Sixty-One Million Dollars, From One Phone Call

How does stolen crypto get frozen?

It gets frozen twice, by two different people, for two different reasons.

The first freeze belongs to a private company. Most money stolen in these schemes is converted into a stablecoin — a cryptocurrency built to be worth exactly one dollar — and the largest of those is issued by a single firm. Because a company issues it, that company can switch a specific address off. It takes seconds. No judge is involved.

The second freeze belongs to a court. A U.S. Attorney files a civil forfeiture complaint, which is a lawsuit against the money itself, and if the court agrees, ownership passes to the government. That takes months.

The reason to keep the two apart is the part almost nobody says out loud: neither of them is the same as a victim being repaid. The Justice Department publishes what it has stopped, to the cent. It does not publish what has gone home.

It started with one report to a tip line

On Tuesday 24 February 2026, the U.S. Attorney’s Office for the Eastern District of North Carolina announced that federal agents had seized over $61 million worth of Tether.

The announcement does not begin with a raid or an arrest. It begins with a phone line. Agents and analysts in Raleigh received a report of alleged investment fraud from a victim through the Homeland Security Investigations tip line — one person, saying they thought they had been scammed.

The office describes what that person had been through in three moves, and they are worth reading slowly, because they are the same three moves in almost every one of these cases. Someone presented themselves as a romantic partner. A trading platform appeared that looked exactly like a real one, showing a portfolio with returns that do not happen. And when the person tried to withdraw, there was a tax, or a fee, that had to be paid first to release the funds.

From that single report, investigators traced the money into and through multiple cryptocurrency wallets. And then comes the sentence that explains why this case exists at all: several of those wallets still contained substantial amounts of victims’ money.

Not the original victim’s money alone. Victims’, plural. One report opened a door onto a pool that many people had been paying into.

What a stablecoin is, and the property that traps it

A stablecoin is a cryptocurrency designed to hold a fixed value — one coin, one dollar, permanently. For someone moving stolen money, it has two attractive properties and one that is a problem.

It holds its value, so a delay of a week does not cost anything. It moves in minutes, anywhere, without a bank in the middle. And every movement is written on a public ledger that anybody can read, investigators included.

That last property is why laundering exists as a step at all. The money has to be broken up. In the June 2025 Washington case, the Secret Service described a network that had executed hundreds of thousands of transactions and dispersed the proceeds across an extensive group of addresses to disguise where they came from. In the cases announced in July 2026, the funds were laundered using hundreds of intermediary addresses, mixed with money taken from other people, so that no single line could be followed cleanly.

But splitting money is not the same as spending it. Sooner or later it has to sit somewhere long enough to be worth something to somebody. That pause is the entire opportunity, and it is what the North Carolina agents found at the end of the trail.

Who can freeze stolen cryptocurrency?

Two parties can, and understanding which is which is the difference between a useful expectation and a false one.

Lever one belongs to the company that issues the coin

The ability to freeze is built into the coin itself. The issuer can mark an address so that the balance sitting there cannot move. Not the blockchain — the coin. Bitcoin does not have this, because no company issues bitcoin. A stablecoin has it, because a company does.

The clearest description of how that works in practice comes from the issuer. In November 2023, after an investigation involving the Department of Justice, Tether described its own action in one line: a freeze request by the United States Secret Service, and a voluntary freeze by Tether. At the time the company called it the largest freeze of that coin in its history.

The company added a detail in the same statement that most coverage skipped, and it matters here. The frozen wallets were on the secondary market. In other words: not the issuer’s own customers. Anybody’s wallet, anywhere the coin was sitting.

That is the reach of lever one — and it is also its risk, which we come back to at the end.

Lever two belongs to a court

Freezing money does not decide who it belongs to. That is what forfeiture is for.

The U.S. Attorney files a civil forfeiture complaint in federal court — a lawsuit against the money itself rather than against a person, which is why the case names read like the United States against a quantity of coin. Nobody has to be arrested first. The government has to persuade the court that the property is connected to the crime.

If the court agrees, the coins are transferred to the government. In the North Carolina case, the office wrote that Tether assisted in transferring the assets. The coin moves one last time, and the wallet at the other end belongs to the United States.

The Justice Department’s own April 2026 release puts both levers in a single phrase: funds restrained through voluntary actions of cryptocurrency providers, as well as U.S. legal process. Providers, and process. The company, and the court. Speed on one side, legitimacy on the other — and neither one works without the other.

Trace, freeze, seize, forfeit: four verbs, two owners

Written out in order, the machine is short:

1. Trace. Investigators follow the money across the public ledger from the victim’s first transfer through the addresses it was split into.
2. Freeze. The issuer disables the addresses that still hold a balance. Seconds, on request.
3. Seize. The government takes control — in these cases, by the issuer transferring the balance to a wallet the government holds.
4. Forfeit. A court decides ownership passes to the United States.

Two of those four steps belong to a private company. That is not a criticism of anyone; it is the design. And it is the reason a scheme running out of a compound thousands of miles away can be stopped by a corporate decision made in an afternoon, while the question of who actually owns the money takes a year.

From one case to a machine

The scale of this is recent, and it is worth seeing the ladder rather than only the top of it.

June 2025. Before any strike force existed, the U.S. Attorney’s office in Washington filed a complaint against more than $225.3 million in cryptocurrency. The Secret Service called it the largest cryptocurrency seizure in its history. The filing describes dozens of confirmed victims in the United States and more than 400 suspected victims worldwide. The Justice Department thanked Tether by name. That was one case, and it took an entire investigation.

November 2025. The office in Washington turned the case into a standing operation: the Scam Center Strike Force, joining the U.S. Attorney for the District of Columbia, the Justice Department’s Criminal Division, the FBI and the Secret Service, with the IRS criminal investigators, the Postal Inspectors, the DEA and three more U.S. Attorneys’ offices added later. One team, one job. The office’s own estimate of the size of the problem, in its release: this industry takes nearly $10 billion a year from Americans.

February 2026. Two days after the North Carolina seizure, the U.S. Attorney in Washington announced that freezes and seizures by the Strike Force had topped $580 million — in her words, in only three months. Worth noting for anyone checking the arithmetic: the headline of that release says $580 million and a sentence lower down says $578 million. We use the headline figure, which is the one both the Justice Department and the Secret Service put at the top.

Three months from launch to $580 million. The largest seizure in Secret Service history had been $225.3 million, and it had taken a case. The machine did more than double it in a quarter.

Today. The Strike Force’s own page states that its Crypto Seizure team has restrained $832,831,006.15. Stated to the cent — which tells you something about what is being counted carefully, and, as we will see, what is not being counted at all.

The parts of a strike that are not money

A strike force does not only freeze coins, and the actions that are not seizures are the ones that reach ordinary life.

In the 23 April 2026 release alone: 503 .com web domains seized, which is 503 fake investment platforms taken off the internet by address in one action. A Telegram channel with more than 6,000 followers seized — the first of its kind — which had been recruiting workers for a compound in Cambodia. Two men charged in Washington with wire fraud conspiracy over a compound in Burma, arrested by Thai police; the charges are allegations and both are presumed innocent. And a State Department reward of up to $10 million for information about the money behind a compound in Burma’s Karen State.

The same release records the scam changing costume. In one version the contact is not a romantic partner at all: it is someone posing as a bank’s fraud department, saying the account was used to buy firearms, followed by a handoff to a fake detective, then a fake court official, then days of pressure over messaging apps until the person hands over the account and the savings. Different story, same compounds, same wallets at the end of the line.

In June 2026, a week of coordinated action with Apple, Coinbase, Google, Meta, Microsoft and others interrupted more than 1.4 million social media and email accounts used by the scam centres. The cryptocurrency frozen in that same week was $3.8 million.

Put those two numbers next to each other, because the contrast is the lesson: 1.4 million accounts, and $3.8 million. Accounts are fast. Money is slow.

The call that comes before the loss

The part of all this that gets closest to a kitchen table has no seizure in it.

Since January 2024, the FBI and the Secret Service have run Operation Level Up. It works backwards from the money: investigators identify victims from inside the trail of transactions, and then they call them — often before the person has any idea.

As of March 2026, the Justice Department reported 8,935 people notified. Seventy-seven percent of them did not know they were being scammed. The estimated amount those people did not go on to send, after the call, was $562,726,245. And 93 of them were referred to an FBI victim specialist for suicide intervention.

Ninety-three people, in a document otherwise full of seizure totals.

The same release records one man surviving on disability pay who had already sent $1,200 and was about to cut into money he needed for food to send more, when the call came.

If a federal agent ever does call you about this, one caution belongs here: scammers imitate that call too. Hang up and call the agency back on a number you look up yourself. A real investigator will not mind.

Does freezing the money mean victims get it back?

No, and this is the single most misread thing about every one of these announcements.

Three words appear in the paperwork and they are not synonyms:

• Restrained means the money has been frozen or seized. It cannot move.
• Recovered means the government has control of it.
• Returned means a person who was defrauded has been repaid.

Press releases count the first two. The route to the third is a separate process, and the burden in it sits with the victim: under the federal rules, persons seeking remission as victims file the petition themselves and support the loss with documentary evidence including invoices and receipts.

Every release in this story ends with a version of the same clause — that the office will seek to return the funds to victims to the maximum extent possible. In every document we read for this piece, the total actually returned to victims does not appear. It is not hidden. It simply is not counted. The page counts what was stopped, to the cent, and does not count what came home.

We wrote about where those forfeited assets go, and what a victim’s petition actually involves, in how scam networks hide money — the case where $15 billion in bitcoin ended up in the custody of the United States.

The switch does not know whose money it is

There is one more line worth sitting with, and it comes from the company holding lever one.

When Tether froze wallets at the Secret Service’s request, it added that to the extent lawful wallets were captured by the operation, it would work with law enforcement and the owners to unfreeze them, as appropriate.

Read that plainly: the company anticipated freezing money that had nothing to do with the crime, and described the remedy as working it out afterwards. That is what a switch is. It stops a balance at an address. It does not know whose balance it is, and it does not ask before it acts.

This is the honest shape of the system as it exists. It is fast because a private company can act without a court, and it is fallible for exactly the same reason. The court comes second, and the court is where the errors are supposed to be corrected.

What this actually changes for you

If you have lost money to an investment platform, four things follow from the above, and none of them are abstract.

Your report is the input. Not a formality, not paperwork. The $61 million case exists because one person called a tip line. The trace only starts with a report, and the freeze only works on money someone has traced.

Speed is the whole game. The freeze only bites on a balance that is still sitting still. Every day between the loss and the report is a day of addresses being split and drained.

Nobody needs to be arrested for the money to be stopped. Forfeiture is a case against the property. People often delay reporting because they assume nothing can happen unless the scammer is caught. That is backwards.

A large seizure figure is not a promise about you. Seeing $832 million in a headline and concluding that your share is coming is the mistake the paperwork invites and never corrects.

How to spot the platform that will not let you withdraw

The scheme in the North Carolina filing has a shape, and the shape repeats. Each of these has a 30-second counter-test.

• The introduction came before the opportunity. A person appeared first — a wrong-number text, a dating app, a friendly group chat — and the investment came later. Counter-test: search the profile photo. If it appears elsewhere under another name, you have your answer.
• The returns are steady and high. Real markets are neither. Counter-test: compare the reported gain with any published index over the same weeks.
• The platform is only reachable by a link they sent. Counter-test: search the platform’s name plus the word “withdrawal” and see what other people say. Then check the U.S. regulator lists for the firm’s registration rather than trusting a page on the site itself.
• A withdrawal triggers a new payment. A tax, a fee, a compliance deposit, an unlocking charge. This is the tell that ends the argument. Counter-test: there is no legitimate financial product anywhere that requires you to send money in order to take money out. None.
• The pressure arrives with a deadline. Counter-test: say you will decide tomorrow. Watch what happens to the tone.

What to do if it already happened

In this order.

1. Stop sending money. Including — especially — any fee presented as the way to release your funds. That fee is the second scam, and the people who pay it are on a list precisely because they already paid once.
2. Report it to IC3, the FBI’s Internet Crime Complaint Center. This is the report that feeds the trace. Include wallet addresses, transaction hashes, the platform’s web address, the phone numbers and the account names. Detail is what makes a report traceable rather than merely counted.
3. Tell the bank or the exchange you sent from, immediately. They may be able to act on their own side, and their records will matter later.
4. Keep everything. Screenshots, chat logs, receipts, transfer confirmations. If a petition for remission ever becomes possible, the rule requires documentary evidence — invoices and receipts — and that evidence has to already exist.
5. Do not hire anyone who contacts you offering to get the money back. Recovery-fee fraud is its own category, and its customer list is people who have just been defrauded.
6. Expect a queue, not a refund. The freeze may be fast. The rest is a legal process, and it moves at the speed of courts.

How not to be next

The single habit that defeats this entire industry costs nothing: never let the first contact choose the venue. If someone reaches you and steers you to a platform, an app or a wallet, the platform is theirs and everything you see there is theirs to draw.

The rest follows from that. Verify a firm through a regulator’s own site, typed in yourself, not through a link. Treat a withdrawal that requires a payment as final proof, not as a hurdle. And tell someone early — the reason 77 percent of the people the FBI called did not know they were being scammed is that these schemes are built to be invisible from inside them. Embarrassment is the scammer’s best remaining asset once the money is gone.

Watch the full documentary