Connect with us

Crypto

Questions swirl around US plans for record $15B Prince Group crypto seizure – ICIJ

Published

on

Questions swirl around US plans for record B Prince Group crypto seizure – ICIJ

The U.S. Justice Department last October announced the largest asset seizure in American history: a cache of bitcoin then valued at $15 billion tied to the Cambodia-based Prince Group that prosecutors alleged oversaw an empire of human trafficking and industrial-scale scamming.

The news offered a rare glimmer of hope for victims of sophisticated cryptocurrency scams. In part due to the ease of laundering cryptocurrencies, these victims have had a notoriously difficult time recovering their lost life savings or even getting law enforcement to begin tracing such funds.

“By dismantling a criminal empire built on forced labor and deception, we are sending a clear message that the United States will use every tool at its disposal to defend victims, recover stolen assets, and bring to justice those who exploit the vulnerable for profit,” U.S. Attorney General Pam Bondi said in a joint statement.

But in the five months since the announcement, questions and frustrations have begun to swirl around the Justice Department’s handling of the historic cache of seized funds. The Justice Department has given little indication of what it plans to do with the 127,271 seized bitcoins, currently worth around $9 billion, as it has swiftly rejected claims on the funds made by attorneys representing hundreds of alleged victims.

Daniel Thornburgh and other attorneys representing hundreds of alleged victims of crypto scams say the government is not providing a viable path for returning seized funds to rightful owners.

Advertisement

Victims’ advocates and attorneys fear the agency may use the funds to capitalize President Trump’s national Strategic Bitcoin Reserve, a government crypto stockpile advocated by the cryptocurrency industry.

“This would lead to victims being revictimized by their own government,” said Thornburgh.

He is part of a growing number of attorneys and victim advocates who are calling for a special victim fund to take over responsibility for the historic sum of seized assets. They argue that this alternative offers a clearer path to victims receiving restitution.

The Department of Justice declined to comment on the case.

In November, the International Consortium of Investigative Journalists and 36 partner publications released The Coin Laundry investigation that showed how cryptocurrency scam victims face immense difficulty recovering funds due to the rapidly expanding illicit crypto economy. In interviews, dozens of victims told ICIJ and its media partners that they faced financial ruin as criminals rapidly laundered their stolen funds through secretive crypto wallets. In many cases, reports to law enforcement yielded no response at all.

Advertisement

The U.S. seizure of billions in bitcoin from the Prince Group’s founder Chen Zhi stemmed from allegations that he operated a transnational criminal organization that used forced labor in scam compounds to defraud victims worldwide. After the group was hit with U.S. and U.K. sanctions, Chen was taken into custody in Cambodia and sent to China in January 2026.

Even as victim attorneys strategize how to get their clients’ money back, fundamental questions hang over the case, including how and when U.S. authorities obtained the funds in the first place. Attorneys say that more information could help victims make stronger claims on the assets, while the Prince Group argues the lack of detail points to a flimsy case for the government holding the crypto at all. Although the Justice Department declined to comment on how it obtained the Bitcoin, the Chinese government recently accused the U.S. of stealing it through sophisticated hacking.

The government’s indictment of Chen contains apparent irregularities that are especially striking given the case’s significance. Prosecutors’ evidence against Chen relied in part on photographs alleged to illustrate the Prince Group’s violent methods.

ICIJ confirmed that one disturbing photo included in the indictment showing a man bound to an overturned chair appears to have nothing to do with the Prince Group. The exact photo was part of a light-hearted post published on a Mongolian-language website in April of 2020, describing an unusual medical incident. In another case, a man portrayed in the indictment as a victim of the Prince Group told ICIJ in an interview he had never been the victim of organized crime.

Victim claims have been swiftly rejected

When government authorities seize assets, they can keep those assets for public sector use, distribute the assets to victims who lost money to the crime in question, or do a combination of both. The process of determining if and how assets should be returned to victims is complicated and can take years.

Advertisement

In the wake of the Prince Group seizure, one U.S. senator said the assets could be used in part to strengthen Donald Trump’s national strategic bitcoin reserve, a U.S. government stockpile of cryptocurrency that industry proponents say will help boost the prominence of bitcoin. At the same time an array of alleged scam victims and their lawyers flooded the Justice Department with claims on the seized assets.

The department rapidly rejected many of them, asserting a wide variety of reasons why the victims had no legitimate claims, including that victims had not put forth specific evidence linking their cases to the seized funds and that they had no legal basis to credibly claim the funds in the first place.

Victims and their attorneys told ICIJ that a troubling picture is emerging of a Justice Department that appears set on rejecting claims.

Without more information about the seizure, scam victims are at a disadvantage because the alleged laundering was highly complex, making it difficult to directly link any specific scam to the cache of digital currency, according to lawyers.

“What’s happening here is not normal at all,” said Marc Fitapelli, a New York-based attorney who represents victims of cryptocurrency scams. “There should be an independent person appointed by the court to have control over these assets.”

Advertisement
The Phnom Penh headquarters of Prince Holding Group in Cambodia, with the Prince Group logo missing from the building’s facade. Image: Patrick Chengzhi Wang/SOPA Images/LightRocket via Getty Images

Thornburgh told ICIJ that recent conversations with Justice Department lawyers convinced him that the government was committed to denying victim claims, so he booked a trip to Cambodia on a long-shot mission to collect additional evidence linking his cases to the Prince Group. Thornburg said he spent a grueling week in early March interviewing dozens of former workers at the country’s notorious scam compounds, but had little luck finding the documentation to connect his client’s cases to the DOJ’s seized funds.

“It was an incredible amount of work to demonstrate what I probably already knew, which was: this was going to be impossible,” Thornburgh said. “Even if I was successful, victims or their lawyers should not have to travel all the way across the world to recover their assets.”

Thornburgh expressed concern about the Justice Department’s tactics in a separate high-profile crypto forfeiture action announced in June. Last month, government attorneys argued that victims did not deserve to recover funds from this seizure because the victims had freely given it away to scammers. “Although their voluntary transfers may have been induced through misrepresentations, those transfers were made voluntarily nonetheless,” the Justice Department said in a filing.

Several experts pointed to legislation as the most promising path to recovering victim funds. Erin West, the founder of Operation Shamrock, an advocacy group for victims of cyber scams, told ICIJ the organization would be working with partners to push for legislation that allocates the seized funds to victims. “We have an amazing opportunity to put found assets back into the hands of those who deserve it most,” West said.

Fitapelli said that a call with Justice Department lawyers last month yielded little in direct answers. “I was told that victims will be contacted by the government if/when the DOJ determines it is appropriate,” he said. “So victims should hope that some lawyer at the Justice department stumbles on their file and contacts them? This is so unfair.”

Advertisement

Deeper questions about the money

Scam victims aren’t the only ones seeking more information from the Justice Department about the case.

Almost immediately after the government’s announcement of the historic seizure, cryptocurrency experts began to ask basic questions about the origin of the enormous pile of bitcoin. According to the U.S. officials, the Prince Group’s alleged laundering methods diverted proceeds of fraud to fund a bitcoin mining company called LuBian that created new, “clean” bitcoins. Attorneys representing thousands of alleged victims of Iranian terrorism say that this bitcoin mining operation had extensive ties to Iran and are also making claims on the seized bitcoin.

But there is a twist in the history of these coins: On the blockchain, the publicly available ledger of most cryptocurrency transactions, experts could see that the huge sum of seized bitcoin, which was reportedly stolen by an unknown hacker in 2020 and then sat dormant in crypto wallets of unknown ownership for years. This crypto remained untouched between late 2020 and mid-2024, when the cache of bitcoin moved to a new set of wallets where it has remained since, crypto analyst Yury Serov told ICIJ.






The U.S. government filings that ICIJ reviewed do not provide details on how it came into possession of the bitcoin. This lack of an official explanation has created an opening for speculation among experts, interested parties and a rival superpower. A Chinese cybercrimes agency recently suggested that the U.S. government originally stole the bitcoin through sophisticated hacking in 2020.

Advertisement

Last week, lawyers representing Chen demanded that the Justice Department explain how it seized the funds.

The Justice Department’s asset forfeiture filing, which describes the government’s rationale for taking the $15 billion, has also created some confusion about which victims may be entitled to the funds.

After the government announced its seizure in 2025, analysts quickly pointed out that the $15 billion in bitcoin had sat dormant in crypto wallets for years after their reported theft in 2020. Chen’s defense attorneys have argued these dormant assets have had no opportunity to commingle with any money taken from scam victims after 2020. But, in its asset forfeiture filing, some of the government’s most specific descriptions of the Prince Group’s alleged scams involve frauds that took place in 2021 and 2022 — after the seized bitcoin went dormant.

Attorneys for Chen last week criticized the asset forfeiture complaint’s use of these alleged crimes to justify seizing money that had been out of circulation since 2020.

The Prince Group argues that the U.S. government somehow took the coins and then created a story to justify keeping them. “This indictment is simply air cover for a giant cash grab — one that both does a disservice to the victims of these crypto scams and injustice to an innocent man,” a spokesperson for the Prince Group told ICIJ in a statement.

Advertisement

“Prosecutors used exaggerations, deceit, and outright impossibilities to convince a court to retroactively approve their theft of Bitcoin and to convince a grand jury of everyday Americans to indict an innocent man, Chen Zhi,” the spokesperson said. “Not only did prosecutors use salacious rumors and innuendo to make wild accusations completely unconnected to Chen, they made serious errors, generated falsehoods out of whole cloth, and acted with egregious negligence all in an effort to justify their desperate, unfounded allegations.”

In court filings last week, Prince Group lawyers highlighted another possibly problematic part of U.S. authorities’ case against Chen. Several photos that the indictment claimed as evidence of wrongdoing appear to have no ostensible relationship to the Prince Group or its alleged crimes.

One of these photos, offered up by U.S. prosecutors as an example of the Prince Group’s violence, shows a man bound to an overturned plastic lawnchair. But ICIJ was able to confirm that the same photo was featured on a Mongolian-language website six years ago in a post about a man whose testicles became stuck in a lawn chair and had to be extricated from the chair by medical workers. This article contains no mention of the Prince Group or any wrongdoing.

Side-by-side screenshots showing identical photos of a man attached to a lawn chair in a hospital bed, one from the US prosecutor's indictment, the other from a Mongolian website.
Left, a photo included in the U.S. indictment against Chen Zhi shows a man attached to a lawn chair in a hospital bed; Right, the same image was published in an unrelated article on a Mongolian-language website in 2020.

Another photo in the indictment shows a purported victim of the Prince Group with blood flowing from a head wound. However, on a Zoom call arranged by representatives for the Prince Group, the man, who requested anonymity, told ICIJ that the photo depicted injuries he sustained in a drunken fight in 2015, and that he has never been the victim of violence by an organized crime group.

Hany Farid, a visual forensics expert at the University of California at Berkeley, confirmed that the man ICIJ spoke with via Zoom is the same person pictured in the indictment.

The Department of Justice declined to comment on the photographs.

Advertisement
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Crypto

Scattered Spider hacker pleads guilty to stealing $8 million in cryptocurrency – Help Net Security

Published

on

Scattered Spider hacker pleads guilty to stealing  million in cryptocurrency – Help Net Security

A British national tied to the Scattered Spider cybercrime group pleaded guilty to hacking multiple companies via SMS phishing and stealing over $8 million in virtual currency from US victims.

Tyler Robert Buchanan, 24, of Dundee, Scotland, pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft.

In November 2024, US authorities unsealed criminal charges against Buchanan and four other alleged members of the Scattered Spider group, accusing them of using phishing text messages to steal employee credentials, breach company systems and steal cryptocurrency.

According to court documents, Buchanan and his co-conspirators conducted cyber intrusions and virtual currency thefts between September 2021 and April 2023.

Advertisement

The victims included interactive entertainment, telecommunications and technology companies, as well as business process outsourcing (BPO) and IT service providers, cloud communications firms, virtual currency companies and individual victims.

“As part of the scheme, Buchanan and his co-conspirators conducted Short Message Service (SMS) phishing attacks by sending hundreds of SMS phishing messages to the mobile telephones of a victim company’s employees. The messages purported to be from the victim company or a contracted IT or BPO supplier for the victim company,” the Justice Department said.

“The SMS phishing messages contained links to phishing websites designed to look like legitimate websites of a victim company or a contracted IT or BPO supplier. The websites then lured the recipient into providing confidential information, including personal identifying information (PII), and account usernames and passwords.”

In April 2023, police found on a digital device at Buchanan’s residence in Scotland the names and addresses of numerous victims, including a text file containing cryptocurrency seed phrases and login credentials for one account.

Buchanan has been in federal custody since April 2025 and faces up to 22 years in federal prison.

Advertisement

Co-conspirator Noah Michael Urban is serving a 10-year federal prison sentence and was ordered to pay $13 million in restitution after pleading guilty in April 2025 to fraud-related charges. Three other defendants charged alongside Buchanan, including Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo and Joel Martin Evans, still face criminal charges in the case.

Scattered Spider is a cybercrime collective, also known as UNC3944, Muddled Libra and Octo Tempest, made up largely of young, native English-speaking hackers who use social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass MFA, and compromise enterprise networks.

The group gained notoriety for its role in high-profile hacking and extortion attacks against Caesars Entertainment and MGM Resorts International, two of the largest casino operators in the US.

Although authorities have increased pressure on the group and arrested several members, including four they consider responsible for ransomware attacks targeting UK-based retailers last year, the group continues to operate, with new members replacing those arrested.

Advertisement
Continue Reading

Crypto

XRP Prepares for Quantum Future as Ripple Maps XRPL Strategy for Security Readiness

Published

on

XRP Prepares for Quantum Future as Ripple Maps XRPL Strategy for Security Readiness

Key Takeaways:

  • Ripple outlines a phased roadmap to prepare XRPL for quantum-era cryptography risks.
  • Industry momentum grows as XRPL testing highlights performance and security tradeoffs.
  • Developers at Ripple will expand testing to balance innovation with network stability.

Ripple Maps Quantum Security Strategy

Ripple’s post-quantum strategy reflects a growing shift in blockchain security as quantum computing risks gain credibility. The company’s latest Insight, published April 20 by Senior Director of Engineering Ayo Akinyele, outlined a structured roadmap to prepare the XRP Ledger for future cryptographic disruption while preserving network performance.

The Insight stated:

“Ripple is introducing a multi-phase roadmap to prepare the XRP Ledger (XRPL) for a post-quantum future, with a target for full readiness by 2028.”

It also detailed collaboration efforts: “Ripple is working with Project Eleven to accelerate development, including validator testing and early custody prototypes.”

Akinyele explained that quantum security is becoming more relevant because blockchain networks rely on cryptographic systems that could eventually be broken by sufficiently advanced quantum computers. On XRPL, each signed transaction reveals a public key on-chain, which could weaken long-term wallet security in a post-quantum environment.

He also pointed to the “harvest now, decrypt later” threat, where attackers collect cryptographic data today and wait for future quantum capabilities to exploit it. While this does not indicate an immediate failure of current protections, it increases the urgency of preparing systems that secure long-duration value. These risks reinforce the need for early testing of quantum-resistant cryptographic systems and structured migration planning.

Advertisement

XRPL Testing Targets Long-Term Stability

Ripple’s roadmap consists of four phases, starting with contingency planning for a potential failure of existing cryptographic standards. This includes a “Quantum-Day” framework designed to enable secure migration to post-quantum accounts if vulnerabilities emerge. Additional phases focus on evaluating National Institute of Standards and Technology (NIST)-recommended algorithms under real network conditions, measuring impacts on throughput, storage, and verification efficiency. XRPL’s native features, including key rotation and deterministic key generation, provide a technical advantage by enabling gradual migration without forcing users to abandon existing accounts. Parallel testing on development networks will allow developers to assess performance tradeoffs before broader implementation.

The senior director of engineering emphasized long-term execution and coordination, stating:

“We should not view addressing the quantum threat on XRPL as a single upgrade, but rather a multi-phased strategy of carefully migrating a live, global financial infrastructure without compromising the value of digital assets protected by the XRPL.”

Akinyele indicated that achieving post-quantum readiness requires balancing cryptographic innovation with operational stability, ensuring the network remains efficient while adapting to future security challenges.

Advertisement
Continue Reading

Crypto

Central Banks Say US Stablecoins Threaten Financial Integrity | PYMNTS.com

Published

on

Central Banks Say US Stablecoins Threaten Financial Integrity | PYMNTS.com

Central bank officials are warning of potential threats from the increasing use of U.S. stablecoins for international payments.

Stablecoins — crypto assets pegged to fiat currencies like the dollar — “raise serious risks for financial integrity and can facilitate regulatory circumvention,” the head of the Bank for International Settlements (BIS) said in a speech in Japan Monday (April 20).

The fast-rising use of stablecoins could also “make it easier to evade capital controls” in emerging markets (EMs) and developing countries trying to keep control on financial flows and heighten “dollarisation risks,” said BIS general manager Pablo Hernández de Cos, whose comments were reported by the Financial Times (FT).

Their increasing popularity “opens up new avenues for tax evasion,” he added, citing estimates that “stablecoins now account for most illicit transactions within the crypto ecosystem.”

According to the FT, the increased worldwide use of dollar-denominated stablecoins was mentioned as a threat to financial stability in EMs by multiple financial policymakers when they convened in Washington last week for the IMF and World Bank meetings.

Advertisement

“There will be a focus on the extent to which it moves into domestic currency substitution,” Andrew Bailey, governor of the Bank of England, said during a financial industry event in D.C.

Advertisement: Scroll to Continue

Bailey, who also chairs the Financial Stability Board, said “the rate of progress” on establishing international rules for stablecoins had slowed.

“If you had asked me a year ago, I would have said we are heading very quickly towards it. But I think it is something that we will have to come to terms with pretty soon,” he added.

Meanwhile, French Finance Minister Roland Lescure said last week that European banks should develop more euro-based stablecoins and tokenized deposits to reduce the region’s dependence on non-European payment providers.

Advertisement

Speaking at a cryptocurrency conference in Paris, Lescure said that the small volume of euro-pegged stablecoins compared to dollar-pegged tokens is “not satisfactory” and that a company formed by a group of European banks to introduce a euro-pegged stablecoin later this year is “what we need and that is what we want.”

In other stablecoin news, PYMNTS wrote last week about the implications of recent security incidents such as the North Korea-linked hack that led to losses of up to $280 million.

“The incidents underscore the fact that major stablecoin issuers retain the technical ability to halt transfers of specific tokens, or even eliminate them entirely through what’s termed as ‘burning,’ often in response to regulatory directives, security incidents or compliance concerns,” PYMNTS wrote.

“For CFOs accustomed to the predictability of bank deposits or money market funds, this can introduce a new category of risk: not market risk, but governance risk embedded in code.”

Advertisement
Continue Reading
Advertisement

Trending