Not long ago, Lawyer Shao received a consultation from a client.
A technical employee of a digital wallet company was arrested without any warning by police from another province on the grounds that some of the wallet platform's partner merchants were suspected of running online casinos. The employee, who was a technical backend maintenance staff, was taken away for investigation on suspicion of "assisting in information network criminal activities."
Similar cases are common in the cryptocurrency/Web3 field. Faced with the sudden accusation, the parties raised two questions:
“I am in a technical position. I didn’t touch the money or participate in profit sharing. How can it constitute a crime?
Employees of big platforms like Binance and OKC are fine, so why should I be arrested for working for a small platform? Is this profit-seeking law enforcement? "
Author: Lawyer Shao Shiwei
These doubts are actually the legal blind spots that are common among Web3 practitioners. This article will use this case to systematically analyze the three major legal risks currently faced by Web3 technical positions and provide practical suggestions.
Legal risk blind spot 1: Are technical positions also risky?
Many technical personnel think, "I just deliver code on demand, and how it is used is up to the client" - the logic behind this statement is actually a misunderstanding of the principle of "technology neutrality".
In the crypto circle, some people often use the example of the victory of the currency mixer Tornado Cash to try to prove that "technology is not guilty."
Tornado Cash is a decentralized privacy protocol based on Ethereum, which is mainly used to obfuscate transaction paths and enhance the anonymity of users on the blockchain. Users can use it to "disorganize and reorganize" encrypted assets to achieve difficult-to-trace transfer effects. It is widely used in personal privacy protection, but it is also used by criminals for money laundering. Although the tool was sanctioned by the U.S. Treasury Department in 2022, in March 2025, the United States finally revoked its economic sanctions on Tornado Cash. This also triggered a discussion on the "boundary of technical responsibility."
However, law enforcement officials in different countries have different understandings and judicial standards of "technological neutrality."
In my country's current judicial practice, whether a crime is constituted does not depend on whether you have personally committed the illegal or criminal act, but on whether the "technical service" you provide has played a "substantial role" in the upstream crime.
In other words, if your technical work objectively has the effect of "lowering the threshold" for criminal activities - such as providing anonymous transfers, currency mixing functions, and means of circumventing KYC, it will no longer be "neutral" but "assistance."
Legal risk blind spot 2: "I am just an employee of a small platform and will not be targeted"
The wallet company involved is registered in the Philippines, and its middle and senior management are all overseas, but its business focus is mainly on mainland China. It employs domestic technical personnel and customer service through a "remote collaboration" model, and its overall operating structure is loose, which is a typical "decentralized employment" model of Web3 projects.
This kind of "distributed office + domestic and overseas collaboration" architecture is extremely common in cryptocurrency projects and is prone to compliance risks.
It is understood that the reason why law enforcement officers determined that the platform was suspected of violating the law was based on a number of key clues:
The wallet system has the function of "multi-level collection + anonymous currency mixing", and the capital flow path is highly consistent with gambling-related behaviors;
Highly sensitive keywords such as “coin mixing optimization” and “anti-tracking” appeared in the technical documents, which are suspected of evading supervision;
The entire platform lacks due diligence records on high-risk merchants and has not established an effective risk control mechanism.
Although technical staff do not directly handle funds and do not understand the background of merchants, as long as the system tools they develop have the objective effect of "lowering the threshold for crime" or "weakening the regulatory effect", they may also be held accountable according to law. This is the logic path that is frequently applied in current "technology-involved" criminal cases.
Compared with leading virtual asset trading platforms such as Binance and OKX, small Web3 projects that lack compliance mechanisms are more likely to be "prioritized" by law enforcement agencies. The reason is very realistic:
The top platforms have a huge number of users and complex overseas structures, making cross-border investigations difficult, time-consuming, and costly. Small platforms, on the other hand, often have personnel in China, making arrests more "efficient";
Large platforms generally have established compliance defenses such as KYC real-name authentication and AML anti-money laundering, forming a dual moat of "technology + law"; while small platforms often lack such mechanisms;
Most mainstream platforms are equipped with law enforcement docking systems (such as API linkage and law enforcement data channels), and they demonstrate a high degree of cooperation in investigations; small platforms are more likely to become targets due to insufficient compliance capabilities and lack of response mechanisms.
As for the question of "profit-seeking law enforcement" mentioned by the consultant, there is indeed a policy background. For example, in the "Law of the People's Republic of China on Promoting Private Economy" implemented on May 20, 2025, many articles mention that the rights of private economic organizations and their operators must be specifically protected, and no unit or individual may infringe upon them; it is firmly prohibited to abuse power to implement law enforcement in other places for the purpose of economic interests.
However, it is worth noting that the core objects of such policy protection are physical enterprises that operate in compliance with regulations. For cryptocurrency projects that are already in a legal gray area, under the cover of regulatory red lines such as the "94 Announcement" and the "924 Notice", due to the lack of compliance endorsement, their space for seeking policy exemptions or rights protection is quite limited.
Legal risk blind spot 3: Legal dangers hidden in remote work with high salaries
The reason why the technician in this case took the job was because he was attracted by the offer of "remote work + monthly salary of 40,000 yuan". No need to punch in, no limit on working hours, working from home, high degree of freedom; compared with traditional Web2 positions, this treatment is almost a "dream job" for many programmers, especially young people.
But he didn't notice several obvious high-risk signals at the time:
The project owner’s registered place is unclear, and the salary settlement method is USDT (virtual currency) transfer;
There is no written labor contract, and all arrangements are communicated only through the Telegram group;
There is no compliance audit, KYC process or anti-money laundering system, nor any public project materials;
These manifestations have long exposed the common characteristics of "high-risk platforms".
However, due to the lack of sufficient risk prevention and control concepts, many technical personnel, faced with the attractive "freedom + high salary" shell, rarely take the initiative to review the compliance of the platform. Once something goes wrong, they realize that they have already stepped into the gray area.
How can Web3 technicians protect themselves in compliance? Lawyer advice
In the gray area of legal supervision of Web3, if technical personnel want to protect themselves, the first step is to establish basic legal risk awareness and compliance prevention and control thinking.
Before getting involved in or joining any Web3 project, be sure to judge and self-check from the following key points:
Whether the project is registered in a clear, regulated jurisdiction;
Whether there is a third-party code audit or security audit conducted by a professional organization;
Whether there are anti-money laundering and user identity identification systems such as KYC and AML;
Whether basic information such as the project leader, team background, and funding source are disclosed to the public.
After joining the company, you must stay away from high-risk functional modules, especially those involving:
Mixer, anonymous transfer, privacy coin;
Bypass or circumvent KYC, blacklist blocking and other mechanisms;
Development of tools to help users hide the source of funds or circumvent censorship.
If you encounter suspicious instructions or pressure from the project party, be sure to keep relevant communication records (such as Telegram chat screenshots, meeting minutes, etc.) to leave key evidence for possible self-proof in the future.
When signing a technical cooperation agreement or outsourcing contract, it is recommended that technical personnel clearly stipulate:
It does not directly access user funds accounts;
No personally identifiable data or sensitive information of users is processed;
Do not participate in marketing activities involving solicitation, distribution, token sales, etc.
Drawing these "legal red lines" can not only avoid stepping on landmines, but also clarify the boundaries of responsibility afterwards.
If you still have doubts about the legality and compliance of the project, it is recommended to find a professional lawyer team to do a "project compliance check" as soon as possible. This can not only timely discover potential legal risks, but also help technicians assess the boundaries of criminal liability that they may bear in their roles, and prevent problems before they occur.
Lawyers remind: Technical tools are innocent, but their actual use may be responsible
Web3 practitioners should be aware of the following:
When dealing with issues at the boundary between technology and law, our law enforcement officers tend to judge whether an action poses a threat to the public interest and social order based on the actual use of the technical tools and the impact they have on society.
In recent years, our team has handled many major new cases in the Web3 industry and participated in early compliance and risk reviews in many projects. Therefore, we can provide customized legal examinations and compliance advice to consultants in a more targeted manner. If you are also a technical practitioner or project operator in the Web3 field, or have questions about project compliance, please come and chat.
I hope that every practitioner who moves forward in the new technological wave can move forward more steadily and soberly.
