The world's first hacker attacking the smart contract of the exchange to make profits constitutes a crime of fraud?

On July 11, 2023, the U.S. Department of Justice issued a press release, announcing that it would initiate criminal proceedings against a hacker attacking a virtual asset exchange. According to the press release, Damian Williams, the U.S. Attorney for the Southern District of New York, together with the U.S. Homeland Security Investigations, the U.S. Internal Revenue Service and other law enforcement agencies, conducted a detailed investigation and evidence collection on the case, and charged the defendant Shakeeb Ahmed (hereinafter Mr. A for short) is suspected of two crimes of "wire fraud" (wire fraud) and "money laundering" (money laundering). Mr. A was arrested in New York State on the morning of July 11 local time.

Notably, this case is the first case in the world in which a hacker was accused of "wire fraud" after profiting from attacking a virtual currency exchange. Sister Sa’s team believes that if the defendant (hacker) in this case is finally determined to have committed a crime related to telecommunications fraud, it is likely to create a dangerous and fascinating legal precedent-machines or programs can also be deceived.

01 Detailed explanation of the USA Vs. SHAKEEB AHMED case

In July 2022, defendant Mr. A (an American citizen residing in Manhattan, New York) planned and implemented a cyber attack on the smart contract of a virtual currency exchange. $9 million in virtual currency.

Specifically, the way Mr. A attacked the virtual currency exchange was very special. The exchange under attack is a decentralized virtual currency exchange established overseas and controlled and operated through smart contracts on the Solana chain, or it can also be called an "automated market maker" (automated market maker) . The biggest difference between this kind of automatic market maker and Mouan is that it can continue to operate on the chain according to the smart contract without the participation of "human" or only requires a very small amount of maintenance, providing users with virtual currency exchange or other specific services.

As a senior security engineer of an international blockchain technology company, Mr. A has extensive knowledge of blockchain and smart contracts and is familiar with smart contracts and blockchain auditing. He discovered the virtual currency transaction by using his own technical advantages. The major loopholes in the smart contract "deceived" the smart contract by tampering with the data, making the smart contract transfer the assets of other users in the exchange and the exchange fund pool to Mr. A under a wrong understanding. Mr. A's specific operation is very professional and complicated. For everyone's understanding, Sister Sa's team gave an inappropriate example to illustrate: Mr. A's behavior is similar to someone defrauding the bank through loopholes in the banking system program and false capital flows. The system made the system "mistakenly believe" that there were 100 billion deposits in his account, and settled the interest for the account holder on this basis (even if the interest rate is low, as long as the deposit base is large enough, the amount of interest will be huge ), what Mr. A cheated is equivalent to this "interest".

Subsequently, Mr. A quickly "laundered" the virtual currency of about US$9 million obtained by defrauding the smart contract of the virtual currency exchange through a series of operations:

(1) Trade the fraudulently obtained virtual currency on other trading platforms;

(2) Exchange the traded tokens into Ethereum tokens through cross-chain;

(3) Then exchange the Ethereum tokens for Monero coins which are less traceable;

(4) Use overseas cryptocurrency exchanges to trade and exchange Monero coins.

Sister Sa’s team believes that Mr. A has used almost all money laundering methods that an ordinary person can use to cover up and transfer his criminal proceeds, except that he did not use currency mixers and NFT to assist in money laundering. Early detection caused Mr. A to fail to transfer the assets involved. After the case happened, Mr. A also negotiated with the virtual currency exchange, and he was willing to return most of the proceeds of crime (required to leave 1.5 million US dollars) in exchange for the cryptocurrency exchange not reporting the matter to law enforcement agencies.

02 **Can smart contracts be the object of fraud? **

Under U.S. law, wire fraud refers to a crime in which the perpetrator uses some form of telecommunications or the Internet to commit fraud and defraud others of their property. Specifically, wire transfer fraud requires the perpetrator to use phone calls, faxes, emails, text messages, the Internet or social media to defraud the victim and defraud the victim of property. The U.S. Department of Justice’s Criminal Resource Manual Section 941.18 USC 1343 (Justice Criminal Resource Manual Section 941.18 USC 1343) identifies key elements that constitute wire fraud:

(1) Defendant voluntarily and willfully devised or participated in a scheme to defraud others of money;

(2) the defendant did so with fraudulent intent;

(3) It is reasonably foreseeable that interstate wire communications will be used;

(4) INTERSTATE WIRED COMMUNICATIONS ACTUALLY USED.

As a federal crime, wire fraud carries a maximum penalty of 20 years in prison and a hefty $250,000 fine if convicted by a court, and doubles the fine for corporations or unincorporated organizations, up to $500,000. It should be noted that, like China, the targets of wire transfer fraud crimes in the United States have always been natural persons, legal persons, and unincorporated organizations. There has never been a case of being convicted of a wire transfer fraud machine or program in history, which is why What makes the SHAKEEB AHMED case compelling.

So, can smart contracts constitute the criminal object of fraud? In fact, this issue has been discussed a long time ago, and it is quite controversial.

Scholars who hold the negative view believe that only people or legal persons and unincorporated organizations composed of people can become the criminal object of the crime of fraud, and pure machines or programs cannot be "deceived". According to the pre-set conditions, the corresponding results will be generated according to the different input data, so the machine cannot "fall into cognitive errors", and there is no possibility of being deceived. For example, Zheng Yang, a postdoctoral scholar at Beijing Institute of Technology, believes that the understanding that "machines can be defrauded" cannot stand the test. If artificial intelligence or other machines are included in the criminal object category of the crime of fraud, it is beyond the current development level of artificial intelligence, violates the pure tool attribute of artificial intelligence, and confuses the "cheat" in the crime of fraud with the "cheat" in the meaning of daily life. cheat".

However, some scholars believe that although machines cannot be deceived, "robots" can be deceived, because at this time the object of deception is actually the person behind the machine, and the machine can be regarded as an extension of human consciousness. For example, Mr. Liu Xianquan of East China University of Political Science and Law believes that because in some criminal law theories, "machines cannot be deceived" is a basic common sense, it cannot be taken for granted that my country's criminal law cannot defraud machines as a crime of fraud. This point of view It is to use the results as arguments.

In fact, the conclusion that "machines cannot be deceived" is based on the premise that "the meaning of fraud is to make the other party have a wrong understanding of the facts". If the object of fraud has no thinking ability at all, it is impossible to Facts have cognition, and there is no so-called "correct cognition" or "wrong cognition". Therefore, the theory holds that the object of fraud is limited to "people" or "organizations" composed of people.

However, with the rapid development of artificial intelligence, this basic cognition and common theory of criminal law are gradually being seriously challenged, and the issue of whether machines can be the target of fraud will become the focus of debate among jurists for some time to come.

03 **If this case happened in China, what kind of crime would it constitute? **

If this highly controversial case happened in China, the suspect may be involved in three crimes: (1) fraud; (2) theft; (3) information network crime.

(1) Fraud

According to the regulations on the crime of fraud in my country's "Criminal Law", the criminal suspect needs to use illegal possession as the purpose, commit a fraudulent act and make the victim fall into a wrong understanding, and voluntarily dispose of property to make the criminal suspect profit. Judging from common theory and a large number of judicial practices, the criminal object of the crime of fraud in my country is basically limited to natural persons, legal persons, and unincorporated organizations. However, in recent years, due to the rapid development of artificial intelligence and online payment, there are also cases that to some extent have broken through the restrictions on the object of fraud crimes.

For example, the "Wool" case of Grandpa Ken, a chain fast food restaurant chained by college students, has attracted widespread attention in recent years. In this case, the perpetrator took advantage of the loopholes in Grandpa Ken’s self-ordering machine and App. After purchasing the voucher for Grandpa Ken’s set meal, he logged in to the same account through multiple clients at the same time, and entered the state of ordering and waiting for payment on one client. Next, use another client to refund the exchange voucher, so that you can successfully eat Bawang Meal. Subsequent actors will also use this loophole to obtain the Grandpa Ken’s package meal code and sell it to others through a second-hand trading platform in a seafood market to make illegal profits.

In this case, the perpetrator refunded the coupons after initiating a false transaction, mainly by taking advantage of the data out-of-sync loophole between the Grandpa Ken app client and the ordering system of a certain social platform client to create an "information gap". , so that the misunderstanding of the ordering procedure occurred, thereby making illegal profits. In the end, the criminal suspect in this case was convicted and punished by the court for the crime of fraud. Although this case is an individual case, and our country is not a case law country, it can be seen from this case that as long as it complies with the law, the judicial organs of our country do not actually reject Appropriately expand the criminal object of the crime of fraud within a legal and reasonable range (of course, this move has also attracted a lot of controversy). In other words, if the SHAKEEB AHMED case happened in China, there is a certain probability that the suspect will be convicted and punished for the crime of fraud.

(2) Crime of theft or information network crime

Theft and information cybercrime are "old friends" of people in the currency circle. Around 2017, when the concept of virtual currencies such as Bitcoin gradually became popular and ICOs bloomed everywhere, theft and defrauding of other people’s virtual currencies abounded. crimes of illegally obtaining computer information system data, crimes of destroying computer information systems, etc.).

In the judicial practice at that time, a large number of cases of stealing or defrauding virtual currency were treated as information network crimes, mainly because the legal nature of virtual currency was unclear at the time, and the courts were reluctant to treat it as a kind of property rashly.

For example, Tian’s crime of illegally obtaining computer information system data [(2020) Ji 1102 Xingchu No. 500]. In August 2019, the victim, Liu, was introduced by a friend because he was preparing to invest in “Bitcoin”. The defendant Tian Mou. In that month, Tian helped Liu invest more than 2.57 million yuan to buy 35 "bitcoins", and downloaded "bitpie wallet" and "imtohen wallet" on Liu's mobile phone to store "bitcoins". During this operation, Tian obtained 12 English mnemonic words and login passwords to open the above-mentioned "wallet". In October 2019, the defendant, Tian, used the mnemonic and login password he had mastered to entrust a netizen surnamed Liu to enter the computer system to operate, and transferred 35 "bitcoins" in Liu's "wallet" to his own "bitcoin". special wallet" and sold 9 of them for personal consumption.

The court held that the defendant Tian, in violation of state regulations, illegally invaded other people's computer information systems and obtained data stored in the information systems.

In the case of SHAKEEB AHMED, the criminal suspect Mr. A essentially implemented a network attack. Although the smart contract fell into a wrong cognition, if viewed from its behavior itself, the attack on the smart contract itself is an illegal intrusion into the computer. information systems, illegally obtaining computer data, and hacking acts that destroy computer information systems. Therefore, Sister Sa’s team believes that it is not inappropriate to convict and punish it as an information network crime. Discuss. As for the crime of theft, Sister Sa’s team believes that its acquisition of virtual currency was achieved by “cheating” smart contracts. If the crime of theft is punished, there is a violation of the principle of legally prescribed penalties.

04 Written at the end

With the development of AI technology and the increasing popularity of human-computer interaction, the law, as a superstructure (social norms), will inevitably develop with the development of technology, so in the era of strong artificial intelligence, it is not uncommon to break through the crime of fraud. possibility.

At the same time, the words of Sister Sa’s team: Traditional legal theory has always been influenced by pure instrumentalism. The view that machines and programs cannot “think” and thus cannot produce “knowledge” is being challenged with the development of AI technology. As a new As legal practitioners and researchers of the era, we should look at and solve problems with tolerance and enterprising spirit. After all, history has proved that people who work behind closed doors and hold back the incompetence are never as good as those who see the world with their eyes open.