Three iToken front-end engineers conspired to implant a "backdoor" to steal the encryption Wallet, each sentenced to three years in prison.

On April 16, according to Yuntoutiao, from March to May 2023, three front-end development engineers, Liu, Zhang1, and Dong2, conspired to illegally obtain other people’s digital wallet private keys, mnemonics and other data by implanting a “backdoor” in the iToken APP application package in advance, and uploaded them to the database of the pre-built VPS backend server corresponding to the specified domain name, and then downloaded them to the local server. After identification, a total of 27,622 mnemonics and 10,203 private keys (all deduplicated) were illegally obtained, and 19,487 digital wallet addresses (deduplicated) were successfully converted into the above-mentioned mnemonics and private keys. Liu is responsible for writing the code for the request logic; Zhang 1 is responsible for the construction of VPS and database, and the upload of iToken on Android; Dong 2 is responsible for purchasing domain names, encrypting users’ private keys, and uploading iTokens on IOS. Defendants Liu, Zhang1, and Dong2 all confessed to the above facts of the crime after they arrived at the case. The court held that defendants Liu, Zhang1, and Dong2 ganged up to illegally obtain computer information system data by using other technical means in violation of state regulations, and the circumstances were particularly serious, and their conduct constituted the crime of illegally obtaining computer information system data and should be punished. The prosecution was convicted of the charge. The three defendants were sentenced to three years in prison and fined 30,000 yuan for illegally obtaining computer information system data. Defendants Liu, Zhang1, and Dong2 are prohibited from engaging in network security management and network operations and related work for three years from the date on which the criminal punishment is completed.