Recently, a theft involving over 80 million Bitcoins was brought to trial in Henan courts. Suddenly, it reminded me of several similar cases I handled over the past few years. I want to discuss the legal risks behind "black eating black" (criminals stealing from criminals) in virtual currency.

The case is roughly as follows: A Shenzhen cybersecurity engineer, Li Dong, exploited vulnerabilities in a gambling website’s server, using technical means to steal 1.84 million user records, then transferred commission rebates from agent accounts to his own account. Eventually, police in two jurisdictions seized 183 Bitcoins, worth over 80 million. He is now charged with theft and infringing on citizens’ personal information.

This is a typical "black eating black" case—funds stolen from illegal sources (gambling sites). Many ask: since gambling websites are illegal, why am I still liable if I steal from them? This is a common misconception.

Let me explain why such behavior still constitutes a crime: the state has the right to recover gambling funds and illegal assets, but that doesn’t mean anyone can claim these funds through new crimes. Using technical means to intrude into systems and deceive funds is itself a new, independent illegal act. Criminal law protects not only "property ownership" but also social order. So even if the source is gambling money, your theft still constitutes a crime.

However, there are many controversial points here. For example, should virtual currency be classified as "data" or "property"? This directly affects the charges and sentencing. The crime of illegally obtaining computer information system data has a maximum sentence of 7 years, but theft can carry life imprisonment. In judicial practice, there is significant disagreement on this issue, and different verdicts are often given for similar cases.

Another key issue is whether theft and infringing on citizens’ personal information should be prosecuted separately. Based on the case details, Li Dong’s purpose in obtaining the information was to select high-value agent accounts, which should be a preparatory step for theft rather than two separate crimes. His focus was on account business data, not genuine personal privacy. How many of the 1.84 million records truly meet the legal definition of "citizens’ personal information"? That’s hard to say. I once handled a case where the police initially charged 500,000 records, but after data screening, many did not meet legal standards, and the case was eventually dismissed.

Furthermore, are all 183 Bitcoins considered stolen property? Reports say Li Dong started trading coins as early as 2016. Which of the seized Bitcoins can be conclusively proven to originate from gambling site rebates? Which might be from his early holdings or normal transactions? The involved funds have undergone multiple conversions between fiat currency and virtual currency, possibly involving several cold wallet addresses. Each transaction needs to be verified individually. It’s not enough to simply seize the coins and assume they are all stolen.

I want to remind everyone that although these cases involve "black eating black," there is considerable room for defense. The key is to focus on evidence, facts, and appropriate charges, rather than vague notions of guilt or innocence. Is there complete evidence supporting the amount involved? How should virtual currency be legally classified? Are the charges appropriate? These issues directly influence the case’s outcome.

Finally, I want to emphasize that such cases often involve technical details and extensive on-chain data, requiring specialized knowledge. Once convicted, the defendant could face more than ten years in prison. Do not take chances. If involved in such cases, seek professional criminal legal assistance promptly.