Game Leaks Just Became a Criminal Matter. What Evidence Does a Studio Actually Hold?

Once leaks became criminal cases, the evidence bar moved

Three people in Shanghai pulled content out of unreleased builds, and two of them were convicted on April 24.

The method was not sophisticated. Three men born after 2000, surnamed Su, Wu, and Zhou, obtained internal test builds, extracted unreleased material, and uploaded it to video platforms. Unannounced characters, skill animations, and in-game scenes from Genshin Impact, Honkai: Star Rail, and Zenless Zone Zero circulated that way. The motive was ordinary: drive traffic to their accounts, collect platform rewards, take viewer tips. They reportedly believed that deleting the videos after a platform warning would end the matter. Even the discovery was close to accidental. Police found the leaks during a routine visit to miHoYo’s facility in Shanghai’s Xuhui District in October 2025, and the case was made public on February 27, 2026 (Shanghai Daily).

The verdict came on April 24, 2026. The charge was copyright infringement. Su received one year and two months of imprisonment with probation, Wu one year of detention with probation. Su’s videos had passed 600,000 views, Wu’s 300,000 (Global Times).

Look at what the studio side had to work with and the gap is obvious. Everything that mattered finished before anyone noticed. The build left the building, no system recorded which handout it came from or what was extracted, and nothing captured the view counter as it climbed past 600,000. What remained was a takedown request filed after the fact.

The volume is not trivial either. In 2025 alone HoYoverse filed 2,388 civil lawsuits, cooperated with police on 22 criminal investigations, suspended 988 accounts, obtained 1,240 public apologies, and removed more than 109,000 infringing links, recovering 37 million yuan, roughly $5.38 million, in damages and settlements (AUTOMATON WEST, GamingOnPhone). Divide the recovery by the lawsuit count and the average lands in the low thousands of dollars per action. A legal department is running like a factory at that unit price. The problem is not that leaks happen. It is that the cost of processing one case eats most of what the case recovers.

What changed is not the mood but the baseline

What changed is not sentiment. It is the threshold.

A judicial interpretation issued by China’s top judicial authorities in April 2025 fixed the criteria for criminal liability as numbers: distributing more than 500 infringing works, providing more than 10,000 downloads, accumulating more than 100,000 views, or running a paid membership service with more than 1,000 users (Shanghai Daily). The April 2026 conviction is the first demonstration that the path runs all the way through. miHoYo itself described it as the first criminal game leak case brought under that new interpretation.

Numeric thresholds favor software, because they are counted rather than judged. Until now, evidence bought a takedown and nothing more. Evidence that is timestamped and preserved can now support a criminal referral. That changes what a leaker weighs before uploading, and it changes what a publisher’s legal team can do on a Monday morning.

There is a trap built into the same threshold. View counts live on platforms, and things on platforms get deleted. The Shanghai defendants believed deletion would settle it, and mechanically they were half right: deletion destroys the counter. If nobody snapshots the moment a video passes 120,000 views, there is later no way to prove it ever crossed the line. The core function of this market is therefore not detection. It is the timing of preservation.

Widen the lens and this is not only a games problem. Pre-release screeners, unreleased music, hardware drawings and review decks all sit in the same structure. But the place where the threshold is written as a number and the case law now exists is Chinese games. The first customer’s address is already known.

Stack it in three layers, and respect the order you sell them in

Three layers, sold in this order.

The first layer is evidence, and it is the wedge. Define a watchlist of creator accounts, keyword patterns, and invited seats in closed groups. Match candidate frames by perceptual hash against a private register of unreleased asset fingerprints. On a hit, generate a bundle carrying URL, first-seen timestamp, cumulative view trajectory, an archived copy, and a hash anchor, with the item’s current position against each statutory threshold shown on the front page. No engine integration, so it turns on in a week, and the contract closes with legal rather than with security.

The second layer is per-recipient build marking. The common misconception is that this requires steganography in every texture, which is expensive and dies in compression. What actually works is per-recipient variance placed where nobody looks and nobody strips: padding in string tables, asset load order, unused UV offsets, per-build audio dither, small noise in shader constants. The goal is identifying which handout produced a ten-second clip or a single screenshot, not perfect concealment.

The third layer is the access ledger: which build hash went to which account on which device, joined to the evidence bundle so the chain from handout to publication becomes one document. Given that account tracing was the slowest part of the Shanghai investigation, that join is where the value sits.

flowchart LR
  A[Pre-release build<br/>per-recipient marking] --> B[Access ledger<br/>build hash, account, device]
  C[Public platform monitoring<br/>video and image fingerprints] --> D[Evidence bundle<br/>timestamp, hash, view count]
  B --> E[Source attribution<br/>which handout leaked]
  D --> E
  E --> F[Threshold check<br/>takedown, civil, or criminal]

Go to market with Chinese publishers first. It is the one jurisdiction where the enforcement path demonstrably runs end to end, and the budget is already documented in public. Korean and Japanese publishers shipping into China come next, then console and PC teams that run heavy pre-release distribution.

There are exactly two numbers to watch

Two numbers matter. Time from first public upload to a completed evidence bundle, and the share of confirmed leaks traced back to a specific handout. If the first number exceeds a day, this is a reporting tool rather than an enforcement tool, and the market has plenty of reporting tools.

The real adoption barrier is not performance, though. Attribution frequently points inward. The Shanghai three were extracting from internal test builds. Installing attribution means installing a system that will eventually put an employee’s name or a QA vendor’s name on a screen, and that opens HR and contractual problems a studio would rather leave shut. So a mode where the default report shows the leak without the name, and identity is visible only to one designated security owner, has to exist from day one. That is not a feature. It is what determines whether the deal signs.

The opposite risk is worth pricing too. A tool that makes enforcement cheap makes overreach cheap. HoYoverse’s 2,388 lawsuits read as diligence and as community liability at the same time, and a customer is ultimately judged on where it drew the line. Build the threshold logic into the product so that a criminal path is only recommended where the statutory numbers are genuinely met. That is not compliance decoration. It is what keeps the buyer from becoming the next headline.

The week after a leak breaks is when this product sells itself. The trouble is that starting then leaves nothing to work with. A mark is only a mark if it went into the build beforehand, and a view count is only evidence if someone captured it before it was deleted.