A Singapore court has sentenced Zhang Xinghua, a 38-year-old Chinese national, to two years in prison for his involvement in the theft of approximately $6.9 million in cryptocurrency from the SafeX exchange. Zhang pleaded guilty to two charges: conspiracy to commit unauthorized access to computer systems and handling the proceeds of criminal conduct.
The case originated from a breakdown in business relations between King Coder, where the conspirators worked, and DTL, the parent company of SafeX. Between June and August 2025, another individual, Chen Chong Xin (who remains at large), accessed SafeX's digital vaults without authorization on three separate occasions, transferring the stolen funds to multiple external wallets.
Zhang's role began at the laundering stage. Prosecutors documented that he deposited more than $1.6 million across two transactions through the crypto mixer Tornado Cash in July and August 2025, using the service to obscure the trail of the stolen assets. Without police intervention, Zhang would have received a share of over $886,000 in cryptocurrency.
The theft was discovered in August 2025 when SafeX's internal systems triggered a low-balance alert on its wallets. The platform conducted internal checks, filed a police report, and authorities arrested Zhang within days. The court also noted that Zhang's wife received a portion of the stolen funds via her Binance account, through which Zhang later made a partial restitution of approximately $95,000 in Bitcoin.
Singaporean authorities managed to seize or freeze around $2.1 million linked to the case. However, approximately $4.8 million remains beyond their jurisdictional reach, spread across private wallets and virtual asset service providers in other countries. The case of one alleged accomplice is still pending before the courts.
The incident reignites the global regulatory debate surrounding crypto mixers like Tornado Cash. While the U.S. Treasury lifted sanctions on Tornado Cash in March 2025, acknowledging potential legitimate uses for financial privacy, the protocol's founder, Roman Storm, was convicted last year in the United States for operating an unlicensed money transmitter. Federal prosecutors have since requested a retrial on more serious charges of money laundering and sanctions evasion.
