As cryptocurrency moves further into the mainstream, an increasingly diverse and professional array of bad actors are following suit. Every year, criminal enterprises ranging from industrial scam compounds to global money laundering networks and state-sponsored cybercrime syndicates exploit blockchain to move billions in illicit funds. But the traceable nature of cryptocurrency means that it is uniquely recoverable compared to traditional financial instruments — with the right technology and expertise.
Chainalysis data, technology, and training have empowered law enforcement and ecosystem partners to track, freeze, and disrupt entire illicit financial networks. From supporting the largest ever USDT freeze, to dismantling global scam networks, our intelligence has been the foundation of major law enforcement actions across the world.
Beyond stopping bad actors, Chainalysis solutions create concrete financial returns, turning recovered funds into resources for future investigations at a time when cost-efficient enforcement has never been more critical. The recently announced U.S. Strategic Bitcoin Reserve echoes this shift in philosophy, creating a pathway for the U.S. government to retain its owned bitcoin as a long term financial resource instead of immediately selling it.
To date, Chainalysis has assisted our partners with the seizure and freezing of approximately $12.6 billion worth of cryptocurrency1, restoring funds to victims and providing governments with the realized ROI of blockchain investigations.
What is asset seizure and forfeiture?
The terms “seizure” and “forfeiture” are often used interchangeably, yet they refer to distinct legal actions.
Asset seizure is where authorities temporarily take control of assets suspected to be linked to criminal activities, preventing these funds or properties from being unlawfully moved or hidden while legal proceedings unfold.
Asset forfeiture, on the other hand, is where ownership is passed to the government once a court has determined that the seized assets are connected to criminal activities.
Understanding this distinction is important: seizures secure assets during investigations (temporary custody), while forfeitures (permanent ownership) finalize the process, allowing the government to dispose, re-purpose, or return the assets in question to victims.
Beyond a criminal context, private sector investigators — including lawyers, forensic accountants, and insolvency professionals — may also pursue asset recovery in civil trials. Using blockchain analytics and legal mechanisms, they can seek court ordered asset preservation, proprietary injunctions, and freezing orders to recover stolen or fraudulently acquired cryptocurrency. Legal systems across the world, such as in the UK, Canada, and Singapore, are increasingly recognizing crypto as property, enabling traditional asset recovery remedies to be applied.
Authority over asset seizures and forfeitures often varies significantly between countries. Some jurisdictions have streamlined due legal process allowing agencies to swiftly secure and liquidate seized cryptocurrency, such as the UK, which amended its Proceeds of Crime Act 2002 (POCA) to allow law enforcement to search for and seize cryptocurrency prior to an arrest, if there are reasonable grounds to suspect criminal activity.
What is asset freezing?
Asset freezing is a legal or regulatory measure that, in many jurisdictions, prevents individuals or entities from accessing or transferring specific funds due to suspected involvement in illicit activities, such as fraud, money laundering, or sanctions violations. For instance, in the United States, the Treasury Department’s Office of Foreign Asst Controls (OFAC) issues blocking orders requiring U.S. persons to block property and interests in property with specific individuals or entities (“blocked persons”), preventing their transfer and use without explicit authorization.
Similarly, law enforcement authorities in the U.S. typically apply to courts for seizure warrants, granting them custody of assets when probable cause exists. In the legacy financial system, banks and financial institutions enforce asset freezes based on court orders or regulatory directives. They can also proactively freeze customer accounts when they suspect illegal activities, fraud, or terms-of-service violations.
A crypto-specific legislative change introduced in the UK is the crypto wallet freezing order (CWFO). This new provision enables authorities to seek a CWFO against crypto wallets administrated by UK-connected crypto asset service providers (CASPs) if there are grounds to suspect that the wallet contains criminal property or property intended for use in unlawful conduct. Once granted, a CWFO prohibits withdrawals or payments from the wallet in question. This legislation provides an important framework for crypto seizures, ensuring that law enforcement has the powers that they need to effectively pursue and disrupt crypto crime — an approach that merits consideration by governments worldwide as policies surrounding cryptocurrency become more defined.
In crypto, centralized stablecoin issuers play a similar role to legacy financial institutions, with the ability to restrict access to assets linked to illicit activity. Unlike decentralized cryptocurrencies like bitcoin, stablecoins are generally centrally controlled, allowing issuers like Tether (USDT) and Circle (USDC) to freeze or even burn tokens associated with illicit activity. These issuers collaborate closely with global law enforcement agencies, using blockchain analytics to monitor transactions in real-time. When suspicious wallets are identified, stablecoin issuers can blacklist addresses, preventing criminals from using the frozen funds and assisting authorities in asset recovery.
This unique capability makes stablecoins a compliance-friendly choice and a valuable tool for combating financial crime. By freezing assets, stablecoin issuers help law enforcement disrupt illicit activity and prevent further misuse.
How forfeited cryptocurrency can generate returns for law enforcement
Forfeited cryptocurrency presents a unique opportunity for law enforcement. Unlike traditional asset forfeiture, where seized cash or property is often quickly offloaded, crypto assets have the potential to appreciate in value. However, victim restitution remains the foremost priority as victims of crypto-related crimes may be entitled to recover the exact digital assets stolen from them, not just their equivalent value at the time of theft or seizure. In the United States, in cases where restitution is not applicable, forfeited assets, including cryptocurrency, are ultimately directed to the Assets Forfeiture Fund or the Treasury Forfeiture Fund, which help pay for expenses associated with asset seizure, which can include blockchain analysis solutions and programs.
Despite these constraints, the development of the U.S. Strategic Bitcoin Reserve raises intriguing possibilities. While current frameworks do not allow U.S. law enforcement to directly capitalize on forfeited crypto at the agency level, policymakers are considering the use of cryptocurrency for broader governmental interests. What makes the Reserve unique is that it is not solely reliant on additional seizures to grow, with policymakers actively exploring open market acquisitions of bitcoin to expand holdings beyond what law enforcement recovers. This move suggests a broader recognition of bitcoin as a strategic asset, potentially reshaping how governments finance operations — reinforcing the notion that seizures can drive lasting impacts if not immediately liquidated.
How do crypto asset seizures and forfeitures work?
The public sector investigation process typically begins with gathering blockchain transaction details and using Chainalysis Reactor to trace illicit cryptocurrency flows. If sufficient evidence is found, authorities collaborate with cryptocurrency exchanges or custodians to prepare a seizure warrant to obtain judicial authorization to seize the assets by transferring them to government-controlled wallets or freezing them until legal proceedings conclude. In the U.S., upon conviction, the government typically auctions forfeited assets, generally compensating victims based on the value of the asset’s value at the time of loss. Remaining forfeited assets and any proceeds are auctioned and transferred into the Asset Forfeiture Fund or Treasury Forfeiture Fund to be used for the government’s forfeiture obligations, reinvested in law enforcement operations, or allocated to community initiatives.
The private sector has an important part to play in the fight against financial crime. Collaboration between crypto platforms, stablecoin issuers, and law enforcement — powered by Chainalysis data — is central to effective enforcement. Chainalysis Crypto Compliance Solution enables platforms to detect and disrupt illicit activity at scale, providing the insights needed to detect irregular transactions, structured payments, or funds linked to illicit activities. Exchanges and issuers can work together to proactively freeze assets, block bad actors, and report cases to financial authorities before illicit funds are laundered or converted into fiat. This partnership structure has already delivered real-world impact, such as Tether’s proactive $225 million USDT freeze. As the frontline of the crypto ecosystem, exchanges and issuers are not just gatekeepers — they are important partners in compliance and enforcement.
Successful cryptocurrency seizure and forfeiture require specialized expertise, training, and technology. Investigators must skillfully identify and securely manage digital evidence, such as crypto wallets and private keys. Chainalysis helps streamline the entire process from investigation to recovery with training programs and specialist support in conjunction with our tools to improve outcomes.
How Chainalysis supports asset seizure
Over ten years, Chainalysis has supported hundreds of cryptocurrency cases involving seizures and freezing of assets in partnership with government agencies worldwide, helping them to secure an estimated $12.6 billion dollars worth of illicit crypto. Recent reports point to approximately 198,000 bitcoin currently under U.S. government custody. Chainalysis has supported much of the recovery of these seized funds, providing the most comprehensive blockchain tooling and training to enforcement agencies and regulatory bodies across the world.
Chainalysis Reactor
Chainalysis Reactor is an advanced blockchain analysis tool that enables law enforcement, financial institutions, and compliance professionals to trace cryptocurrency transactions, identify illicit activity, and connect crypto addresses to real world entities. By visualizing complex transaction flows across multiple blockchains, Reactor helps investigators uncover money laundering, fraud, ransomware payments, and other financial crimes. It integrates with sanctions lists, darknet marketplace data, and open source intelligence, providing timely and actionable insights for investigations.
Chainalysis Wallet Scan
Chainalysis Wallet Scan is a tool designed to help law enforcement efficiently identify cryptocurrency assets linked to seed phrases. It automates the conversion of seed phrases into public keys, scanning across 15+ blockchains, 35+ wallets, and 50 million+ addresses to uncover associated assets, producing results in minutes. Conducted securely offline, Wallet Scan ensures evidential integrity by keeping seed phrases private. Wallet Scan allows investigators to act quickly, minimizing the risk of assets being moved.
Chainalysis Asset Seizure Certification
Specialized training through the Chainalysis Asset Seizure Certification (CASC) course ensures law enforcement officers have the practical skills and knowledge required to manage digital evidence, execute asset recoveries effectively, and achieve immediate operational impact.
Global crypto seizures supported by Chainalysis
Chainalysis has played a major part in the largest and most complex cryptocurrency investigations and seizures. Each operation relied on close cooperation between law enforcement and Chainalysis, demonstrating that illicit crypto can be effectively traced, seized, and returned to victims or reinvested into crime prevention efforts — worldwide and across borders.
Silk Road hacker seizure – $3.36 billion
Agencies involved: U.S. IRS-CI and DOJ
Amount recovered: ~$3.36B1
In November 2021, IRS-CI seized 50,676 bitcoin from James Zhong, an American who pleaded guilty to wire fraud for stealing the funds from Silk Road in 2012 — marking one of the largest crypto seizures in history. Zhong exploited a flaw in Silk Road’s withdrawal system, later using mixing services and exchanges to launder the funds. Investigators used Reactor to trace the transactions and link Zhong to the crime. A 2021 raid recovered 50,491 bitcoin, some hidden in a popcorn tin, with 861 bitcoin later surrendered.
Silk Road seizure – $1 billion
Agencies involved: U.S. IRS-CI and DOJ
Amount recovered: ~$1B+
In November 2020, the U.S. Department of Justice (DOJ) seized over $1 billion worth of cryptocurrency linked to Silk Road, which was the first modern darknet marketplace. Using Chainalysis tools, Internal Revenue Service Criminal Investigation (IRS-CI) agents identified 54 previously undetected transactions, tracing illicit bitcoin to a hacker who had stolen the funds from Silk Road. The bitcoin was transferred to a government-control wallet, where it will be moved to the Treasury Forfeiture Fund (TFF) if forfeiture proceedings are successful. The TFF reinvests in law enforcement programming to train agents to identify and seize more illicit funds.
Colonial Pipeline ransomware recovery – $4.4 million
Agencies involved: U.S. FBI and DOJ
Amount recovered: ~$4.4M
In May 2021, Colonial Pipeline paid approximately $4.4 million worth of bitcoin in ransom to DarkSide, a Russia-based ransomware group following a cyberattack that disrupted fuel supply across the southeastern U.S. Using Chainalysis tools, the Federal Bureau of Investigation (FBI) traced the ransom payment, identifying fund movements through DarkSide’s network. This led to the seizure of $2.3 million worth of bitcoin from the attacker’s wallet.
Hezbollah and Iran’s Quds Force terrorism financing seizure – $1.7 million
Agencies involved: Israel NBCTF
Amount recovered: ~$1.7M
In June 2023, Israel’s National Bureau for Counter Terror Financing (NBCTF) seized approximately $1.7 million worth of cryptocurrency linked to Hezbollah and Iran’s Quds Force, marking the first ever seizure of crypto assets associated with Hezbollah. Chainalysis tools helped investigators trace the funds and identify wallets used to move money through Syrian intermediaries.
Public-private partnerships enhance compliance and enforcement
Collaboration between Chainalysis, law enforcement agencies, and cryptocurrency industry partners dramatically enhances investigative capabilities, the potential of successful disruption of criminal operations, and the recovery of assets. In each of these cases, authorities were able to cut off funding of major illicit operations with the help of Chainalysis and crypto industry partners.
Chainalysis, Tether, and OKX disrupt major pig butchering pipeline
Agencies involved: U.S. DOJ and Secret Service
In late 2023, Chainalysis, Tether, and crypto exchange OKX collaborated with the DOJ and U.S. Secret Service to investigate a major pig butchering romance scam compound in Southeast Asia. Using Chainalysis, investigators traced illicit transactions, allowing Tether to freeze approximately $225 million of USDT held in perpetrators’ wallets — marking the largest ever freeze of USDT.
Chainalysis and Tether support Operation Endgame
Agencies involved: Dutch FIOD
In September 2024, the Dutch Fiscal Information and Investigation Service (FIOD), supported by Chainalysis and Tether, shut down illicit cryptocurrency exchanges Cryptex and pm2btc for facilitating money laundering. Authorities seized €7 million (approximately $7.6 million) worth of cryptocurrency during this operation.
Operation Spincaster: Disrupting global crypto scams
Announced in July 2024, Chainalysis-led Operation Spincaster is a series of targeted sprints bringing together law enforcement and private sector partners to dismantle cryptocurrency-enabled scam networks, including approval phishing and pig butchering romance scams. Throughout 2024, Chainalysis coordinated Spincaster operations across six countries: the U.S., Canada, the UK, Spain, Netherlands, and Australia — providing investigative training using Chainalysis’ blockchain analysis tools. These efforts generated over 7,000 investigative leads tied to approximately $162 million in scam-related losses, enabling partners to close fraudulent accounts and seize illicit cryptocurrency.
In one notable Spincaster sprint in Delta, Canada, Chainalysis tools helped local law enforcement trace and seize millions in stolen crypto from scams. During the operation, investigators identified 1,100 victims and examined 240 scam-related addresses, revealing losses exceeding $25 million. Using Chainalysis tooling, law enforcement tracked and froze illicit funds, including $1.2 million in a blacklisted address under international seizure and $800,000 in fraudulent transactions from Canadian exchanges.
Turning asset seizures into an operational advantage
As financial crime evolves alongside the mass adoption of cryptocurrency, agencies need every advantage to stay ahead. Crypto seizures are more than just a legal process — they are a strategic imperative for authorities. Effective seizures disrupt criminals, generate revenue and new leads, and drive cost efficiency.
Chainalysis is the only partner that enables agencies to track, seize, and capitalize on crypto assets at scale. Our blockchain intelligence and real-time investigative support give agencies the speed and precision needed to act decisively. Although legal proceedings are a critical part of bringing criminals to justice, they can take time. Seizures, however, dismantle criminal funding networks, making it harder for bad actors to continue to operate and forcing them to identify new funding streams. Seizures can also generate revenue, allowing the government to reinvest seized funds into their own operations, reducing reliance on taxpayer dollars.
Beyond recovering assets, effective seizures also cut enforcement costs and deter future crime. By making it riskier and less profitable for criminals to exploit crypto, agencies have the opportunity to shift the balance of power. Chainalysis provides the technology, expertise, and support to ensure that seizures are not just an endpoint, but a force multiplier in the fight against financial crime. By turning seizures into an operational advantage, Chainalysis helps agencies act with precision, strike faster, and cut off crime at source.
Endnotes
[1] All cryptocurrency values are reported at the time of seizure.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
