U.S. seizes $61M in crypto as authorities uncover new fraud network
U.S. authorities have seized millions of dollars in cryptocurrency stolen through investment scams. Investigators traced the movement of funds across dozens of wallets and multiple blockchains.
13.03.2026
117
9 min
0
The U.S. Department of Justice has confiscated approximately $61 million in cryptocurrency linked to fraudulent investment schemes. These operations are commonly known as “pig butchering” scams, one of the fastest-growing forms of crypto fraud.
In such schemes, scammers build long-term relationships with victims before directing them to fake cryptocurrency trading platforms, gradually convincing them to transfer increasingly large amounts of money.
Blockchain analysis allowed investigators to track the flow of the stolen assets.
Despite attempts to obscure the origin of the funds by moving them across numerous wallets and multiple blockchains, investigators were able to reconstruct the transaction trail and identify wallets where victims’ funds ultimately accumulated.
GetBlock AML Research has revealed details about the investigation and the process used to seize the digital assets for the U.S. government.
Early Reporting Increases the Chances of Recovering Funds. The sooner victims report a fraud incident, the greater the chances that investigators can trace transfers and freeze stolen funds.
How to recover stolen crypto assets: the only successful strategy
When dealing with scammers, it is important to act quickly and judiciously: gather all available information, contact your service provider, and the police
U.S. Authorities Confiscate $61M in USDT
Last week, the U.S. Attorney’s Office for the Eastern District of North Carolina announced the seizure of more than $61 million in USDT, which was linked to investment scams known as pig-butchering schemes.
The investigation was conducted by Homeland Security Investigations (HSI) in Raleigh with support from international HSI offices. The case highlights how advanced blockchain analytics and digital asset seizure techniques have become in major crypto-fraud investigations.
According to court documents, the seized funds were located in cryptocurrency addresses used to launder money obtained from victims of investment scams.
The investigation began after one of the victims filed a report through a federal crime reporting hotline.
During the investigation, agents identified cryptocurrency wallets where funds from multiple victims had been pooled together. These wallets ultimately became the target of the seizure order.
How Pig-Butchering Scams Work
Pig-butchering schemes are highly organized fraud operations designed to extract as much money as possible from victims over time.
Scammers typically start by building trust with their targets. They may pose as romantic partners, friends, or business contacts.
Once trust is established, the victim is presented with what appears to be a profitable cryptocurrency investment opportunity. Fraudsters often claim to have access to exclusive trading strategies or insider market information.
Victims are then directed to fake crypto trading platforms that closely resemble legitimate exchanges. These platforms mimic the interface, design, and functionality of real services.
The platform may display fake profits and rising balances, creating the illusion that the investments are successful.
In some cases, victims are even allowed to withdraw a small amount of money to reinforce the illusion of legitimacy. But once the victim starts transferring larger sums, new requirements appear—such as paying “taxes,” “compliance fees,” or “liquidity verification deposits.”
By that stage, the funds have already been transferred to wallets controlled by scammers, making recovery through the fake platform impossible.
How your cryptocurrency will be stolen: top 5 popular schemes
Scammers use a set of ready-made schemes to deceive unsuspecting cryptocurrency owners and obtain their assets
These operations function much like a business. Some groups focus on communicating with victims, others build and maintain fraudulent websites, while additional teams handle money transfers and laundering.
The goal is not a one-time fraud, but a scalable system for extracting funds from victims.
How Investigators Tracked the Money
After victims sent funds to the scammers’ wallets, the money was quickly moved across numerous intermediary addresses.
This strategy is intended to obscure the transaction trail and hide the origin of the funds.
In this case, investigators discovered that funds from different victims were merged into the same wallets, even when transfers originated from different countries and across multiple blockchains.
HSI agents and analysts were able to track the funds through a chain of wallet-to-wallet transfers.
They identified transaction patterns consistent with an organized money-laundering operation. Even when funds were mixed with other balances, blockchain analysis allowed investigators to group related addresses based on behavioral patterns and shared control.
By analyzing transaction timing, transfer patterns, and network structures, investigators identified consolidation wallets where significant sums eventually accumulated.
Networkofaddressesusedtostoreandlaunderstolencryptocurrency. Visualization: TRMLabs
Despite attempts to conceal the activity, the public nature of blockchain technology means every transaction is permanently recorded.
Investigators were able to reconstruct the full path of the funds—from the victim’s first transfer to the wallets where large balances remained. These wallets ultimately became the legal basis for the seizure.
The investigation also involved tracking transactions across multiple blockchains and through services often used to obscure activity, including crypto swaps and cross-chain transfers.
The ability to correlate data across different blockchains proved critical in identifying points where funds converged.
The Role of Cooperation Between Authorities and Crypto Companies
The Department of Justice and HSI acknowledged assistance from the issuer of USDT, which helped facilitate the transfer of the seized assets.
Cooperation with digital asset companies often plays a key role in such investigations, particularly when funds are located on platforms where they can technically be frozen or recovered.
Cases like this also highlight the importance of rapid response.
Pig-butchering operations are specifically designed to move funds quickly—sometimes within 24 to 48 hours after receiving them.
If victims report fraud promptly and provide wallet addresses and transaction data, the chances of tracing and freezing stolen funds increase significantly.
The Scale of Crypto Fraud
The $61 million seizure comes amid a global rise in cryptocurrency-related scams.
Industry estimates suggest that around $35 billion was sent to fraudulent schemes in 2025 alone, with a significant portion tied to pig-butchering operations.
What to do If someone messages you about crypto: a practical checklist
Scammers often use a deceptive tactic: they let victims withdraw a small initial profit. After that, walking away becomes much harder.
Although the infrastructure behind these scams is global, the consequences are deeply personal.
Victims often lose retirement savings, business funds, and money accumulated over decades. The psychological damage can also be severe, as scammers spend long periods building trust and emotional connections with their targets.
Why This Operation Matters
The North Carolina seizure highlights several key points.
- First, blockchain transparency remains a major advantage for investigators. While criminals can attempt to obscure transactions, they cannot erase the permanent record of transfers on public ledgers.
- Second, advanced transaction analytics can reveal critical wallets even within complex laundering networks.
- Third, fund recovery is possible if investigations move quickly enough to keep pace with the movement of funds.
The seizure of more than $61 million in USDT was the result of a combined effort involving victim reports, blockchain analytics, law enforcement action, and cooperation from the crypto industry.
The case reinforces an important principle in modern financial crime investigations: even in a world of rapid digital transactions, illicit activity still leaves a trail.
As crypto fraud continues to evolve, investigations like this demonstrate that with the right tools and coordination, authorities can trace illicit funds, seize criminal proceeds, and work toward returning assets to victims.
Useful material?
Research
The blockchain has helped uncover the ties between cryptocurrency fundraising campaigns, exchangers in Syria, and intermediaries in several countries around the world. A telltale pattern has emerged in which the same addresses were used across multiple donation drives at once
Jun 24, 2026
Research
Four Iranian cryptocurrency exchanges accounted for roughly 78% of all digital asset volume tied to the country in 2025. They have now become the focal point of the largest U.S. sanctions campaign against Iran's cryptocurrency infrastructure.
Jun 5, 2026
Research
A financial system is already up and running on public blockchains, with loans, analogues of U.S. Treasuries, and automated capital markets. More than $551 billion has flowed through DeFi protocols — but most of that activity has nothing to do with the real economy and everything to do with the speculative build-up of risk.
May 29, 2026
Research
Around 97% of Chinese suppliers of chemicals used to make fentanyl accept payment in cryptocurrency. The volume of such transactions continues to grow alongside the global market for synthetic drugs
May 22, 2026
Research
For the first time, the new law makes blockchain analytics an officially mandatory tool of financial oversight in the United States. Authorities will also gain the power to restrict transactions with foreign crypto services tied to money-laundering risks.
May 20, 2026
Research
Working with cryptocurrencies requires more than just new technology — it demands a complete overhaul of internal processes. We explain how the financial sector is learning to control digital assets and detect threats
May 8, 2026
Telegram
Twitter