Is it theft or fraud when the coins in the wallet remain but are changed to multi-signature by someone else?

Author: Gao Mengyang

Opening the wallet, the USDT balance is still there, and the transaction records do not show any assets being transferred. But when you prepare to make a transfer, the system prompts that the signature permission is insufficient. Clearly, the mnemonic phrase and private key are in your hands, yet you cannot transfer the coins out.

Further inquiry reveals that the wallet's permissions have been modified by someone. What used to require only your signature to complete a transaction now requires authorization from another unfamiliar address.

The coins have not been transferred, but the control is no longer in your hands.

This situation is commonly referred to as "malicious multi-signature." Unlike typical cryptocurrency theft, the attacker may not immediately transfer the assets but first exploits the wallet's permission mechanism to limit the original holder's ability to manage the assets.

This raises the question: if the coins are still in the original address, can it be considered theft? If it was induced by someone to sign, should it be classified as theft or fraud?

For users encountering similar situations, clarifying these issues is crucial, not only for subsequent police reports but also for preparing evidence and assessing the chances of recovering assets.

01 Who has taken control when the wallet is maliciously multi-signed?

To understand the legal issues of malicious multi-signature, it is essential to distinguish between two concepts: whether there are assets in the wallet and who has the right to manage those assets.

Taking the TRON network as an example, its account permission management mechanism allows for the allocation of signature weights to different addresses and sets the signature threshold required to complete transactions. Normally, users can manage their accounts through their private keys and can also set up multi-signatures for scenarios like corporate fund management.

However, if someone modifies the wallet's Owner or Active permissions without permission by obtaining the private key, mnemonic phrase, or inducing the user to sign a malicious permission change transaction, the situation changes entirely.

For instance, if a user could originally complete a transfer alone, after the permissions are modified, they now require a co-signature from another unfamiliar address to operate. In more severe cases, the other party may have already obtained enough signature weight to independently modify permissions or transfer assets, while the original user can only see the account balance but cannot manage the assets independently.

From the blockchain perspective, the assets may still remain in the original address, with no transfers occurring. However, from the actual control relationship, the original holder's ability to manage the assets has changed.

There is an easily overlooked detail here: malicious multi-signature does not necessarily mean the attacker can independently transfer the assets.

In some cases, the attacker can independently manage the wallet; in others, neither party can complete the transfer alone; and in some cases, only specific operational permissions are restricted. Which scenario applies requires checking the account's permission addresses, signature weights, thresholds, and executable operations.

Therefore, when encountering a wallet that cannot transfer, one cannot simply conclude that malicious multi-signature has occurred based solely on interface prompts, nor can one directly conclude that "all coins have been stolen."

What truly needs to be clarified is: who modified the permissions? Was the modification made with valid authorization? Who currently controls the wallet? Has the original holder been substantially excluded from asset management?

These facts are the starting point for subsequent criminal legal analysis.

02 Is it theft or fraud? The key is not just whether there was deception.

In judicial practice, illegally obtaining virtual currency may involve theft, fraud, and crimes related to computer information systems. However, which specific charge applies cannot be judged solely based on the result of "the wallet being multi-signed."

First scenario: Unauthorized modification of permissions and further transfer of assets.

Assuming the attacker illegally obtains the private key, mnemonic phrase, etc., and unilaterally modifies the wallet permissions, subsequently transferring the assets to an address they control.

In this case, if there is evidence proving that the perpetrator has the intent to illegally possess, obtaining control of the assets without the consent of the rights holder and actually transferring the assets may involve the determination of theft.

However, virtual currency has data attributes and certain property interests, and there is still controversy over the criminal law protection paths and methods of determining the amount of crime in different cases.

Some judicial opinions emphasize the property attributes of virtual currency, believing that illegal theft can constitute theft; others evaluate cases from the perspective of computer information system data security.

Therefore, even if the assets have actually been transferred, one cannot skip over the specific manner of behavior, the nature of the assets, and the evidence situation to directly determine the charge.

Second scenario: Inducing users to sign permission change transactions through false statements.

This scenario is more worthy of discussion.

For example, the perpetrator may falsely claim account security upgrades, platform certification, or normal transaction operations, prompting the user to click a link, connect the wallet, and confirm the signature. The user believes they are completing a normal operation, but in reality, they are signing a transaction that modifies account permissions.

On the surface, the user did indeed click the confirmation button themselves.

However, legally speaking, whether clicking confirm means agreeing to allow others to obtain control of the assets is two different questions.

The critical distinction between theft and fraud lies in whether the victim has been deceived into a misunderstanding that leads them to dispose of their property. If the user was merely induced to complete a technical operation without knowing that the operation would allow others to control their assets, then whether they possess the awareness of property disposition in the legal sense requires further judgment.

Conversely, if the perpetrator, through fabricating facts, causes the user to actively transfer assets or actual control to the other party under a misunderstanding, it may also involve the evaluation of fraud.

Thus, the presence of deceptive language does not necessarily constitute fraud, nor does a user clicking a signature confirmation automatically exclude the possibility of theft.

Especially for malicious multi-signature, whether the permission change can be evaluated as property disposition and whether the perpetrator has obtained property control in the legal sense still requires analysis based on specific facts.

Third scenario: Obtaining wallet control permissions through malicious programs, technical intrusion, etc.

If the attacker also engages in illegal acquisition of identity authentication information, intrusion, or illegal control of computer information systems, when meeting the relevant crime composition and conviction conditions, it may also involve crimes related to computer information systems as stipulated in Article 285 of the Criminal Law.

However, modifying on-chain account permissions does not equate to the perpetrator necessarily illegally controlling the computer information system in the legal sense. Whether there is technical intrusion, illegal acquisition of system data, etc., requires separate examination.

In other words, malicious multi-signature is merely a technical result, while the evaluation of criminal responsibility requires further answers: what exactly did the perpetrator do, how did they obtain permissions, what benefits did they gain, and what consequences did they cause?

03 If the coins have not been transferred, does it mean there is no property loss?

This is a rather tricky question in malicious multi-signature cases.

In traditional theft cases, property is taken away from the victim's control by others, and the change in property possession is usually quite straightforward.

However, digital assets are different.

Assuming a wallet was originally managed independently by the user, and later someone maliciously modified the permissions, causing the user to be unable to transfer. At this point, the on-chain balance has not changed, and the assets have not entered the attacker's new address.

So, what exactly has the user lost?

From a practical usage perspective, the user has already lost part or even all of their ability to manage the assets they originally enjoyed. Even if the balance still exists, they may be unable to perform normal transfers, payments, or other legal disposal operations.

However, in criminal law evaluation, the infringement of control rights and the completion of property crimes do not necessarily equate.

It is necessary to further distinguish several situations: whether the perpetrator has obtained exclusive control; whether the user can still restore operations through other effective permissions; whether both parties cannot complete transfers independently; whether the attacker has actually transferred assets, and whether there are further illegal possession behaviors.

These facts will affect the judgment of changes in property possession, the completion or attempted completion of crimes, actual losses, and the amount of crime.

It is especially important to note that one cannot simply take the entire virtual currency balance displayed in the wallet as the amount of crime that has already occurred. The asset control situation, actual transfer situation, and basis for value determination may all require further verification.

But this does not mean that as long as the assets have not left the original address, the behavior does not carry criminal risk.

If the perpetrator, through deception, illegal acquisition of permissions, etc., has planned to seize control of another person's wallet, even if the asset transfer has not yet been completed, it may still require analysis of whether it has already constituted a crime in conjunction with the relevant crime composition and implementation stage.

Therefore, "the coins have not been transferred" cannot directly equate to "no crime has occurred," and "the wallet cannot be operated" cannot directly equate to "all assets have been stolen."

Both judgments are overly simplistic.

04 What evidence should be prepared when reporting a malicious multi-signature?

When encountering malicious multi-signature, many people's first reaction is to confront the other party or seek someone in various communities who can解除多签.

However, from the perspective of safeguarding rights, it is more important to quickly clarify the changes in permissions and secure evidence than to argue.

First, prove who originally controlled the wallet.

The wallet address itself cannot directly prove the ownership of rights in reality.

If one wishes to maintain rights through criminal procedures, it is necessary to organize wallet creation and usage records, historical transfer records, sources of asset acquisition, transaction vouchers, and other materials that can prove the actual control of the wallet previously as much as possible.

Especially in cases involving others managing on behalf of, co-managing, or corporate wallets, it is also necessary to distinguish who is the asset rights holder, who is merely the technical manager, and what authorization scope was originally agreed upon by both parties.

Second, find the specific records of permission modification.

In networks that support on-chain permission queries, one can check account permissions through the official block explorer, focusing on the transaction hash (TxID) of abnormal permission change transactions, occurrence time, block records, signature addresses before and after the change, weights, and signature thresholds.

This information helps explain why the wallet cannot operate and also helps prove when the abnormal state was formed.

If conditions permit, it is advisable to have a qualified technical person assist in analyzing the permission change process and retain original on-chain records for verification, rather than just a balance screenshot.

Next, try to restore how the other party obtained the opportunity to operate.

If someone requested to view the phone, provided an operation link, assisted in using the wallet, or requested a signature under the pretext of security certification before the incident, relevant chat records, webpage links, transaction现场资料, and electronic device records should be preserved as much as possible.

It should be particularly noted that on-chain records can usually prove that a certain permission change transaction occurred, but they do not necessarily directly prove who operated the wallet in reality.

To associate an on-chain address with specific individuals, it often requires corroboration from device traces, chat records, transaction relationships,现场证据, and other materials.

Finally, quickly assess whether the assets still have safe disposal options.

Upon discovering anomalies, it is inadvisable to continue recharging or paying so-called "unlocking fees" to suspicious wallets, nor should one easily provide private keys or mnemonic phrases to unfamiliar technical personnel.

If the account still retains legal and effective operational permissions, it should be promptly verified by trusted professionals for feasible safe disposal methods, while also retaining necessary evidence. If permissions can no longer be restored, it is necessary to assess subsequent on-chain tracking, criminal prosecution, and other relief paths based on specific circumstances.

For suspected criminal situations, preliminary materials can be brought to the public security organs for reporting. The public security organs should legally accept and review relevant reporting or accusation materials, but whether the case can be criminally filed still depends on whether it meets the corresponding conditions.

Even if there are currently no records of asset transfer, one can truthfully explain the illegal modification of permissions, the impairment of control ability, and potential asset risks, rather than describing the yet-to-occur transfer behavior as completed theft.

05 More important than asset balance is who truly holds the control.

The reason malicious multi-signature easily leads users to overlook risks is that it does not necessarily change the wallet balance immediately.

On the surface, the coins are still there; in actual operation, the original holder may already be unable to manage them.

For criminal legal analysis, such cases should not only focus on whether a transfer has occurred but also pay attention to how permissions were changed, whether the control relationship has undergone substantial changes, and what means the perpetrator used to obtain control permissions.

If, after malicious multi-signature, the entire balance is directly recognized as theft loss, it may overlook the actual control differences brought about by different permission structures; if it is assumed that there are no legal issues simply because the assets have not been transferred, it may also ignore the already occurred illegal acquisition of permissions and other behaviors.

For affected users, the most important thing is not to immediately label the event as "theft" or "fraud," but to first clarify the original control relationship of the wallet, the abnormal permission change process, the actual asset status, and the behaviors of relevant personnel.

Only with sufficiently complete facts and evidence can one further judge criminal responsibility, choose appropriate paths for safeguarding rights, and assess the realistic possibility of asset recovery.

The coins in the wallet may still be there, but that does not mean the risk has not occurred. What truly needs to be confirmed is whether the power to control the assets is still in your hands.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.