
For example, the party involved in this case, a network information security engineer, committed the theft of virtual currency from a gambling website precisely because of his technical advantage in being familiar with blockchain technology, while also having a misunderstanding of the law.
Based on the aforementioned facts, the perpetrator exploited a program vulnerability in the server of an overseas online gambling website to steal the personal information of citizens of the gambling website through technical means. They then selected agent accounts with high commission rates and numerous downlines from the gambling website, replacing the commission bank accounts of these agent accounts with bank accounts under their control, thereby achieving the goal of stealing the "agent commission funds of the gambling website."
So, what technical means might Li Dong have used?
First, he needs to discover vulnerabilities in the website server, database, or proxy management backend, such as SQL injection, logical flaws, and unauthorized access.
Secondly, he needs the ability to process and analyze large-scale data. This can be achieved through technical means such as exploiting vulnerabilities to export databases, intercepting network packets, and compromising the management backend.
Secondly, in order to maximize his profits by "selecting agent accounts with high rebate rates and many downlines", he needs to screen agent accounts. Therefore, he needs to thoroughly understand the gambling website's agent levels, rebate calculation rules, fund flow and other core business logic.
Finally, the agent's commission account is replaced with his own account. This requires him to understand the bank card verification and binding process, and he may use system vulnerabilities or social engineering to bypass security checks (such as SMS verification and facial recognition).
So the question arises: Since what Li Dong obtained was not other people's legitimate property, but rather illegal funds from a gambling website, does this behavior still constitute a violation of the law? And why was he held criminally liable?
Why are people still prosecuted for stealing virtual currency from gambling websites?
1. Why can theft still constitute a crime when virtual currencies and gambling funds are not protected?
Due to their anonymity and other characteristics, cryptocurrencies are widely used by illicit industries as tools for money laundering and transferring illicit funds. Especially in gambling websites, supporting cryptocurrency deposits and withdrawals has gradually become a basic feature for many.
Attorney Shao previously represented an agent of a blockchain game who was accused of operating a casino. The case arose because the agent's friend (a gambler) filed a lawsuit in court due to financial losses, and the court transferred the case to the public security authorities.
However, most people know that once someone is prosecuted for gambling or operating a casino, the gambling funds will usually be confiscated according to law, and the gambling funds themselves are not protected by law.
It is against this backdrop, coupled with long-term policy propaganda, that statements such as "virtual currency is not equivalent to legal tender" and "virtual currency transactions are not protected by law" have gradually become "common sense" in the minds of many people.
Therefore, in cases involving virtual currency theft, fraud, and illegal acquisition of computer information system data, many parties involved have a common misconception:
Since virtual currencies themselves are not protected by law, if someone takes another person's virtual currency for themselves, even if the other party reports it to the police, they will not be able to protect their rights; and legally, they cannot be convicted for it.
2. Why is it that "double-crossing" still results in criminal liability?
In so-called "double-crossing" cases, the assets involved are often of illicit origin, such as gambling funds or stolen money. The state certainly has the right to pursue and confiscate these assets according to law.
However, this does not mean that anyone can seize these assets by committing new crimes.
If an individual uses violence, threats, deception, or system intrusion to seize funds controlled by another, it constitutes a new and independent illegal act. Criminal law regulates not only "property ownership," but more importantly, the protection of social order.
Therefore, in this case, even if the funds obtained by Li Dong came from gambling websites, his actions may still constitute a crime and he may be held criminally liable in accordance with the law.
However, it should be emphasized that this does not mean that the judicial authorities' determination of the facts of the case, the choice of charges, and the calculation of the amount involved will necessarily be without controversy.
On the contrary, such cases often involve considerable room for dispute, which is also a key area where lawyers can focus their efforts. The relevant defense strategies will be further elaborated below.
What are the key defense options in cryptocurrency theft cases?
1. Jurisdiction and Profit-Driven Enforcement Issues
Based on media reports, Li Dong has long resided in Shenzhen, while the investigating authorities are located in Hunan and Henan provinces. Furthermore, the case involves the seizure and liquidation of over 80 million yuan worth of Bitcoin. Li Dong's family has raised concerns about potential issues such as territorial jurisdiction and profit-driven enforcement.
However, since I am not the lawyer representing this case and have not reviewed the case file, it is inappropriate to make speculative judgments about the case without complete information. Therefore, this part will not be elaborated upon.
However, judging from the general situation of cases involving Web3 and virtual currencies, in the many cases that Attorney Shao has encountered and handled, profit-driven law enforcement is indeed a "disaster area" in such cases, and it is also an unavoidable reality in such cases (related reading: A brief discussion on profit-driven law enforcement in criminal cases involving crypto ).
Meanwhile, the question of where jurisdiction should fall in cases involving cybercrime and virtual currency is also a frequently contentious issue (related reading: Different sentences for similar cases? A study on the issue of "territorial jurisdiction" in criminal cases ).
However, it is important to remind families of criminal cases that even with the aforementioned controversies, if the investigating authorities continue to pursue the case, the more crucial task for defense lawyers is to return to the case itself and seek truly valuable defense opportunities based on evidence, facts, and charges.
In specific cases like these, the defense doesn't simply discuss "guilt or innocence" in abstract terms, but rather focuses on several core issues: how to define the nature of virtual currency, whether the applicable charges are appropriate, whether the data involved meets the criteria for criminal liability, and whether there is complete evidence to support the amount involved. These issues directly determine the course of the case and directly affect the final outcome.
Based on the common characteristics of such cases, the relevant defense strategies can generally be developed from the following aspects.
2. Is virtual currency data or property? The impact of different interpretations on the charges.
This is a problem that lawyers almost inevitably face when handling cases involving virtual currency theft, fraud, embezzlement, and illegal acquisition of computer information system data.
Whether virtual currency is classified as "data" or "property" will directly affect the applicable charges, thereby affecting the possible sentence faced by the individuals involved.
In cases involving substantial sums of money, the maximum statutory penalty for illegally obtaining data from computer information systems is seven years , while the maximum statutory penalty for theft, fraud, and embezzlement may reach life imprisonment .
However, in judicial practice, there are still significant differences in the determination of the nature of virtual currency, and it is not uncommon for different judgments to be rendered in the same case in different regions and among different law enforcement officers.
This is precisely why lawyers can play a role and fight for effective defense in such cases.
Attorney Shao has already discussed this issue in detail, so it will not be repeated here. Those interested can refer to the following articles:
In cryptocurrency theft cases, how is the value of the stolen cryptocurrency determined?
3. Is it reasonable to punish someone for both theft and infringement of citizens' personal information?
Currently, the procuratorate has filed a public prosecution against Li Dong on charges of theft and infringement of citizens' personal information.
However, considering the circumstances of the case, Li Dong's direct purpose in obtaining the relevant information was to screen agent accounts with high commission rates and a large number of downstream users, thereby appropriating the commission funds from the gambling website.
Against this backdrop, Attorney Shao believes that the act of obtaining information is more in line with the preliminary steps and necessary means to carry out the theft, and should be evaluated as a whole, rather than mechanically split into two independent crimes .
Li Dong primarily focused on and acquired business data from agent accounts (such as account IDs and performance records), with the core purpose of screening targets rather than obtaining citizens' privacy. A large amount of personal information unrelated to theft (such as ordinary gamblers' phone numbers and addresses) was likely acquired incidentally during bulk exports, reflecting the crudeness of his criminal tools rather than a separate, intentional act of violating citizens' personal information.
While technically these actions can be separated, legal evaluation should focus on the perpetrator's subjective planning and the overall process of their actions. A process of browsing, analyzing, and exporting relevant data in order to commit theft should be considered a continuous criminal process for overall evaluation under criminal law. Artificially dissecting such actions is a mechanistic understanding of complex criminal acts.
If the prosecution intends to prove that Li Dong had two independent criminal intents, then it is necessary to provide evidence to prove them:
- Did Li Dong have two clear and separate intentions when he hacked into the system: to steal money and to steal data to sell ? Can the existing evidence (such as his communication records and chat content) prove that he had the intention to sell or use the data for other purposes? If not, it should be presumed that all his actions served a single overall intention.
- The key question is whether the 1.84 million pieces of information involved were actually used in situations unrelated to theft (such as being sold, provided to others, or used for other fraud). If the prosecution can only prove that "the information was obtained" but cannot prove that "the information was used independently," then these pieces of information remain tools and components of the theft crime, rather than independent fruits of the crime.
4. Whether the amount of citizens' personal information is sufficient to constitute a crime.
Criminal convictions and sentencing must be based on sufficient and conclusive evidence. Even if the court ultimately finds the defendant guilty, there are still defense arguments that can be used to seek leniency or reduction of sentence based on the relevant evidence.
Regarding the crime of infringing on citizens' personal information, the Criminal Law and related judicial interpretations have relatively strict standards for identifying "citizens' personal information," and not all data can be identified as citizens' personal information in the sense of criminal law.
In a previous case handled by Attorney Shao, a company was accused of infringing on citizens' personal information . The police initially alleged the company had infringed on as many as 500,000 pieces of information. However, after Attorney Shao screened and compared the data, he discovered that a large portion of the data did not meet the criteria for "citizens' personal information" under criminal law. Based on this, Attorney Shao explicitly requested the prosecutor to return the case for supplementary investigation and demanded a re-examination of the data according to relevant standards.
After re-evaluation and deduplication, the public security authorities finally confirmed that the number of pieces of information that met the criteria for criminal prosecution did not reach the 5,000 required for filing a case. The case was therefore withdrawn in accordance with the law , and the parties involved were not held criminally liable.
Therefore, returning to this case, if a large portion of the so-called "1.84 million pieces of information" consists only of data such as website accounts, betting records, IP addresses, and device information, and lacks key elements that can directly identify a specific natural person, such as their name and ID number, then whether it meets the definition of "citizen's personal information" under criminal law is highly controversial.
Their defense lawyer also argued that the portable hard drive storing the information was not sealed after the police intervened; the electronic data showed signs of multiple modifications; and much of the related personal information was not complete. Therefore, if the evidence collection process violated legal procedures and the integrity of the data was compromised, whether the electronic data in question can be used as evidence for conviction and sentencing is a key point of contention in this case.
5. Are all 183 bitcoins stolen goods? Examination of the source of the amount involved and the chain of evidence.
According to media reports, Li Dong's family stated that he began trading cryptocurrencies and acquiring Bitcoin around 2016. Whether the 183 Bitcoins seized by the police all originated from stolen gambling websites, and whether there is sufficient evidence to prove this, are key points of the trial.
The media reports did not specify whether the gambling website agent commissions stolen by Li Dong were in RMB, BTC, or stablecoins such as USDT and Tether. The reports only mentioned that he transferred "more than 6.44 million yuan" of the stolen funds to purchase 13 bank cards and "used a certain group to purchase Bitcoin and other virtual currencies."
This statement indicates that the funds involved underwent at least multiple conversions between fiat currency and virtual currency after entering their control. If it also involves purchasing other people's bank cards, using cold wallet addresses, or borrowing third-party accounts, the fund flow will be further lengthened and become more complex.
On the other hand, according to the report, the judicial authorities ultimately seized the Bitcoins registered under Li Dong's name. The key question then becomes: which of these seized Bitcoins can form a complete chain of evidence proving that they indeed originated from gambling website commissions? Which could be confused with his earlier holdings and normal transactions? This must be verified item by item by the investigating authorities; it cannot be assumed that "all the stolen goods" are simply due to the seizure of the Bitcoins.
In the cryptocurrency-related cases handled by Attorney Shao, in order to clarify the source and destination of each fund and verify whether the evidence chain of the amount involved in the case alleged by the investigating authorities is closed, Attorney Shao's team usually conducts cross-checking of the fund flow and on-chain data, and creates a fund flow chart (as shown below) . Because clients often involve multiple cold wallet addresses and frequently use third-party accounts, each address and each transfer needs to be verified one by one.
This is an extremely demanding task, often requiring several weeks. However, it is precisely through this meticulous verification that we can more clearly discover whether the amount of money involved in the case alleged by the prosecution can truly be supported by a complete chain of evidence, or whether there are problems such as breaks in the chain, conflation of information, or exaggerated calculations.
In addition, it is necessary to combine the audit reports, judicial appraisal opinions and other materials that may appear in the case file, and verify their calculation methods, sources of evidence and basis for conclusions one by one, in order to further determine whether the relevant conclusions can withstand scrutiny.
In conclusion
Hopefully, this article will serve as a warning to those who harbor similar侥幸心理 (a sense of侥幸, or a belief that they can get away with it), since the public security organs' understanding and ability to handle cases involving virtual currencies are constantly improving.
If a case is uncovered, it is highly complex and often involves technical issues and large amounts of on-chain data. These cases are highly specialized and complex, and if a guilty verdict is reached, the amount involved is often exceptionally large, with the perpetrator potentially facing more than ten years in prison. Therefore, one should not be blindly optimistic, believing that "it won't constitute a crime" or that "the evidence is insufficient to investigate." It is crucial to take these cases seriously and seek assistance from a professional criminal lawyer promptly.
[i] Network engineer accused of stealing funds from gambling website; police in two locations seize 183 bitcoins in succession_Case No. 1_The Paper https://www.thepaper.cn/newsDetail_forward_32414856
Disclaimer: As a blockchain information platform, the articles published on this site represent only the personal views of the authors and guests and do not reflect the position of Web3Caff. The information contained in the articles is for reference only and does not constitute any investment advice or offer. Please comply with the relevant laws and regulations of your country or region.
Welcome to the official Web3Caff community : Twitter account | Web3Caff Research Twitter account | WeChat reader group | WeChat official account
