On January 19, 2026, a network information security engineer from Shenzhen, identified by the pseudonym Li Dong, was placed under criminal investigation by police in Zhangjiajie, Hunan Province, and Changge, Henan Province, on suspicion of stealing funds from gambling websites. A large quantity of Bitcoin held in his digital wallets was lawfully seized. Police disclosed that approximately 183 bitcoins were confiscated in total, with an estimated value exceeding RMB 80 million.
According to the report, the case was first initiated in May 2024, when Zhangjiajie police received an anonymous tip and formally launched an investigation. Law enforcement subsequently seized approximately 103 Bitcoins linked to the case and completed their liquidation, involving nearly RMB 50 million in value. Several days later, police in Changge, Henan Province, also opened a case against the same individual and seized the remaining approximately 80 Bitcoins, valued at more than RMB 40 million.
Case Developments Under Cross-Regional Coordinated Investigation
As the investigation progressed, the Changge Municipal People’s Procuratorate filed a public prosecution against the suspect on charges of theft and infringement of citizens’ personal information. Prosecutors alleged that since 2020, the engineer had exploited software vulnerabilities in servers operated by overseas gambling websites to illegally obtain large volumes of users’ personal data. He then transferred related rebates and illicit proceeds into bank accounts and Bitcoin wallets under his control.
During court proceedings, the defense challenged the integrity of the evidentiary chain, arguing that certain data extraction and storage procedures were disputed. Prosecutors, however, maintained that the fund transfer paths, account control relationships, and on-chain records corroborated one another. The case has been heard in open court and will continue at a later date.
Challenges in Risk Identification in Digital Asset–Related Criminal Cases
Criminal cases involving virtual assets such as this one highlight the practical challenges faced by judicial and regulatory authorities. Due to the decentralized nature and rapid transferability of on-chain assets, once combined with illicit activity, fund flows often become highly complex, significantly increasing the difficulty of investigation, evidence collection, and risk identification.
In compliance and security practice, regulatory focus is gradually shifting away from identifying asset ownership alone toward the continuous analysis of transaction behavior itself. Only through comprehensive assessment of fund flows, transaction frequency, and address associations can potential illegal activities be more effectively identified.
From Case Reflection to Compliance Capability Building
Against this backdrop, monitoring and analytical capabilities centered on transaction behavior are becoming increasingly important. For example, by leveraging transaction monitoring systems such as Trustformer KYT, institutions can analyze on-chain transaction paths and behavioral patterns, enhancing the systematic and transparent identification of risks and providing a solid data foundation for subsequent compliance reviews or judicial cooperation.
Conclusion
As virtual assets continue to expand their presence in the real economy, related risk incidents—and the mechanisms used to govern them—will continue to evolve. The enforcement practices reflected in this case demonstrate that digital asset security has become a key focus for regulatory and judicial systems, and its future development merits sustained attention from the industry.