This article analyzes the compliance of evidence obtained from virtual currency exchanges and elaborates on the principles of evidence collection.

Author: Lawyer Liu Zhengyao

Introduction

As virtual currencies become increasingly understood by more people, the use of virtual currencies for criminal activities such as money laundering, fraud, operating illegal casinos, and illegal business operations is on the rise. Due to a series of regulatory policies targeting virtual currencies issued in mainland China in 2017 and 2021, domestic virtual currency trading platforms have been completely banned, and currently, some virtual currency exchanges commonly used by Chinese users (such as Binance, OKX, Bybit, Bitget, HTX, etc.) all operate overseas.

This poses a challenge for domestic public security investigation agencies: criminal acts occur domestically or victims are located domestically, but key transaction data, exchange KYC (Know Your Customer) information, login log information, etc., are stored on servers abroad. Can the "electronic data" obtained by the investigating agency from overseas exchanges via email or online police systems be used as evidence in court?

The author will analyze this practical pain point from the perspective of a defense lawyer, in conjunction with Chinese criminal procedure law and relevant judicial interpretations.

1. Current Situation: How Do Investigating Agencies "Request Evidence" from Overseas Exchanges?

Before discussing "whether it can be used," it is essential to understand "how to obtain" the electronic evidence involved. Currently, mainland Chinese public security agencies have three main ways to obtain data from overseas exchanges, each with different legal effects:

(1) International Criminal Judicial Assistance

This is the most formal and compliant method according to international legal procedures. Evidence is obtained by contacting the competent authorities of the country or region where the virtual currency exchange is registered or where its servers are located, based on bilateral criminal judicial assistance treaties. However, this method has a significant drawback: the process is extremely cumbersome, often taking 6 months to several years. For rapidly changing cryptocurrency cases, a delay of even one day could result in the involved virtual currency's price dropping to zero, making this efficiency almost impossible to meet investigative needs, and thus it is rarely chosen in practice.

(2) Police Cooperation and "Green Channels"

Based on Interpol or other police cooperation mechanisms, evidence collection from the involved exchanges can be conducted relatively quickly.

However, what is more commonly seen in judicial practice is that domestic public security agencies directly utilize the "law enforcement cooperation mechanisms" established by virtual currency exchanges (such as Binance, OKX).

(The above image shows Binance's "Government Law Enforcement Request Submission System," sourced from Binance's official website)

(The above image shows OKX's "Law Enforcement Request Guidelines," sourced from OKX's official website)

In terms of specific operational modes, investigating officers can authenticate their identity in Binance's system (law firms or lawyers can also authenticate) and send a request for evidence (such as a scanned copy of the case decision or evidence collection notice), which will be reviewed by the exchange's compliance team, and they will reply via email with an Excel spreadsheet or PDF file. OKX receives law enforcement requests via email. This is currently the primary method of evidence collection in most cryptocurrency-related cases in China.

(The above image shows Binance's evidence request registration page, sourced from Binance's official website)

(The above image shows OKX's evidence request method, sourced from OKX's official website)

(3) Self-Extraction of Technology and "Remote Examination"

This is a relatively common evidence collection model in judicial practice. For apprehended suspects, if public security investigators can log into their exchange accounts using seized devices such as the suspects' mobile phones or computers, they can directly view and export transaction records and deposit/withdrawal records. Data obtained in this manner is often directly used as evidence to charge crimes.

According to Article 33 of the "Rules for Electronic Data Collection in Criminal Cases by Public Security Organs" issued by the Ministry of Public Security in 2019 (hereinafter referred to as the "2019 Rules"), this model falls under network remote examination, which involves the direct extraction of electronic data from devices controlled within the country, rather than directly requesting evidence from overseas entities, and there is still some procedural controversy regarding this (see below).

2. Core Controversy: The "Legitimacy" Dilemma of Obtaining Evidence from Abroad

Currently, in our defense, we mainly focus on the legality and authenticity of the evidence when prosecutors present Excel spreadsheets or PDF files directly sent back from overseas virtual currency exchanges (via email) in court.

(The above image shows transaction records obtained by public security agencies from Huobi after requesting evidence)

(1) Legal Basis for Obtaining Evidence from Abroad

It is well known that exchanges like Binance, OKX, and Bybit are often registered or actually operate in countries and regions such as the Cayman Islands, Seychelles, Dubai, Hong Kong, and Singapore. As previously mentioned, according to normal electronic evidence collection procedures in criminal cases, domestic public security investigation agencies cannot directly collect evidence from abroad; strictly speaking, they must go through international criminal judicial assistance. However, in practice, very few agencies adopt this model; more public security agencies directly rely on the "Several Provisions on Collecting, Extracting, and Reviewing Electronic Data in Criminal Cases" issued by the "Two Highs and One Ministry" in 2016 (hereinafter referred to as the "2016 Provisions") and the 2019 Rules, which allow for "online extraction" or "remote examination" of electronic data stored abroad.

Thus, it appears that the basis for public security agencies to collect evidence from overseas virtual currency exchanges is judicial interpretations or regulations from the Ministry of Public Security, but according to Article 25 of the "International Criminal Judicial Assistance Law," obtaining electronic data from abroad should be done through criminal judicial assistance. However, friends familiar with the current state of criminal defense in China understand that this kind of dispute may at most be considered a procedural flaw or controversy, which is unlikely to substantially affect the direction of the case.

(2) The "Authenticity" and "Integrity" of Data Cannot Be Self-Proven

If domestic public security agencies operate according to the aforementioned "law enforcement cooperation mechanism," the data returned by virtual currency exchanges is usually a standard Excel/PDF file, without any third-party notarization, some lacking digital signatures, and sometimes the sender is merely a personal email of an exchange employee.

Thus, as a defense lawyer, one might raise the following questions: How can it be proven that the files sent and received via email have not been tampered with? How can it be proven that a personal email indeed represents the official exchange? How can it be proven that there were no technical errors in the data generation process? And so on.

In practice, since employees of the exchange cannot testify in court, the authenticity and integrity of such evidence are often unprovable.

(3) The Legitimacy of the Exchange Itself is Questionable in Mainland China

According to the notice issued by ten ministries and commissions of the state (including the "Two Highs and One Ministry") on September 24, 2021, titled "Notice on Further Preventing and Dealing with Risks of Virtual Currency Trading and Speculation," overseas virtual currency exchanges are prohibited from conducting business in any form in mainland China, and all their business activities are considered "illegal financial activities." Therefore, it can be understood that from the regulatory perspective in mainland China, overseas virtual currency exchanges are entities that inherently carry a "criminal halo," raising significant doubts about the legality of evidence obtained from such overseas illegal entities by domestic public security agencies.

3. Can the Relevant Evidence Be Used in Court?

Despite the aforementioned flaws, in current judicial practice, there are very few cases where evidence obtained by public security agencies from overseas exchanges is excluded by the court. In most cases, even if there are obvious flaws, the evidence can still be accepted by the court after "correction." When reviewing such evidence, courts typically follow the following logic and standards:

(1) Distinguishing "Flawed Evidence" from "Illegal Evidence"

Courts tend to believe that evidence obtained by requesting information from overseas exchanges via email, while not fully complying with rigorous judicial assistance procedures, does not typically constitute "illegal evidence that may severely affect judicial fairness," but rather "flawed evidence." Such evidence can be remedied through correction or reasonable explanation without needing to be directly excluded.

(2) Mutual Verification with Other Evidence

Slightly more rigorous public security investigation agencies and procuratorates will take the following measures to strengthen the electronic data obtained directly from overseas exchanges:

First, record the entire process of sending and receiving emails with audio and video. At the same time, perform integrity checks on the received email content using hash calculations (such as commonly used MD5 or SHA-256) to ensure that the data has not been tampered with;

Second, notarization by a notary office or third-party evidence storage. Notarize the entire process of sending the evidence request email and receiving the reply email, or use blockchain storage to prove "this email indeed came from the exchange's email, and the content has not been modified by the investigating personnel."

Third, attach an analysis report. Hire a domestic blockchain security company to provide an analysis report. Although they cannot verify internal data from the exchange (such as KYC), they can verify on-chain data. The basic logic is: if the transfer hash values in the Excel file provided by the exchange match the publicly queried data on the blockchain explorer, it can indirectly verify the authenticity of the exchange's data.

Fourth, corroborate with other evidence in the case. Compare the exchange data with the defendant's statements, chat records on seized mobile phones, and locally cached data. If data from multiple sources matches, the court usually accepts it.

4. Defense Perspective: How to Effectively Challenge Evidence?

For the parties involved in the case and their defense lawyers, facing evidence from overseas exchanges submitted by the investigating agency does not mean being powerless. Here are several frequently effective points for challenging evidence summarized by Lawyer Liu based on his practical experience:

(1) Review the Authenticity of KYC (Account Ownership Issues)

The KYC data provided by the exchange (usually passport or ID information) is often static. Therefore, defense lawyers should pay particular attention to whether the KYC information in a certain accused account could have been obtained through the buying and selling of KYC, meaning that without other corroborating evidence, the involved account may not have been operated by the registered person (referencing the numerous real-life cases of buying and selling bank cards); additionally, checking whether the login IP address of the exchange account matches the individual's living trajectory can also indirectly verify whether the account is indeed being used by the accused party.

(2) Challenging the Integrity of Data

If the transaction records from the exchange account in the evidence are merely screenshots of an Excel spreadsheet or other printed documents, rather than the original electronic files, then it cannot be proven that the evidence is unique, and there is a possibility of it being edited or modified. Additionally, some prosecutors even mistakenly present printed paper transaction records or chat logs as documentary evidence, which is completely incorrect, and defense lawyers must firmly oppose this.

(3) The Specificity of Stablecoins like USDT

For data obtained from Tether or decentralized wallets, the nature of the data differs from that of centralized exchanges (such as Binance). On-chain data is public and can be accessed by anyone. If the prosecutor only provides on-chain transfer diagrams but fails to provide the exchange's internal real-name authentication information to link addresses to individuals, then the chain of evidence is broken.

Five, Final Thoughts

To summarize, can evidence obtained from overseas exchanges be used? The short answer is: Yes, but there are thresholds, and there is room for "technical challenges." Specifically:

First, in terms of evidentiary qualifications. Chinese courts generally do not reject the evidentiary qualifications of data from overseas exchanges. As long as the investigating agency can prove the objectivity of the data source (such as through notarized email correspondence), the evidence is usually accepted.

Second, in terms of probative value. A single Excel spreadsheet from an exchange has weak probative value. It must form a closed loop of "on-chain data + internal exchange data + defendant's terminal data + fund flow."

Third, practical trends. With the increasing compliance efforts of leading exchanges like Binance and OKX, the format of the data they provide is becoming more standardized (now generally includes electronic seals), making it more challenging for the defense to attack from the perspective of "formal authenticity."

A Suggestion:

For investigators: It is essential to document the entire process of "sending and receiving letters" with overseas virtual currency exchanges (audio and video recording or notarization), and consider commissioning professional institutions to conduct on-chain data analysis to strengthen the evidence.

For the parties involved and defense lawyers: Focus on examining the originality of electronic data (whether the original electronic files were transferred), the identity (whether the hash values match), and the relevance (whether the possibility of others operating the account can be excluded, etc.).

In the short-term future, the game of technology and law in virtual currency cases will continue. The use of overseas evidence will continuously establish new judicial standards in this game.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。