justice

On October 13, the U.S. Department of Justice announced the arrest of two Americans in an operation targeting North Korean IT personnel who entered U.S. companies under false identities, and the seizure of approximately 187 computer devices. Michael James Bostelle from Pennsylvania and Juan Cecilio Pena Carrillo from Texas were arrested based on an indictment from the Northern District of Ohio Federal Court. Prosecutors allege that the scheme involved over 70 U.S. employers, generating approximately $3 million in revenue for overseas IT personnel. The two are charged with conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft, with Pena additionally charged with aggravated identity theft.The device seizure operation is part of "Operation Lone Star," coordinated by federal law enforcement in the Northern District of Texas. From September 21 to 25, the FBI executed searches at over 40 suspected "laptop farm" residences in Texas, seizing devices including laptops and keyboards, video, and mouse equipment for remote access. According to the Ohio indictment, domestic accomplices received laptops issued by employers at home and then allowed overseas personnel to control them via remote access software or hardware, making it appear as if they were located in the U.S. and accessing company systems, while the accomplices received salaries and transferred funds overseas.The indictment mentions cryptocurrency as one of the means for transferring funds overseas. Trey Michael Nolte, a resident of Ohio, is listed as a co-conspirator but has not been charged in this case; the indictment states that in a conversation on July 8, 2024, he described managing transfers between bank accounts and virtual currencies using spreadsheets, subsequently transferring funds to the defendant Sun Sheng Ming;

According to Bloomberg, the U.S. Department of Justice is reviewing whether Binance Holdings Ltd. has violated the settlement agreement reached with the U.S. government in 2023, while also investigating whether activities on the platform may involve violations of Iran sanctions.Tysen Duva, head of the criminal division of the U.S. Department of Justice, stated in an interview this week that officials are reviewing Binance's compliance with the 2023 agreement. He declined to discuss details and did not indicate that Binance violated the settlement agreement. Under the agreement, Binance agreed to pay a $4.3 billion fine, acknowledged violations of banking-related rules, and accepted enhanced compliance controls.

U.S. federal prosecutors cited the appellate ruling related to the cryptocurrency mixer Bitcoin Fog as a supplementary basis against the not guilty motion of Tornado Cash developer Roman Storm. In documents submitted on Monday, the prosecution referenced the September 25 ruling by the appellate court that upheld the conviction and sentencing of Bitcoin Fog operator Roman Sterlingov. The District of Columbia Circuit Court found that Washington, D.C. had jurisdiction over all four charges: the money laundering charge was based on undercover agents completing Bitcoin Fog transactions in its D.C. office, while the unlicensed money transmission charge was supported by sufficient evidence showing that Bitcoin Fog had served clients in the area.The prosecution stated that the ruling "directly supports" its position in the Storm case, arguing that Tornado Cash's activities in Manhattan were sufficient to establish jurisdiction in the Southern District of New York for the conspiracy charges of money laundering and unlicensed money transmission against Storm, citing the testimony of Shakeeb Ahmed, who claimed to have used Tornado Cash in a Manhattan apartment. Judge Katherine Polk Failla has heard the arguments for the not guilty motion in April 2026 but has yet to rule. In August 2025, the jury found Storm guilty of conspiracy to operate an unlicensed money transmission business, but deadlocked on the charges of money laundering and conspiracy to evade sanctions; Storm submitted a post-trial not guilty motion in September 2025, arguing that the prosecution failed to prove he intended to assist criminals in abusing Tornado Cash.

Tornado Cash co-founder Roman Storm posted on X platform stating that the U.S. Department of the Treasury recently acknowledged in a document that there were issues with the previous rules regarding mixers, and mentioned that this policy could have a "chilling effect" on legitimate activities.Storm stated that although the relevant department of the U.S. Department of the Treasury now believes there are issues with the policy, the U.S. Department of Justice still insists in its case that even legitimate transactions conducted through Tornado Cash constitute illegal activities due to the potential for being used for money laundering, evading sanctions, and other criminal purposes.Storm claimed that the non-criminal department of the U.S. government believes the policy is inappropriate, while the criminal justice department considers all related transactions to be criminal; he has been detained and prosecuted for over 1,139 days and stated that his case stems from developing open-source code.Storm also mentioned that a new document was submitted today to the Southern District of New York (SDNY) federal court, and the U.S. Department of Justice is still pushing for his conviction.

According to Bloomberg, sources have revealed that U.S. federal prosecutors are investigating whether Binance Holdings Ltd. violated U.S. sanctions against Iran by failing to prevent certain transactions on its platform.The investigation into Binance's compliance is being handled by the Manhattan U.S. Attorney's Office. One source also noted that the Criminal Division of the U.S. Department of Justice in Washington is involved in the case, and authorities are focusing on whether Binance knowingly allowed the relevant transactions to proceed.

The U.S. Department of Justice announced that Iris Rabaya Au, a 37-year-old woman from Irvine, Orange County, California, was sentenced to 18 months in federal prison for failing to report over $2.6 million in illegal income to the Internal Revenue Service (IRS). She was also ordered to pay $1.484 million in restitution and had multiple luxury cars, high-performance vehicles, designer handbags, and three "Godfather" sculptures confiscated. Au is the ex-girlfriend of cryptocurrency scammer Adam Iza.Prosecutors stated that between 2020 and 2024, Iza fraudulently obtained Meta advertising accounts and credit lines, selling account access and earning millions of dollars in unreported income. At Iza's direction, Au set up shell companies and opened bank accounts, using the related funds to pay approximately $1 million to Los Angeles County Sheriff's Department (LASD) officers and to purchase or lease luxury homes, cars, jewelry, and clothing. They also spent nearly $10 million on entertainment and purchased about $16 million in cryptocurrency for Iza. Between 2020 and 2023, Au transferred over $2.6 million into her personal bank accounts but did not accurately report it on her federal tax returns. She pleaded guilty to one count of false tax return in March 2025. Iza pleaded guilty in January 2025 to charges including conspiracy to infringe rights, wire fraud, and tax evasion, with a sentencing hearing scheduled for October 5. He was also sentenced to 15 years in federal prison for his involvement in an attempted Bitcoin robbery and kidnapping case in Connecticut in August 2024.

According to Bloomberg, the U.S. Department of Justice is seeking to seize $61 million, claiming that the funds come from Iran's black market oil sales and were laundered through the cryptocurrency exchange Binance.The Manhattan federal prosecutor alleges in a civil forfeiture lawsuit that Iran used a network of cryptocurrency participants to launder over $1.5 billion in illegal oil funds. The prosecution states that the relevant entities used Binance trading accounts to transfer oil proceeds to Iran and its agents and affiliated organizations to fund military and terrorist activities.

According to The Block, the U.S. Department of Justice reported that California man Adam Iza was sentenced to 15 years in prison for his involvement in a kidnapping conspiracy in August 2024.He assisted in planning and funding a kidnapping operation targeting the parents of a person involved in a multi-million dollar Bitcoin theft case, directing six men from Florida to carry out a violent carjacking and kidnapping in Connecticut via mobile phones and encrypted messaging apps. Currently, his brother and six participants have pleaded guilty, while the remaining conspirators are awaiting trial.

According to a notice from the U.S. Department of Justice, the Department's Fraud Center Strike Force, in coordination with the Department of the Treasury, took coordinated law enforcement action against Xinbi Guarantee, seizing and restricting the disposal of over 52 million dollars in cryptocurrency in a single day, bringing the total assets restricted by the task force to approximately 938 million dollars. Tether provided proactive assistance in this investigation.The Department of Justice alleges that Xinbi is an illegal scam service market primarily operating through Telegram, providing customized investment scam websites, money laundering services, and recruiting victims of human trafficking to work in scam parks in Southeast Asia. Law enforcement has seized its Telegram channel and two cryptocurrency wallets holding approximately 12 million dollars, and restricted the disposal of an additional 47 related wallets.At the same time, the U.S. Department of the Treasury's Office of Foreign Assets Control designated Xinbi as a significant transnational criminal organization and sanctioned two additional entities that support it. The task force also assisted Madagascar in shutting down 13 scam parks operated by Chinese criminal groups, processing over 3,200 electronic devices, and local authorities arrested nearly 400 people.

U.S. Attorney General Todd Blanche posted on the X platform that this week cybercriminals launched password recovery attacks against hundreds of thousands of X users. The X platform successfully thwarted this attack to prevent user accounts from being hijacked, and the Department of Justice is working closely with X to track down the attackers.

The U.S. Department of Justice announced that it has seized over $560,000 in cryptocurrency originally intended to fund Hamas and has taken control of the domain names and servers used by the organization for fundraising and recruiting supporters. The Department of Justice released five affidavits along with the announcement on Wednesday, three of which were signed on March 25, June 25, and October 10, 2025, regarding the seizure order for the aforementioned $560,000 in cryptocurrency.According to court documents, investigators identified and tracked rotating cryptocurrency addresses promoted through encrypted group chats and fundraising websites with the help of human intelligence sources. The first actions recovered approximately $201,400 from wallets and accounts, which have transferred over $1.5 million since October 2024, with the related addresses allegedly controlled by Hamas's military wing, the Izz ad-Din al-Qassam Brigades.Additionally, the FBI seized the domain name and servers used to operate the organization's main website Alqassam.ps, allowing them to intercept subsequent cryptocurrency donations. The Department of Justice stated that this operation enabled investigators to obtain information on thousands of individuals who contacted Hamas-related platforms, attempting to donate via cryptocurrency or traditional payment methods.

According to Decrypt, CrowdStrike and the U.S. Department of Justice announced on Tuesday that they have dismantled the Sality peer-to-peer botnet, which has been active since 2003.This botnet primarily hijacked cryptocurrency payments through the EggJagger malware over the past eight years, which monitored the cryptocurrency wallet addresses in victims' clipboards and replaced them with the operator's own address, causing victims to send funds to strangers.CrowdStrike estimates that the operator has stolen at least 12.1 million rubles (approximately $150,000) solely through the EggJagger payload. Most of the stolen cryptocurrency has not been spent, and CrowdStrike assesses that these unspent assets were worth about 147 million rubles (nominally around $1.35 million) at their peak in January 2025. The reason Sality has survived to this day is that it does not have a central server that can be seized; infected machines communicate directly with each other.This multinational operation involved the United States, Bulgaria, Hungary, and Romania. The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service seized Sality-related domains within the United States, and police from multiple European countries also seized other domains.CrowdStrike isolated more than 15,000 infected machines to its controlled honeypot by exploiting its architectural vulnerabilities. The operator has been tracked as SALTY SPIDER, which launched a denial-of-service attack against the Russian cryptocurrency exchange AvanChange in September 2023.

Jing Tian responded on Weibo, stating: "I will never sell my love for money, now, in the past, or in the future, nor will I sell my soul. I still believe in love, I still have poor judgment, and I still lack wisdom. But I believe in the law, believe in kindness, and believe that justice and fairness will ultimately prevail. Time will prove everything."Previously, Sun Yuchen's attorney Zhang Qihuai released a statement of the case facts, indicating that Sun Yuchen has filed a civil lawsuit against Jing Tian and her parents as defendants, involving a subject matter of over 30 million yuan. The case has been legally filed, and the plaintiff has applied for property preservation.

According to The Block, a federal jury in the United States found San Francisco resident Japheth Dillman guilty of wire fraud and conspiracy to commit wire fraud. The U.S. Department of Justice stated that Dillman made false statements regarding the cryptocurrency trading fund Block Bits Capital, which he co-founded, defrauding over 20 investors of nearly $1 million.His sentencing hearing is scheduled for December 8.

According to Decrypt, the U.S. Department of Justice has filed charges against 17 hackers allegedly affiliated with Iran's Mabna Institute, accusing them of participating in years-long cyber attack activities, including the 2017 breach of U.S. cable network HBO, where they stole data and demanded approximately $6 million in ransom paid in Bitcoin. Prosecutors claim that the organization conducted hacking attacks on behalf of the Iranian Islamic Revolutionary Guard Corps and other Iranian government clients, targeting hundreds of universities, businesses, and government agencies worldwide, stealing at least 31.5 TB of academic data and intellectual property.The organization also targeted over 100,000 professor accounts, breaching about 8,000 accounts across 144 U.S. universities and 178 foreign universities. The U.S. State Department is offering a reward of up to $10 million for information leading to the whereabouts of five of the defendants. In recent months, the U.S. Treasury has imposed sanctions on several Iranian cryptocurrency exchanges and frozen over $131 million in cryptocurrency assets related to the Iranian central bank and the Revolutionary Guard.

According to Bloomberg, the U.S. Department of Justice is conducting an antitrust investigation into Silicon Valley's top venture capital firm Andreessen Horowitz (a16z), focusing on its partners serving on the boards of multiple AI companies that are in competition with each other—co-founder Ben Horowitz serves on the board of Databricks, and partner Martin Casado serves on the board of Fivetran, with both companies competing in the data processing field.Casado previously also served on the board of dbt labs (acquired by Fivetran in June). This investigation has been ongoing for nearly a year, starting with the antitrust review of Fivetran's acquisition of dbt labs. Although the acquisition has been unconditionally approved, the investigation into the board positions continues. Such investigations typically end with board members resigning. a16z has close ties to the Trump administration, with both founders donating millions to the Trump campaign in 2024 and successfully pushing for the weakening of safety barriers in AI policy. a16z manages assets totaling $90 billion and recently raised a $15 billion fund, with a portfolio that includes SpaceX, OpenAI, and Cursor, among others.

FlashRescue co-founder @DarcyAri posted on the X platform that on July 28, 2026, the funding project ODY targeting victims in China issued an additional 10 billion tokens and absconded with approximately 15 million USDT from the trading pool. Currently, it is known that there are over 10,000 victims, and the case has been accepted and is under investigation.Including subsequent transfers and transaction fees, ODY has aggregated at least 15,669,118 USDT. Further tracking revealed that the same main aggregation address previously received 5,383,428 USDT transferred from the KXG wallet, confirming that ODY and KXG share a common fund pool.

The U.S. Department of Justice (DOJ) announced that Liu Zhou, the founder and principal operator of the cryptocurrency financial services company MyTrade, was recently fined $10,000 in federal court in Boston for participating in a cryptocurrency market manipulation scheme.Prosecutors stated that MyTrade provided so-called "Volume Support" services to cryptocurrency projects through its "MyTrade MM" platform, using bots to execute false trades (wash trading) across multiple cryptocurrency exchanges, artificially creating trading volume and market activity to mislead investors. According to the plea agreement, MyTrade MM has ceased providing "Volume Support" services and permanently shut down the related wash trading bots, while adding a statement on its website acknowledging that "Volume Support constitutes wash trading, which is illegal under U.S. law." The U.S. Department of Justice stated that the case was jointly pursued by the U.S. Attorney's Office and the Boston division of the Federal Bureau of Investigation (FBI).

The U.S. Department of Justice (DOJ) announced that Taj Tarsha, the founder of the NFT market project Few and Far, has been charged with securities fraud and wire fraud, accused of concealing the use of funds from investors and misappropriating financing for personal consumption.According to the indictment, Tarsha raised funds from investors starting in 2022 through a SAFT (Simple Agreement for Future Tokens), claiming that the funds would be used to develop a decentralized NFT trading market and the FAR token ecosystem.Prosecutors stated that Tarsha raised over $10 million from at least 67 investors by selling approximately 95 million FAR token rights. However, shortly after the fundraising, he allegedly used investor funds for personal purposes, including online gambling, purchasing high-risk crypto assets, paying for a Miami apartment loan, interior design expenses, and personal DJ activities.The indictment documents show that Tarsha also allegedly misappropriated nearly $1 million in company funds through two bonuses that were not disclosed to investors and co-founders, as well as through high salaries. After an audit revealed anomalies in the related funds, Tarsha was accused of providing false explanations to investors, claiming that the use of funds was in line with project development needs.