Crypto Asset Freezes, Website Seizures, and Forfeiture: Inside DOJ’s October 2026 Enforcement Push and Where the Defense Begins
Between October 13 and October 14, 2026, federal and state authorities announced three separate actions against cross-border fraud networks. Each used a different tool. Each reached operators abroad through the assets, devices, and accounts they kept in the United States.
On October 13, the Justice Department’s Criminal Division announced the results of “Joint Disruption Week”, the first coordinated international operation aimed at scam centers in West Africa. The same day, the National Security Division announced an indictment, two arrests, and the seizure of roughly 187 devices in a North Korean remote IT worker case. On October 14, the Brooklyn District Attorney and FBI New York disabled 241 fraudulent crypto investment websites and seized 112 servers hosted in the United States and Eastern Europe.
The money came first in every case. Private-sector partners identified more than $11 million in freezable funds tied to the West African networks. The North Korean scheme routed about $3 million to sanctioned entities. The Brooklyn scheme took tens of millions from victims, and prosecutors have seized about $300,000 so far with no arrests announced. In each matter the government moved against assets and infrastructure before, or instead of, bringing the foreign operators to a U.S. courtroom.
The Policy Behind the October Actions
The policy behind these actions is explicit. Executive Order 14390, signed March 6, 2026, directs the Attorney General to prioritize prosecutions of cyber-enabled fraud and scam centers and to pursue the most serious provable offenses. It also orders a recommendation for a Victims Restoration Program funded by money clawed back, forfeited, or seized from transnational criminal organizations. The FBI’s 2025 Internet Crime Report supplied the numbers behind the order: 72,984 investment scam complaints, 72 percent involving cryptocurrency, and crypto investment losses of more than $7.2 billion, up 24 percent in one year.
Seizure used to follow conviction. Now it opens the case.
The Three Actions
Joint Disruption Week: DOJ Targets West African Scam Centers
During the week of October 6, 2026, law enforcement from more than ten countries and a group of technology and crypto companies worked from the UK National Crime Agency’s headquarters in London to hit scam centers in Ghana and Nigeria. DOJ called it the first coordinated effort focused on West Africa. The results were announced October 13.
The U.S. side included the Criminal Division’s Cyber-Enabled Scam Initiative, the Scam Center Strike Force run by the U.S. Attorney’s Office for the District of Columbia, the FBI, the Secret Service, the Treasury Department, Homeland Security Investigations, and the Homeland Security Task Force. Nigerian and Ghanaian cybercrime authorities ran the arrests on the ground. Private partners included Meta, Google, Microsoft, OpenAI, Binance, Coinbase, Chainalysis, Elliptic, and TRM Labs.
DOJ reported 28 arrests: 19 in the Accra suburb of Sasaabi, Ghana, and 9 in Nigeria. Authorities seized 356 electronic devices, 303 in Ghana and 53 in Nigeria. In Ghana they identified 117 human trafficking victims now awaiting repatriation to Nigeria, along with 89 fraud victims whose losses total roughly $8.3 million. The platforms removed more than 3.7 million fraudulent accounts, Pages, and Groups and shared leads on more than 30 suspected scam centers with law enforcement. The private-sector partners identified more than $11 million in potentially freezable funds.
The schemes included law enforcement impersonation, digital “arrest” extortion, and cryptocurrency investment fraud of the pig-butchering type, where a victim is coached into a fake trading platform and locked out when they try to withdraw.
Two features of the operation bear on the cases that will follow. First, the freezable funds were identified by exchanges and blockchain analytics firms, not by a court. Those identifications become freeze requests to exchanges, then seizure warrants, then civil forfeiture complaints. The Strike Force has run that sequence before. In July 2026 it filed civil forfeiture complaints seeking more than $25 million in crypto traced through hundreds of addresses from five scam investigations. In September it restrained about $52 million and seized Telegram channels tied to the Xinbi Guarantee marketplace.
Second, DOJ framed the week as a beginning. Assistant Attorney General Tysen Duva said the arrests and takedowns were “just the beginning,” and the release ties the operation directly to Executive Order 14390. The Strike Force, launched in November 2025 to target Southeast Asian scam compounds, now has a second theater. DOJ described the week as the start of sustained law enforcement action. The leads developed in London are the raw material for charged cases in U.S. districts.
The North Korean Remote IT Worker Prosecutions
On October 13, 2026, the Justice Department announced charges against 14 people in a scheme that placed North Korean IT workers inside more than 70 U.S. companies using stolen identities. Two U.S. nationals were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten China-based defendants are named in the Northern District of Ohio indictment. Two more remain under seal.
The indictment charges conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft. Pena also faces an aggravated identity theft count under 18 U.S.C. § 1028A, which carries a mandatory two-year sentence consecutive to any other term.
The scheme ran from 2019 to about July 2025. North Korean workers applied for remote jobs using stolen or fabricated identity documents and routed their connections through VPNs and proxies to appear to be inside the United States. U.S. facilitators received the laptops that victim companies shipped to new hires, kept them powered and online at their homes, and installed remote-access software so the workers abroad could log in. The facilitators then moved the wages onward. Prosecutors allege the identities of more than 25 U.S. persons were used and that false information reached the Department of Homeland Security, the IRS, and the Social Security Administration.
The workers earned about $3 million. DOJ says that money went to sanctioned entities controlled by the North Korean government. Victim employers spanned health care, communications, cyber support, retail, and manufacturing in Ohio, sixteen other states, and the District of Columbia. According to the indictment as reported by crypto.news, participants moved earnings between bank accounts and virtual currency before sending funds abroad, and the affected companies incurred at least $3 million in legal, network repair, and related costs.
Separately, between September 21 and 25, the FBI searched more than 40 Texas residences known or suspected to be laptop farms in an action called Operation Lonestar Roundup. Agents seized approximately 187 laptops and KVM devices. CrowdStrike tracks the group as “Famous Chollima.” The FBI issued a public service announcement the same day describing how North Korean operators now recruit Americans under financial pressure to attend interviews, appear on camera, verify identities, and keep employer laptops online, and how they spread devices across more homes to limit the damage when one is found.
The case belongs to the DPRK RevGen: Domestic Enabler Initiative, a joint National Security Division and FBI effort that has produced charges and sentences in June 2025, November 2025, April 2026, and May 2026. The pattern is consistent. The North Korean workers are beyond reach. The U.S. facilitator who hosted the laptops and moved the money is the defendant.
For companies, the exposure runs in two directions. An employer that unknowingly paid a North Korean worker is a victim in the indictment. The same employer paid wages that ended up with sanctioned entities, and the North Korea Sanctions Regulations at 31 C.F.R. Part 510 impose civil liability without regard to intent. A 2022 advisory from Treasury, State, and the FBI warned that individual North Korean IT workers can earn up to $300,000 a year and that the revenue supports the regime’s weapons programs. That advisory is now four years old. The enforcement that followed it is accelerating.
Brooklyn DA and FBI Disable 241 Crypto Fraud Websites
On October 14, 2026, Brooklyn District Attorney Eric Gonzalez announced that his office’s Virtual Currency Unit, working with FBI New York, had seized and disrupted 241 fraudulent cryptocurrency investment domains and 112 servers. The DA’s office called it one of the largest cyber enforcement actions ever taken by a local prosecutor. The Brooklyn DA’s release describes a three-year investigation into a single organization that targeted Russian-speaking residents of Brooklyn and other parts of the country.
The scheme followed a script. A victim answered a Facebook ad in Russian promoting investment opportunities. An “investment advisor” called, also in Russian, and walked the victim through opening an account on a trading platform. The victim bought cryptocurrency and sent it to addresses tied to the platform. After weeks or months of fake gains, the victim tried to withdraw and was locked out or told to pay taxes and fees first. Weeks later, the same operators called back posing as a recovery service that could retrieve the lost funds for an additional charge.
The operators ran their infrastructure from Ukraine and other Eastern European countries. The servers themselves sat with hosting companies in both Eastern Europe and the United States. Last week prosecutors executed search warrants across three time zones in a window of several hours, taking the domains offline and seizing more than 100 cloud-based servers. The seizures captured the data that populated the sites, the victim lists, and the operational software. Estimated losses run to tens of millions of dollars. The office has seized about $300,000 to date and says it is working to recover more.
This was an escalation. Before last week, the Virtual Currency Unit had already seized or disrupted roughly 400 domains tied to crypto investment fraud, including 70 domains in June 2024 linked to about $5 million in losses. Domain seizures warned victims but did little else. New sites appeared within days. By going after the servers, prosecutors removed the operators’ ability to spin up replacements and to re-contact existing victims.
Three points stand out. First, no arrests were announced and no operators were named. The action was built entirely around infrastructure and funds. Second, a county prosecutor obtained warrants that reached servers hosted by U.S. companies and coordinated with foreign hosts to reach the rest. Third, the unit that did it was formed in 2023 and is now on its second major takedown. State and local offices are building standing crypto tracing and seizure capability that runs parallel to DOJ’s. A person or company whose accounts or servers touch this ecosystem can expect inquiries from more than one sovereign.
The operators sit in Ghana, Nigeria, Pyongyang, and Eastern Europe. The government reached them through what they kept in the United States: laptops, servers, domains, exchange accounts, and the facilitators who ran them. In each case the property moved first. The charges, where there were any, followed.
What the Three Actions Have in Common
The operations were run by different agencies against different targets on different continents. Four patterns connect them.
The money is seized before anyone is charged
In West Africa, the $11 million in freezable funds was identified by exchanges and analytics firms during the week in London, with charges to follow. In Brooklyn, $300,000 was seized and 112 servers were taken with no defendant named. In the North Korea case, the Texas laptops were seized three weeks before the first arrest. When the operators are abroad, the property is the only thing within reach, and federal forfeiture law lets the government proceed against property alone.
Infrastructure is seized as facilitating property
The three actions took 356 devices in Ghana and Nigeria, 187 laptops and KVM switches in Texas, 112 servers, 241 domains, and 3.7 million social media accounts. Seizing a server removes the victim list and the means to re-contact those victims. Seizing a laptop ends a revenue stream. Each seizure also produces evidence. The Brooklyn servers confirmed the losses. The Texas devices hold connection logs. The Ghana phones hold the chats.
Foreign operators are reached through their U.S. touchpoints
Every one of these schemes needed something inside the United States. A laptop in a Texas apartment. A server with a U.S. host. A Coinbase or Binance account. A Meta ad account. A domestic bank account opened by a mule. Those touchpoints are where warrants land and where the charged defendants come from. DOJ used the same theory in July 2026 against money mule networks and bulletproof hosting providers, and in the Chen Zhi case, where it indicted a Cambodian executive and filed a $15 billion bitcoin forfeiture while he was still abroad.
The private sector does the first pass
Meta, Google, and Microsoft removed the accounts. Chainalysis, Elliptic, and TRM Labs attributed the wallets. Binance and Coinbase flagged the funds. CrowdStrike tracked the North Korean group and handed its findings to the FBI. Shadowserver and the hosting companies cooperated in Brooklyn. The probable cause behind a crypto seizure warrant now often starts with a private firm’s address-clustering heuristics. Those heuristics are a starting point for investigators. They are also the first thing a claimant contesting a seizure will test, because clustering can sweep in addresses that belong to someone else.
How Asset Freezes and Seizures Work in Federal Crypto Cases
A crypto asset freeze and a seizure are different events with different legal footing. The freeze usually comes first and requires no court. The seizure requires a warrant. The forfeiture that follows decides who keeps the money.
The exchange freeze
Most freezes begin with a request from law enforcement or a flag from an exchange’s own compliance system. The exchange locks the account under its terms of service. No statute compels it and no judge has reviewed anything. The account holder typically receives a notice that the account is restricted and nothing more. A freeze of this kind can last for weeks while agents prepare a warrant application, and the exchange will not release the funds while a law enforcement hold is in place.
The seizure warrant
Under 18 U.S.C. § 981(b), property subject to civil forfeiture may be seized on a warrant issued in the same manner as a search warrant under Rule 41 of the Federal Rules of Criminal Procedure. The government must show probable cause that the property is forfeitable. A warrant may issue in any district where a forfeiture action could be filed and may be executed wherever the property is found. For crypto, execution means the exchange transfers the assets to a government-controlled wallet. The U.S. Marshals Service takes custody.
Section 981(a)(1)(C) reaches proceeds traceable to wire fraud and other specified unlawful activity. Section 981(a)(1)(A) reaches property involved in a money laundering transaction, which can include clean funds commingled with tainted ones.
Administrative and civil forfeiture
After a seizure the government has two paths. For most personal property it can proceed administratively, without filing anything in court, by sending notice to interested parties. The Civil Asset Forfeiture Reform Act, codified at 18 U.S.C. § 983, sets the clock. The seizing agency must send written notice within 60 days of the seizure. A person who wants to contest must file a claim by the deadline in the notice, which cannot be earlier than 35 days after the notice is mailed. Filing a claim stops the administrative process. The government then has 90 days to file a judicial complaint or return the property.
In a judicial case the claimant files a verified claim and an answer. The government bears the burden of proving by a preponderance that the property is forfeitable. An owner who did not know about the underlying conduct, or who bought the property for value without reason to believe it was tainted, can assert the innocent owner defense under § 983(d). The claimant bears that burden. A claimant facing hardship can seek release of the property pending trial under § 983(f).
Notice can be the government’s weak point. In a September 2026 ruling reported by crypto.news, a federal judge in Washington granted forfeiture of about $212,700 in stablecoins tied to North Korean IT worker payments but declined to forfeit the rest of a request exceeding $7.7 million because the government’s public notice had not adequately identified the property.
Criminal forfeiture after indictment
Once a defendant is charged, the indictment carries a forfeiture allegation under Rule 32.2. Money laundering counts support forfeiture of property involved under 18 U.S.C. § 982. Wire fraud counts support forfeiture of proceeds through 28 U.S.C. § 2461(c). The procedures of 21 U.S.C. § 853 apply. The court can enter a pretrial restraining order under § 853(e), enter a money judgment, and reach substitute assets under § 853(p) when the original property cannot be found.
Three Supreme Court decisions govern pretrial restraint and the scope of criminal forfeiture. Kaley v. United States, 571 U.S. 320 (2014), holds that a defendant cannot relitigate the grand jury’s probable cause finding to lift a pretrial restraint on tainted assets. Luis v. United States, 578 U.S. 5 (2016), holds that the government cannot restrain untainted assets a defendant needs to pay counsel. Honeycutt v. United States, 581 U.S. 443 (2017), holds that a defendant forfeits only what he personally obtained, with no joint and several liability for a co-conspirator’s take.
A third party who claims an interest in property named in a preliminary order of forfeiture has 30 days after notice to petition under § 853(n). Courts strictly enforce that deadline.
Domains and servers
A domain is property. The government seizes it with a warrant served on the registrar or registry, which redirects the domain to a server displaying a seizure banner. Physical and cloud servers are imaged or taken under a search warrant, and their contents become evidence. Where the host sits abroad, the request goes through a mutual legal assistance treaty or direct cooperation with the foreign provider. State prosecutors follow their own search warrant and forfeiture statutes. In New York that includes civil forfeiture under CPLR Article 13-A.
When property is seized under a search warrant and no forfeiture proceeding is pending, the owner can move for its return under Rule 41(g). That motion is often the only vehicle for a company whose server was imaged because a tenant on it ran a scam.
Where the money goes
Forfeited funds go to the Assets Forfeiture Fund. Victims can petition for remission under 28 C.F.R. Part 9 or receive restoration through court-ordered restitution. Executive Order 14390 directed the Attorney General to recommend a Victims Restoration Program built on seized and forfeited cyber-fraud proceeds, which signals that remission will become a larger part of these cases. For an account holder whose funds were swept into a seizure, remission and a claim are different remedies. A petition for remission asks the Attorney General for discretionary relief and does not contest the forfeiture. Only a timely claim under § 983 does.
Who Faces Exposure When the Government Freezes First
The named defendants in these actions are a small part of the population they affect. Freezes and seizures of this scale reach people and companies who were never the target.
Exchange account holders
When an analytics firm clusters a scam wallet, every address that received funds from it can be flagged. A trader who bought tokens from a counterparty, a merchant who accepted crypto from a customer, or a person who received a repayment from a friend can find an account locked at Coinbase or Binance with no explanation. The exchange will not say who asked. The seizure warrant, when it comes, will describe the account as holding proceeds of wire fraud. The innocent owner defense exists for this situation. It requires a claim filed on time and a record showing how the funds were acquired.
Domestic facilitators
The person who hosted the laptops, opened the bank account, incorporated the shell, or rented the server is the defendant the government can reach. In the North Korea case, the FBI says facilitators were recruited while under financial pressure and paid to keep company laptops online. Money laundering conspiracy under 18 U.S.C. § 1956(h) requires proof that the defendant knew the funds came from unlawful activity. Aggravated identity theft requires proof that the defendant knew the identity belonged to a real person. Knowledge is the contested element in nearly every one of these cases, and the government’s evidence of it is usually a chat log or a payment the defendant did not question.
Employers and payroll providers
The more than 70 companies that paid North Korean workers are victims in the indictment. They also paid wages that reached sanctioned entities, carry data-exfiltration risk from the workers’ access, and are now on notice through four FBI public service announcements since 2024. A company that discovers a North Korean worker on its payroll faces decisions about disclosure to OFAC, preservation of the worker’s devices, and cooperation with the FBI, each of which carries its own risk.
Hosting providers, registrars, and payment processors
The Brooklyn operation relied on cooperation from U.S. and foreign hosts. The Media Land bulletproof hosting indictment in July 2026 charged a host as a co-conspirator. The line between a cooperating witness and a defendant is drawn by what the provider knew and when, and by how it responded to abuse reports and law enforcement requests before the warrant arrived.
Victims
The Brooklyn scheme re-contacted its own victims with a fake recovery service. Victims of these schemes who paid a recovery fee may face questions about whether they were victims or participants in a second fraud. Victims with documented losses can petition for remission from forfeited funds, and the remission process has its own deadlines and proof requirements.
Foreign nationals
A person outside the United States whose assets are seized here can file a claim and litigate. Doing so brings the fugitive disentitlement statute, 28 U.S.C. § 2466, into play if that person is also charged and declines to appear. Whether a foreign national who never entered the United States can be disentitled is an open and actively litigated question.
Where the Defense Begins: Tracing, Taint, Attribution, and Ephemeral Messages
A seizure warrant affidavit in a crypto case rests on four pillars: a tracing analysis, a theory of why the traced property is forfeitable, an attribution of a wallet or account to a named person, and communications recovered from devices and accounts. Each can be tested. The government’s case is usually strongest on the first and weakest on the third.
Tracing
Blockchain tracing is performed with commercial software that applies heuristics to public ledger data. Common-input-ownership clustering assumes that addresses spent together in one transaction share an owner. Change-address detection guesses which output went back to the sender. Behavioral clustering groups addresses by timing and amount. Each heuristic yields a probability. None becomes evidence until an analyst testifies to it, and the analyst’s methodology, error rate, and training data are discoverable.
The trace weakens at predictable points. Funds that enter an exchange’s omnibus hot wallet lose their on-chain identity and can be followed only through the exchange’s internal ledger, which the government must subpoena. Funds that cross a bridge, pass through a mixer, or move through a decentralized exchange require assumptions about which output corresponds to which input. For commingled funds the government must choose an accounting convention, and the choice among first-in-first-out, pro rata, and lowest intermediate balance can decide whether a particular withdrawal is proceeds at all. 18 U.S.C. § 984 relieves the government of tracing specific fungible funds in a financial institution account, but only in an action brought within one year of the offense. Whether a crypto exchange account qualifies is contested. Outside that window the government must trace.
Tainted asset analysis
Not every dollar in a flagged account is forfeitable. Proceeds under § 981(a)(1)(C) are limited to property obtained through the offense. Property “involved in” money laundering under § 981(a)(1)(A) can reach clean funds commingled with tainted ones, but courts generally require a showing that the clean funds facilitated the laundering rather than sat beside it. Funds that entered an account before the offense began, or that came from an independent source, fall outside both theories.
In a criminal case the analysis matters at two points. Before trial, Kaley forecloses a challenge to the grand jury’s finding that a crime occurred, but it leaves open a hearing on whether the restrained property is traceable to that crime, and several circuits grant one when the restraint affects the defendant’s ability to retain counsel. Luis adds that untainted assets needed for counsel cannot be restrained at all. After conviction, Honeycutt limits forfeiture to property the defendant personally obtained. In a multi-defendant scheme the government must show what reached this defendant, as opposed to the group.
Attribution to a specific person
A wallet address proves nothing about who controls it. The government attributes through exchange KYC files, IP and device logs, seized hardware, and cooperating witnesses. Each has a weakness. The North Korea indictment itself alleges that more than 25 stolen identities were used to open accounts, which means a KYC record in a defendant’s name establishes only that someone used that name. An IP address at a laptop farm points to the facilitator’s router. A seized phone may have been shared. A cooperator who attributes a Telegram handle to a defendant has usually pleaded guilty already and is seeking a reduced sentence under U.S.S.G. § 5K1.1.
Conspiracy charges raise the bar. Money laundering conspiracy under § 1956(h) requires proof that the defendant agreed to launder and knew the funds were criminal proceeds. Wire fraud conspiracy under 18 U.S.C. § 1349 requires proof that the defendant joined the scheme with intent to defraud. A facilitator who was told a plausible story, or a counterparty who processed a transaction at market rates, has a defense that turns on what the government can prove about that person’s knowledge. The knowledge evidence is almost always a message.
Search warrants for ephemeral messages
Signal, Telegram, WhatsApp, and Snapchat offer disappearing messages, and the operators in these cases use them. Investigators obtain the messages anyway: from the other participant’s device, from a cooperator’s screenshots, from cloud backups that preserve what the app deleted, and from the defendant’s own phone under a Rule 41 warrant. Riley v. California, 573 U.S. 373 (2014), requires a warrant to search a phone’s contents. Content held by a provider requires a warrant under 18 U.S.C. § 2703.
The warrant is where the defense works. The Fourth Amendment requires particularity, and a warrant authorizing a search of every message on a device for a scheme alleged to span six years invites a challenge to its scope and to any evidence found outside the dates and subjects it named. A message captured from a cooperator’s phone raises authentication and completeness questions under Federal Rules of Evidence 901 and 106, because one side of a disappearing conversation is routinely all that survives. The government, for its part, treats deletion after notice of an investigation as obstruction under 18 U.S.C. § 1519, so the timing of any deletion becomes its own contested fact.
The firm handles these issues through its crypto freeze, seizure, and forfeiture defense practice and its crypto fraud and money laundering practice.
Defending Asset Freezes, Seizures, and Crypto Fraud Investigations
Armstrong & Bradylyons PLLC defends individuals and companies in cryptocurrency fraud investigations, money laundering prosecutions, and the civil and criminal forfeiture proceedings that run alongside them. The firm’s partners built and supervised these cases at the Justice Department before they began defending them.
Scott Armstrong served as an Assistant Chief in the Market Integrity and Major Frauds Unit of DOJ’s Fraud Section, where he supervised the Section’s investment and crypto fraud trials nationwide. He was lead trial counsel in the first cryptocurrency market manipulation case charged under Title 15, involving more than $300 million in spoof and wash trades, and tried a $650 million Ponzi scheme to verdict in the District of Colorado. He has tried sixteen federal jury trials. In private practice he negotiated the complete dismissal of a federal receiver’s clawback demand exceeding $1 million by identifying errors in the receiver’s tracing.
Drew Bradylyons served as Chief of the Financial Crimes and Public Corruption Unit at the U.S. Attorney’s Office for the Eastern District of Virginia and spent roughly eight of his twelve years as a federal prosecutor at DOJ’s Fraud Section. His unit charged crypto investment fraud, Ponzi schemes, and precious metals schemes, and he supervised cryptocurrency Ponzi prosecutions involving hundreds of millions of dollars in losses. He routinely ran parallel criminal, civil, and administrative tracks with the SEC and CFTC.
The firm is based in Washington, D.C. and handles matters in every federal district. Its attorneys have tried 25 federal jury trials. Representative matters in this area include representing clients in exploit, hack, and fraud matters involving more than $40 million in crypto assets; representing an international cryptocurrency exchange in connection with a DOJ and FBI seizure of its domain name; representing an international cryptocurrency exchange against a law enforcement freeze of approximately $2.5 million in stablecoins; and representing a foreign national against a federal indictment charging conspiracy to commit wire fraud and conspiracy to commit money laundering for allegedly orchestrating a $260 million “social engineering” crypto heist. The firm’s crypto freeze, seizure, and forfeiture defense practice covers exchange account freezes, seizure warrants, civil forfeiture claims, criminal forfeiture and ancillary proceedings, remission petitions, and the grand jury investigations that produce them.
Frequently Asked Questions
What is the difference between a cryptocurrency asset freeze and a seizure?
A freeze is a restriction the exchange places on an account. It happens under the exchange’s terms of service, usually at the request of law enforcement or after an internal compliance flag, and no court is involved. The funds stay in the account but cannot be moved. A seizure is a transfer of the assets to government custody under a warrant issued on probable cause. Under 18 U.S.C. § 981(b), a seizure warrant follows the procedures for a search warrant under Rule 41 and may be executed wherever the property is found. A freeze can last for weeks before a warrant issues. Once the warrant is executed, the exchange sends the crypto to a government wallet and the forfeiture clock under 18 U.S.C. § 983 begins.
Can the government seize cryptocurrency on an exchange without charging anyone with a crime?
Yes. Civil forfeiture is an action against the property, and no criminal charge is required. The government seizes the asset on a warrant, sends notice to interested parties, and either forfeits the property administratively if no one files a claim or files a civil complaint in federal court if someone does. The July 2026 complaints by the Scam Center Strike Force seeking more than $25 million from five crypto scam investigations, and the roughly $300,000 seized in the Brooklyn case with no arrests announced, are both examples. The government must still prove in a contested case, by a preponderance of the evidence, that the property is proceeds of or was involved in a crime. A claimant does not need to be a defendant to contest the seizure. The claimant needs an ownership interest and a timely claim.
How long does the government have to bring a forfeiture case after seizing crypto?
The Civil Asset Forfeiture Reform Act at 18 U.S.C. § 983 sets the deadlines. In an administrative forfeiture, the seizing agency must send written notice to known interested parties within 60 days of the seizure, or 90 days if a state or local agency made the seizure and turned the property over. The claimant’s deadline to file a claim is stated in the notice and cannot be earlier than 35 days after the notice is mailed. Once a claim is filed, the government has 90 days to file a judicial forfeiture complaint or obtain an indictment with a forfeiture allegation. If it does neither, it must release the property. Courts enforce these deadlines, and the government’s failure to meet them is a defense.
What is the innocent owner defense in a federal forfeiture case?
Under 18 U.S.C. § 983(d), property is not forfeitable if the claimant proves by a preponderance of the evidence that he or she is an innocent owner. For an interest that existed when the illegal conduct occurred, the owner must show no knowledge of the conduct, or that upon learning of it the owner did all that could reasonably be expected to stop the illegal use. For an interest acquired afterward, the owner must show a bona fide purchase for value without knowledge or reasonable cause to believe the property was subject to forfeiture. In crypto cases this defense turns on records: where the funds came from, what the claimant knew about the counterparty, and whether the transaction looked like any other at the time. The burden sits with the claimant.
How does the government seize a website or domain?
A domain name is property subject to forfeiture when it is used to commit or facilitate a crime. Agents obtain a seizure warrant and serve it on the registrar or the registry that controls the top-level domain. The registry redirects the domain to a government server that displays a seizure notice. Registries for the most common domains are U.S. companies, which brings foreign-registered sites within reach of a U.S. warrant. Servers are seized or imaged under a search warrant, and the data on them becomes evidence. Where the host is abroad, the request moves through a mutual legal assistance treaty or direct cooperation. The Brooklyn District Attorney’s October 2026 action took 241 domains and 112 servers in one coordinated operation, with servers located in both the United States and Eastern Europe.
What is a North Korean laptop farm and why are U.S. residents charged?
A laptop farm is a U.S. residence where a facilitator keeps company-issued laptops powered and connected so that North Korean IT workers abroad can log in remotely and appear to be working from inside the United States. The workers obtain the jobs with stolen or fabricated identities. The facilitator installs remote-access software, handles mail and equipment, and often moves the wages onward. DOJ’s October 13, 2026 announcement described searches of more than 40 Texas residences and the seizure of 187 devices. U.S. facilitators are charged because they are the reachable participants. The charges are typically wire fraud conspiracy, money laundering conspiracy, and identity theft, with aggravated identity theft under 18 U.S.C. § 1028A adding a mandatory two-year consecutive sentence. The revenue is alleged to reach sanctioned entities, which adds sanctions exposure for anyone who handled the money.
What is the Scam Center Strike Force?
The Scam Center Strike Force was launched in November 2025 by the U.S. Attorney’s Office for the District of Columbia to target cryptocurrency investment fraud, cyber-enabled fraud, human trafficking, and money laundering tied to scam compounds, originally in Southeast Asia. It works with the FBI, Secret Service, DOJ’s Criminal Division, the Postal Inspection Service, IRS Criminal Investigation, HSI, and several U.S. Attorney’s Offices. It has reported more than $800 million in assets recovered since its launch, including about $52 million restrained in the September 2026 Xinbi Guarantee action. In October 2026 it joined Joint Disruption Week, the first coordinated operation focused on West African scam centers. Its cases tend to lead with forfeiture complaints and seizure warrants, often filed before any individual is charged.
What is Executive Order 14390 and how does it affect crypto fraud enforcement?
Executive Order 14390, signed March 6, 2026, directs federal agencies to build a coordinated response to cyber-enabled fraud by foreign transnational criminal organizations. It orders the Attorney General to continue prioritizing prosecutions of cyber-enabled fraud, including scam centers, and to pursue the most serious provable offenses. It creates an operational cell within the Homeland Security Task Force’s National Coordination Center to coordinate disruption efforts with the private sector. It also directed a recommendation on a Victims Restoration Program that would return clawed back, forfeited, or seized funds to victims. DOJ cited the order in both of its October 13, 2026 announcements. In practice the order has meant more seizure-first enforcement, more private-sector involvement in identifying freezable funds, and more cases built around domestic enablers of foreign schemes.
Can a person outside the United States contest a U.S. forfeiture of their cryptocurrency?
Yes. Any person with an ownership interest can file a claim in a civil forfeiture case and litigate it, regardless of nationality or location. The risk comes from 28 U.S.C. § 2466, the fugitive disentitlement statute. If the claimant is also charged criminally and avoids the jurisdiction to evade prosecution, the court may bar the claim. Whether that applies to a foreign national who never entered the United States and never fled it is actively litigated, and courts have reached different results depending on the claimant’s conduct. The Chen Zhi case, with roughly $15 billion in bitcoin under a civil forfeiture complaint while the defendant remains abroad, is the largest current test of that question.
What happens to seized cryptocurrency and how do victims recover it?
Seized crypto is held by the U.S. Marshals Service until a forfeiture order is entered. Forfeited assets go to the Assets Forfeiture Fund. Victims can recover through two channels. Restitution is ordered by the court at sentencing in a criminal case. Remission is an administrative petition to the Justice Department under 28 C.F.R. Part 9, available in both civil and criminal forfeitures, in which the victim documents a pecuniary loss directly caused by the offense. Remission petitions have deadlines and proof requirements, and recovery is pro rata when losses exceed the forfeited amount. The firm’s analysis of the OneCoin remission process describes how a large crypto remission works in practice.
What happens when DOJ seizes a cryptocurrency exchange’s domain name?
The exchange usually learns of the seizure when its site begins displaying a government banner. A seizure warrant under 18 U.S.C. § 981(b) is served on the registrar or registry, and the domain is redirected without advance notice to the owner. Customers cannot reach the platform. The exchange’s servers, wallets, and customer funds may be untouched, or may be the subject of separate warrants served the same day. Two legal paths exist. If no forfeiture action is pending, the exchange can move for return of the property under Rule 41(g). Once the government initiates forfeiture, the exchange files a claim, which forces the government to prove the domain was used to commit or facilitate an offense and opens the door to an innocent owner defense. In parallel, the exchange’s dialogue with the prosecuting office about customer access, data preservation, and the scope of the government’s theory often determines more than any motion. Armstrong & Bradylyons has represented an international cryptocurrency exchange in connection with a DOJ and FBI seizure of its domain name.
Can a cryptocurrency exchange contest a law enforcement freeze of customer stablecoins?
Yes. The first question is what the freeze actually is. A letter from an agency asking an exchange to hold funds has no legal force of its own. The exchange decides whether to comply under its terms of service, weighing the request against its contractual obligations to the customer and its exposure if the funds move. A seizure warrant is different and must be honored. Stablecoins add a third layer, because the issuers of USDT and USDC can freeze tokens at the smart contract level on a law enforcement request, independent of any exchange. An exchange holding customer assets can insist on a warrant, negotiate the scope and duration of any hold, seek release pending trial under 18 U.S.C. § 983(f), and file a claim as custodian, provided it identifies the customers on whose behalf it holds the assets as Supplemental Rule G requires. The firm has represented an international cryptocurrency exchange against a law enforcement freeze of approximately $2.5 million in stablecoins.
How is a “social engineering” crypto heist charged, and what defenses does a foreign national have?
A social engineering heist, in which a victim is manipulated into surrendering credentials or approving a transfer, is charged as wire fraud conspiracy under 18 U.S.C. § 1349 and money laundering conspiracy under 18 U.S.C. § 1956(h), with forfeiture allegations covering the stolen assets. The government rarely holds the defendant’s wallet keys. It attributes through handles on Discord and Telegram, exchange KYC files, device seizures, and cooperating participants who have already pleaded guilty. For a foreign national the case also involves extradition or negotiated surrender, venue in a district the defendant may never have entered, and fugitive disentitlement under 28 U.S.C. § 2466 if seized assets are contested from abroad. The defenses track the proof: whether the attribution holds, whether the defendant joined the agreement with the knowledge the statutes require, and whether forfeiture reaches only what this defendant obtained under Honeycutt. The firm has represented a foreign national against a federal indictment charging conspiracy to commit wire fraud and conspiracy to commit money laundering for allegedly orchestrating a $260 million social engineering crypto heist.
What defenses exist when crypto assets are traced to a hack or exploit?
Assets taken in a hack or exploit move within hours through bridges, decentralized exchanges, and mixers, and they reach wallets whose owners had nothing to do with the theft. A market maker, a liquidity provider, or a buyer who paid full value on an open market can end up holding tokens the government later labels proceeds. The defenses turn on tracing and taint. The claimant tests where the trace enters commingled liquidity, whether the government’s accounting convention supports calling these specific assets proceeds, and whether the claimant qualifies as an innocent owner under 18 U.S.C. § 983(d) by showing a bona fide purchase for value without knowledge or reasonable cause to believe the assets were subject to forfeiture. Where the victim protocol or exchange has obtained a civil freeze or a receiver, the same tracing contest runs in parallel in the civil case. The firm has represented clients in exploit, hack, and fraud matters involving more than $40 million in crypto assets.
What experience does Armstrong & Bradylyons PLLC bring to asset freeze and crypto forfeiture matters?
Scott Armstrong served as an Assistant Chief in the Market Integrity and Major Frauds Unit at DOJ’s Fraud Section, where he supervised investment and crypto fraud cases nationwide and was lead trial counsel in the first cryptocurrency market manipulation case charged under Title 15. He has tried sixteen federal jury trials, including a $650 million Ponzi scheme. Drew Bradylyons served as Chief of the Financial Crimes and Public Corruption Unit at the U.S. Attorney’s Office for the Eastern District of Virginia and supervised cryptocurrency Ponzi prosecutions involving hundreds of millions of dollars in losses.
In private practice the firm has represented clients in exploit, hack, and fraud matters involving more than $40 million in crypto assets; an international cryptocurrency exchange in connection with a DOJ and FBI seizure of its domain name; an international exchange against a law enforcement freeze of approximately $2.5 million in stablecoins; and a foreign national indicted for allegedly orchestrating a $260 million social engineering crypto heist. The firm is based in Washington, D.C., its attorneys have tried 25 federal jury trials, and it represents account holders, exchanges, facilitators, companies, and foreign nationals in every federal district through its crypto freeze, seizure, and forfeiture defense practice.
Facing a Crypto Asset Freeze, Seizure Warrant, or Forfeiture Action?
Armstrong & Bradylyons PLLC defends account holders, exchanges, facilitators, companies, and foreign nationals in federal crypto fraud investigations, asset freezes, seizure proceedings, and civil and criminal forfeiture actions nationwide. As former DOJ prosecutors, Scott Armstrong and Drew Bradylyons built and supervised the crypto fraud and forfeiture cases the government brings today.
