US Extradition Requests Denied by Russia and China

An indictment promises accountability. For a hacker living in a state that shields its own, it delivers nothing. The gap between those two facts is the entire story of why most state-linked hackers named by the US Justice Department never see a courtroom, and the reason is not some diplomatic misunderstanding that a phone call could fix. Three mechanisms work together by design: no treaty obligation, constitutional bans on handing over citizens, and deliberate state policy that treats its own hackers as assets worth protecting. Each one alone would stop most extradition requests cold. Stacked together, they form a closed system, and every section that follows just shows a different wall in that system.

How the Absence of Extradition Treaties Removes Legal Compulsion

Extradition runs on treaties, and without one, a country has zero legal duty to hand anyone over, no matter how airtight the evidence or how many pages the indictment runs. The United States has no extradition treaty with Russia or China. That single fact is the foundation everything else in this piece sits on top of.

Treaty absence doesn't mean extradition is flatly impossible, though. Under the international law principle of comity, any country can choose to extradite someone without a treaty obligating it to, if doing so serves its interests at the time. That sounds like a loophole for the US, but flip it around: it also means the decision belongs entirely to politics, not law. The question stops being "does the law require this country to hand someone over?" and becomes "does this country want to?" For Russia and China, the answer is structurally no, and the next section explains the specific reasons why.

Constitutional Prohibitions and State Policy in Russia and China

Treaty absence hands Russia and China discretion. Their own laws take that discretion and lock it shut. Russia's constitution bars surrendering its own nationals under any circumstances, and China does the same by statute. That means even if Washington and either of those governments sat down tomorrow and drafted a treaty, it still wouldn't compel the surrender of one of their own citizens without a constitutional change first. The treaty would exist on paper while the people it's supposed to cover stay exactly where they are.

Russia's situation adds a second complication on top of that, a mutual-exposure problem. The US has indicted Russian intelligence officers for hacking American organizations, and any mutual extradition agreement cuts both ways: it would open the door to Russia demanding the surrender of US intelligence personnel in return. That's a trade Washington will not make.

China's blocking condition runs through human rights concerns instead. The US has never agreed to an extradition treaty with China, partly over those concerns, and the one partial workaround that used to exist, an extradition arrangement with Hong Kong, was suspended in 2020 after Beijing imposed its national security law there. The side door closed along with the front door.

None of these four barriers, treaty absence, constitutional prohibition, state policy, and geopolitical standoff, is an alternate explanation competing with the others. They operate at the same time, reinforcing each other, and all four would need to fall before extradition became realistic. Right now, none of them are anywhere close to falling.

What state-sponsored hacking looks like when accountability is structurally removed: the indictment record

Taking away the risk of arrest means hacking campaigns stop looking like one-off crimes and start looking like institutional programs with budgets and reporting lines. The indictment record backs this up with real cases, not hypotheticals.

In March 2024, the Justice Department indicted seven Chinese state-linked hackers connected to APT31 and Wuhan Xiaoruizhi Science and Technology Co., charged with targeting senior US officials, including people at the White House and in Congress, both Senators and Representatives among them. All seven are believed to still be living in China.

Salt Typhoon, active from 2024 into 2026, went after telecommunications infrastructure, specifically the CALEA lawful intercept systems US law enforcement relies on for court-ordered wiretaps. If Chinese intelligence had access to those systems, it potentially had a list of exactly who US law enforcement was watching. The FBI has notified more than 600 organizations of potential breaches tied to this campaign, and nine major US telecom companies have been infiltrated.

Volt Typhoon took a different approach: burrowing into US critical infrastructure, power grids, water systems, communications, transportation, and sitting there quietly, building dormant access for potential use later. CISA confirmed in February 2024 that Volt Typhoon had already been inside US critical infrastructure for at least five years by that point.

Identified. Named. Indicted. Still operating. That's the pattern across all three cases, and it holds because being identified without the possibility of arrest carries no real cost.

The US "Name and Shame" Strategy

Since arrests aren't realistically on the table, the US has leaned on a different tool: issuing criminal indictments against hackers it knows it cannot bring in. The goal is to prove attribution capability, impose a reputational hit, and discourage the next operation before it starts.

There's a real case for this working, at least partially. Indictments and sanctions have, in some instances, pushed state-backed hackers to slow down while they figure out how they got caught. A DOJ official confirmed that a slowdown "usually" follows an indictment release, as the named actors scramble to work out what exposed them. Reporting on this strategy has found that the most effective actions against state-backed attackers haven't come from Cyber Command at all, but from attribution, indictments, and the threat of sanctions.

Volt Typhoon offers a specific data point here. According to Secureworks, Volt Typhoon's unusually tight operational security likely grew out of embarrassment over the steady drumbeat of US indictments against Chinese state-backed hackers, combined with pressure from Chinese leadership to keep operations out of the headlines. Indictments appear to have changed how the group operates day to day, even if they didn't change what the group was there to do.

That's the limitation baked into the whole strategy. Naming someone works as a deterrent in a world where naming eventually leads to arrest. When arrest is off the table structurally, naming becomes a political signal instead of a legal threat, and how much it actually deters anyone depends entirely on how much the named hackers (and the governments backing them) care about getting called out in public.

The Xu Zewei Case and the Travel-Trap Model

Russia and China won't hand their citizens over. But the protection those two countries provide only works while the person stays inside their borders, and the Xu Zewei case is the clearest recent proof of exactly that.

Xu Zewei arrived in Houston, Texas, in late April 2026 after Italy approved his extradition, a journey that started the moment he left protected territory and ended in a federal courtroom. Earlier cases follow the same pattern. Russian national Peter Levashov was arrested in Spain and extradited to the US. Yevgeniy Nikulin, charged with hacking LinkedIn and Dropbox, was extradited out of the Czech Republic. Roman Seleznev was picked up in the Maldives, a country with no formal extradition treaty with the US at all, and was surrendered anyway.

The rule holds steady across every one of these: the accused left the country protecting them, and a nation willing to cooperate, whether by treaty or by choice, made the arrest. None of it required Russia or China to change a single law.

A co-defendant named in the same indictment as Xu Zewei, Zhang Yu, 44, remains at large. That one detail keeps the structural argument intact: this model catches the person who travels, not the network behind them. The protection Russia and China offer their hackers is durable, but it only covers geography. Hackers who understand this have learned exactly which countries will cooperate and which won't, and they plan their travel around that map.

What permanent impunity means for defenders who must treat named adversaries as permanent threats

Knowing exactly who ran an attack doesn't translate into a legal remedy when the mechanisms covered above are all blocking the door at once. That leaves defenders with one working assumption: named, identified adversaries are going to keep operating, indefinitely, regardless of how many indictments pile up with their names on them.

That changes the question a security team actually needs to answer. It's not "will this actor eventually get arrested?" It's "how do we build defenses assuming this actor keeps operating at scale, with state resources, specifically against us?" Those are two very different starting points for a security program, and only one of them matches reality.

The March 2025 indictment wave against I-Soon, along with the separate charges against Silk Typhoon members Yin Kecheng and Zhou Shuai, made the institutional nature of this threat explicit. A US official described the I-Soon defendants as "cyber mercenaries" who received financial backing for their work, and the DOJ's own announcement states the group "conducted computer intrusions at the direction of the PRC's MPS and Ministry of State Security (MSS)," charging those agencies between roughly $10,000 and $75,000 for each email inbox it successfully broke into. That's a contractor relationship with a line item and an invoice, backed by a sovereign state rather than a handful of individuals who might eventually be deterred or hauled into court.

Security vendors talking to CISOs and practitioners need to build their threat intelligence around that reality, not around the hope that it will someday resolve itself. Content that treats named adversaries like Salt Typhoon or Volt Typhoon as permanent features of the landscape, not temporary problems waiting on a legal fix, is the only kind that actually matches what defenders are up against. Anything that soft-pedals this structure loses credibility fast with an audience that already knows better. Content that reasons from this reality instead of around it is the content that earns trust with the people who have to defend against it every day.