US Authorities Seize $25 Million in Crypto Tied to Cross-Border Fraud Schemes

U.S. federal authorities in Washington, D.C. said they have seized more than $25 million in cryptocurrency tied to cross-border fraud schemes, underscoring how digital assets remain central to modern cybercrime—and how aggressively law enforcement is moving to claw funds back through forfeiture actions.

In an announcement dated July 21, the U.S. Attorney’s Office for the District of Columbia and the U.S. Secret Service’s Washington Field Office said the seizures were made through investigations by their Cyber Fraud Task Force. Prosecutors have since filed five civil forfeiture complaints to permanently confiscate the recovered assets, which they say are linked to an international scam network targeting residents in the U.S. and Canada.

Officials said the largest case involved a ‘romance scam’ affecting more than 200 victims, with losses totaling roughly $12.1 million. A second major case—worth about $10.4 million—stemmed from a network of suspicious wallets flagged by Canadian authorities and shared with the Secret Service. Investigators said they identified more than 270 suspicious transactions connected to fraudulent investment platforms, noting that the two main cases account for roughly 85% of the total assets targeted for forfeiture.

The remaining cases involved schemes characterized by withdrawal restrictions, fake investment accounts, and tracing of stolen proceeds. Investigators also said several key suspected money launderers were based in Southeast Asia, and that they observed internet addresses linked to China, Malaysia, and Cambodia—an operational footprint consistent with broader patterns of industrialized scam operations that rely on layered laundering routes across jurisdictions.

Separately, South Korea’s Mirae Asset Consulting said it has secured management control of Korbit, one of the country’s early cryptocurrency exchanges, as it moves to reposition the business into a broader digital asset infrastructure play. According to local reports, Mirae Asset Consulting increased its stake to 97.15% in a deal valued at about 141.4 billion won (roughly $95 million to $102 million at prevailing exchange rates).

South Korea’s Fair Trade Commission approved the transaction on July 9, 2026, citing Korbit’s estimated 0.5% share of the domestic crypto trading market in 2025 and concluding the acquisition was unlikely to restrict competition. Korbit plans to rebrand as DigitalX and pivot toward becoming a digital asset infrastructure platform, while maintaining its operating entity, client deposits, and core trading services for the time being. The firm said customer assets will continue to be segregated in line with existing protection rules.

Mirae Asset founder and Global Strategy Officer Hyeon-joo Park framed DigitalX as a key pillar of the group’s “Mirae Asset 3.0” initiative, with an ambition to connect ‘real-world asset tokenization,’ security tokens, stablecoins, traditional securities, and digital assets on one platform. The company emphasized that the objective is not to outcompete Korea’s dominant venues by spot volume, but to combine its securities and asset-management capabilities with Korbit’s operational experience in digital assets.

In DeFi, Uniswap said on July 26 UTC it introduced ‘permissioned pools’ built on Uniswap v4, aiming to make regulated on-chain markets more feasible for tokenized securities, funds, and equities by integrating allowlist verification into automated market maker (AMM) trading. Superstate, Securitize, and Daugo were named as launch partners. The protocol stressed that standard ‘permissionless’ pools on Uniswap v4 will continue unchanged.

Russia’s largest bank, Sberbank, is also preparing to expand into regulated digital asset services. The lender is developing cryptocurrency trading infrastructure and digital custody services targeted at regulated financial institutions, with plans to launch by Dec. 1, according to local reporting. Russia’s updated rules governing trading, custody, and payments involving crypto assets are set to take effect on Sept. 1, while requirements for licensed intermediaries will apply beginning in July 2027. Public crypto trading in Russia will be restricted to assets meeting liquidity and market-cap thresholds, while using crypto for domestic payments remains prohibited.

Meanwhile, DeFi trade aggregator Odos said it will shut down all services on July 30, 2026, with its app shifting into read-only mode starting July 27. Users will be able to view balances and transaction history but will not be able to initiate new trades. Odos said it has never directly custodyed user funds; assets held in external wallets such as MetaMask, Rabby, or hardware wallets remain controlled by users’ private keys. However, users who created Odos wallets through Google, Apple, or email login were urged to export their private keys or move assets to self-custody wallets before the cutoff.

Odos, which spun out of Semiotic Labs in 2022, said it has routed more than $104 billion in volume across roughly 15 networks. The company noted a sharp contraction in activity, from about $7.85 billion in monthly volume in December 2024 to a few hundred million dollars by mid-2026. It added that the ODOS token will continue to exist independently of the product shutdown, describing the Odos DAO and the operating company as separate entities, and warned users to ignore any scam communications claiming token migrations, claims, or airdrops.

Market activity also flared around Euler (EUL) after Upbit announced a listing in its Korean won market. EUL spiked more than 100% intraday to as high as $2.73 before easing to around $2.30, based on OKX pricing cited in local reports—an example of how top-tier exchange listings can still drive abrupt ‘liquidity inflow’ and volatility in mid-cap tokens.

In security-related developments, on-chain analyst “Vijinn” reported that the attacker behind the AFX Trade exploit swapped 12,467.4 Ether (ETH) for Bitcoin (BTC). AFX Trade’s Arbitrum cross-chain bridge was hacked on July 23, resulting in about $24 million in losses, largely in USD Coin (USDC). The attacker has been reported to have bridged funds from Arbitrum back to Ethereum in stages before conducting the exchange.

The FBI is also investigating a separate malware campaign involving eight downloadable games that authorities say infected roughly 8,000 devices and enabled access to around 80 cryptocurrency wallets, with at least $220,000 in digital assets stolen. Court documents allege the activity ran from May 2024 to February 2026 and that a North Lauderdale, Florida resident, Zaire Dontavius Jamarion Wilkins, 21, financed and promoted the malware operation. Investigators said victims who installed the games had passwords, wallet authentication data, and browser information harvested, with promotion allegedly conducted via Discord, Telegram, X, and LinkedIn, supported by bots used to locate crypto holders across online communities. Wilkins faces a conspiracy charge that carries a maximum sentence of up to 10 years in prison if convicted.

Broader concerns about state-linked theft also resurfaced after a report circulated that Chainalysis CEO Michael Gronager said on CNBC that North Korea has been actively stealing Bitcoin (BTC) to fund nuclear weapons development. Chainalysis, a blockchain analytics company, is widely used by exchanges and law enforcement agencies to trace hacks and money laundering activity.

Finally, liquid staking provider Lido said it is investigating a discrepancy found during a recalculation of stETH yield, while stressing there is no user fund risk and that the issue is not related to validator slashing. According to local reports, Lido developers observed an anomaly in the rebase accounting reported by the protocol’s oracle: the annualized yield was computed at 2.04% versus an expected 2.15%. Lido attributed the mismatch to 32 ETH from a validator deposit awaiting confirmation that was not reflected in oracle statistics, and said the missing amount will be incorporated in the next recalculation after a fix is applied.