Layla Zulfa
A Singapore court has sentenced 38-year-old Chinese national Zhang Xinghua to a prison term of two years following his conviction for his involvement in a sophisticated conspiracy to defraud the cryptocurrency exchange SafeX of approximately $6.9 million (S$8.8 million). The sentencing, which took place after Zhang pleaded guilty to charges including the conspiracy to misuse a computer system and dealing with the proceeds of criminal conduct, marks a significant milestone in Singapore’s ongoing efforts to police the rapidly evolving digital asset sector. The case, characterized by a breach of corporate trust and the use of advanced obfuscation techniques, underscores the growing challenges faced by financial regulators and law enforcement agencies in tracking illicit capital flows within the decentralized finance (DeFi) ecosystem.
The Genesis of the Conspiracy: A Breakdown in Corporate Relations
The roots of the criminal enterprise can be traced back to a deteriorating business relationship between two technology entities: King Coder, the firm where Zhang and his accomplices were employed, and DTL, the parent company of the SafeX cryptocurrency exchange. According to court documents and prosecutorial statements, the trio involved in the theft leveraged their professional proximity to the exchange’s infrastructure to orchestrate a series of unauthorized intrusions. The prosecution highlighted that the motive for the theft appeared to be rooted in the collapse of the partnership between King Coder and DTL, providing the defendants with both the technical insight and the perceived justification to target SafeX’s digital reserves.
The conspiracy involved three primary actors. While Zhang has now been sentenced, the court heard that the primary technical execution of the theft was carried out by Chen Chong Xin, a colleague of Zhang who remains at large and is currently the subject of an intensive law enforcement search. A third accomplice’s legal proceedings remain pending as the judiciary continues to untangle the full extent of the group’s activities.
Chronology of the Theft and Unauthorized Access
The illicit operations against SafeX were not a single isolated event but a calculated series of breaches that took place over several months in 2025. Between June and August 2025, Chen Chong Xin allegedly gained unauthorized access to SafeX’s secure cryptocurrency vaults on three separate occasions. These vaults, designed to hold the exchange’s liquid assets and customer deposits, were breached using credentials or system vulnerabilities derived from the prior working relationship between the two firms.
During these intrusions, the conspirators successfully transferred a total of $6.9 million in various cryptocurrencies to a network of private wallets. The precision of the transfers suggested a deep familiarity with SafeX’s internal protocols. The timeline of the heists is as follows:
- June 2025: Initial breach and preliminary testing of the vault’s vulnerabilities, resulting in the first wave of unauthorized transfers.
- July 2025: A second, more substantial intrusion where a significant portion of the $6.9 million was siphoned into external accounts.
- August 2025: The final breach, which ultimately triggered the exchange’s internal security mechanisms.
The theft remained undetected for several weeks due to the sophisticated manner in which the funds were moved, often in smaller increments designed to bypass automated threshold alerts until the cumulative loss reached a critical mass.
Money Laundering and the Use of Tornado Cash
Once the funds were successfully exfiltrated from the SafeX vaults, Zhang Xinghua took a leading role in the "layering" phase of the money laundering process. To obscure the digital trail of the stolen assets, Zhang utilized Tornado Cash, a well-known cryptocurrency mixing service. Tornado Cash operates by pooling together the deposits of multiple users and then redistributing them to new addresses, effectively severing the on-chain link between the source of the funds and their destination.
Court records indicate that between July and August 2025, Zhang processed over $1.6 million of the stolen proceeds through Tornado Cash across two major transactions. By utilizing this decentralized mixer, Zhang attempted to make the funds "clean" and ready for integration into the legitimate financial system. Prosecutors revealed that had the police not intervened when they did, Zhang was positioned to receive a personal share of the spoils exceeding $886,000 in cryptocurrency.
The use of mixers like Tornado Cash has become a flashpoint for international regulators. While proponents argue that these tools are essential for maintaining financial privacy in a public ledger system, law enforcement agencies maintain that they are primarily used by state-sponsored hacking groups and cybercriminals to hide the origins of ransoms and stolen exchange funds.
Detection, Arrest, and Asset Recovery
The criminal scheme began to unravel in August 2025 when SafeX’s internal monitoring systems finally triggered a "low-balance alarm." This automated alert indicated that the exchange’s operational reserves had fallen below the safety threshold required to facilitate customer withdrawals and daily trading activities. This prompted an immediate internal technical audit, which quickly identified the unauthorized outflows to external wallets.
SafeX management promptly filed a report with the Singapore Police Force’s Technology Crime Division. Utilizing blockchain analytics and traditional investigative techniques, authorities were able to trace a portion of the funds to accounts linked to Zhang. He was arrested just days after the alarm was triggered.
In the aftermath of the arrest, Singaporean authorities moved to freeze and seize assets linked to the theft. To date, approximately $2.1 million in cryptocurrency has been recovered or frozen within the jurisdiction. However, the prosecution informed the court that a substantial portion of the stolen wealth—approximately $4.8 million—remains beyond the reach of local authorities. These funds are currently held in private non-custodial wallets and accounts at virtual asset service providers (VASPs) located in jurisdictions that do not have immediate reciprocal enforcement agreements with Singapore.
In an effort to mitigate his sentence, Zhang made a partial restitution of approximately $95,000 in Bitcoin. This restitution was facilitated through his wife, whose account on the Binance exchange had been used to receive a fraction of the illicit gains.
The Legal Landscape and Sentencing Considerations
In sentencing Zhang to two years in prison, the Singapore court considered both the severity of the breach and the defendant’s level of cooperation. Singapore’s Computer Misuse Act and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act provide for stringent penalties for those who facilitate cyber-enabled financial crimes.
The prosecution argued for a sentence that would serve as a deterrent, noting that Singapore’s reputation as a global fintech and crypto hub depends on the integrity of its digital infrastructure. "The exploitation of professional access to commit large-scale theft threatens the very foundation of trust upon which the digital economy is built," the prosecution stated during the proceedings.
While Zhang was not the primary "hacker" who breached the vaults, his role in laundering the proceeds and his participation in the conspiracy were deemed essential to the success of the operation. The court noted that his willingness to return a portion of the funds and his guilty plea provided some grounds for a more moderate sentence than the maximum allowable under the law.
The Broader Impact: The Tornado Cash Controversy
The sentencing of Zhang Xinghua occurs against the backdrop of a global legal battle over the status of cryptocurrency mixers. The case highlights the ongoing tension between privacy-preserving technology and anti-money laundering (AML) regulations.
Tornado Cash, in particular, has been at the center of high-profile legal actions. Its co-founder, Roman Storm, was found guilty in 2024 of operating an unlicensed money-transmitting business. More recently, in late 2025, federal prosecutors in the United States sought a retrial for Storm on even more serious charges of money laundering and sanctions evasion. This legal pressure exists despite a brief reprieve in March 2025, when the U.S. Treasury lifted certain sanctions on the protocol, acknowledging that mixers can have legitimate uses for lawful users seeking financial anonymity.
The SafeX case serves as a practical example for regulators who argue that regardless of the potential for legitimate use, the reality of current market activity involves mixers being used as a primary tool for "cleaning" stolen digital assets. Singaporean regulators have increasingly signaled that they will hold individuals accountable for the use of such tools when they are utilized to facilitate criminal conduct.
Implications for the Crypto Industry and Cybersecurity
The SafeX breach provides several critical lessons for cryptocurrency exchanges and the broader fintech sector:
- Insider Threat Management: The fact that the breach stemmed from a breakdown in a business relationship underscores the need for "zero-trust" architecture. Access credentials for third-party contractors and partner firms must be strictly managed and immediately revoked upon the termination of a contract.
- The Limitations of Automated Alerts: While the "low-balance alarm" eventually caught the theft, the delay of several weeks allowed millions of dollars to be laundered. Exchanges are now being encouraged to implement real-time transaction monitoring that flags unusual outflow patterns before reserves reach a critical low.
- Jurisdictional Challenges: The inability of Singaporean authorities to recover $4.8 million held in overseas wallets highlights the "jurisdictional arbitrage" that criminals exploit. This case adds weight to calls for a more unified global regulatory framework for VASPs.
- The Role of Centralized Exchanges in Recovery: The recovery of $95,000 through a Binance account demonstrates the vital role that centralized exchanges play in the law enforcement ecosystem. By maintaining robust Know Your Customer (KYC) protocols, these platforms remain the most effective "choke points" for catching criminals attempting to off-ramp digital assets into fiat currency.
As Zhang Xinghua begins his two-year sentence, the search for Chen Chong Xin continues. The SafeX case remains a stark reminder that as the value of the digital asset market grows, so too does the sophistication of the actors seeking to exploit its vulnerabilities. For Singapore, a nation-state that prides itself on being a safe harbor for financial innovation, the successful prosecution of this case is a clear signal that the "Wild West" era of crypto-crime is facing an increasingly capable and determined legal adversary.
