Xu Chao, 33, could face a “lengthy” prison sentence, the judge said. Most of his victims have not been identified.