MABOnChain
Educational content only. Nothing on this site is financial advice.
Home / Scam Alerts / Trump Says Nearly $1B in Scam-Linked Crypto Is Frozen as DOJ Goes Nationwide
Scam Alerts

Trump Says Nearly $1B in Scam-Linked Crypto Is Frozen as DOJ Goes Nationwide

By MABOnChain Desk · Published · Updated · 4 min read

Editorial digital-art illustration in the CoinTelegraph style: the United States justice system cracking down on overseas crypto scam networks, a large glowing golden justice shield and frozen cryptocurrency coins locked in ice in the foreground, dark fraudulent scam compound buildings being dismantled in the background, silhouetted federal investigators examining glowing on-chain evidence on large screens, deep navy night palette with gold and teal highlights, cinematic painterly lighting, dramatic 16:9 composition, no text.

Published October 22, 2026, 2:45 PM PKT. Based on the U.S. Department of Justice Scam Center Strike Force page (primary source), the Reuters report on the October 21, 2026 White House roundtable, and reporting by Unchained, TokenPost, and AMBCrypto on October 22, 2026 (secondary sources). This is the first MABOnChain article on the nationwide scam initiative announced at the roundtable, and it is distinct from MABOnChain's October 14, 2026 article on the Justice Department Joint Disruption Week operation in West Africa.

President Donald Trump said on October 21, 2026 that his administration had frozen nearly $1 billion in cryptocurrency tied to foreign scammers, using a White House roundtable on cybercrime to promote its push against overseas fraud rings that target Americans, according to Unchained and Reuters. Trump also said federal authorities had prevented at least $1.6 billion in losses this year and had shut down more than 500 fraudulent websites, according to a post from the White House Rapid Response account cited by Unchained. At the same event, he said federal law enforcement had warned more than 10,000 Americans targeted for victimization, Reuters reported.

The $938,460,156.82 restrained figure, and what restrained means

The verifiable number behind the rounded $1 billion claim is on the Justice Department's own page. The Scam Center Strike Force Crypto Seizure team has restrained $938,460,156.82 in cryptocurrency from these schemes, the page says, in a tally dated October 15, 2026, according to Unchained and TokenPost. Restrained is a legal status, not a refund. It means authorities have taken steps to hold the funds back from movement, and it is not the same as money paid back to victims, Unchained and TokenPost both note. Returning funds to victims is among the strike force's stated goals, TokenPost reports, and the Justice Department page says its Crypto Seizure team is focused on recovering stolen funds and returning them to victims. Unchained also notes that the White House post did not say where its nearly $1 billion figure came from, which is why this article treats $938,460,156.82 as the documented tally and the $1 billion as the president's rounded claim.

The strike force itself was formed in 2025, according to the Justice Department page, and combines the U.S. Attorney's Office for the District of Columbia with the Criminal Division, the FBI, and the U.S. Secret Service, with partners including the Internal Revenue Service Criminal Investigations, the U.S. Postal Inspection Service, and the Drug Enforcement Administration. Its focus is cryptocurrency-related fraud run out of Southeast Asia, the page says, and its teams investigate scam compounds in Cambodia, Laos, and Burma, including leaders described as Chinese organized crime affiliates. TokenPost reports that the strike force launched in November 2025, that federal actions tied to the campaign have included seizing 503 fake investment websites, and that, as of March 2026, its Operation Level Up had warned 8,935 potential victims, of whom 77 percent were unaware of the scam, with warnings estimated to have prevented $562,726,245 in losses. Those warning and website figures are separate measures from the cryptocurrency under restraint, TokenPost stresses, and they should not be added to the $938 million tally.

A nationwide initiative across all 94 U.S. Attorneys offices

The new development at the roundtable was the structure, not just the totals. Attorney General Todd Blanche said the Justice Department is no longer leaving these cases to individual U.S. Attorneys offices, Unchained reports. "Because of the magnitude of this issue, it demands a nationwide response," Blanche said in remarks the department shared on X, according to Unchained. He described a newly established cyber-enabled scam initiative, run by the Criminal Division, that deploys dozens of prosecutors across all 94 of those offices. In practical terms, that moves scam-center cases from a set of local files into a coordinated national docket, with prosecutors in every federal district able to work the same kind of case under the same initiative. The roundtable also carried the administration's broader framing: White House deputy chief of staff Stephen Miller said Trump had effectively declared cyber warfare against the cyber criminals, according to Unchained and Reuters.

That framing sits on an earlier order. Trump signed Executive Order 14390 on March 6, 2026, which told the attorney general to continue to prioritize prosecutions of people engaged in cyber-enabled fraud, including scam centers, Unchained reports. TokenPost adds that the order directs agencies to review tools against transnational cybercrime, prioritize prosecutions, prepare an action plan, and prepare a recommendation on restoring funds to victims with money seized or forfeited from perpetrators. Both the order and the strike force were in place before the October 21 meeting, TokenPost notes, so the roundtable was a showcase and an escalation of an existing apparatus, not the creation of the apparatus itself.

20 scam compounds dismantled, more than 500 websites shut down

FBI Director Kash Patel said at the roundtable that the bureau had dismantled 20 scam compounds around the world, according to Reuters and Unchained. The compounds are the physical side of the fraud: organized sites, largely in Southeast Asia, where workers run fake investment platforms, fraudulent websites, and online impersonation schemes aimed at Americans, according to AMBCrypto's account of the crackdown. The website figure is the digital side. Trump said authorities had shut down more than 500 fraudulent websites, and TokenPost puts the strike-force-linked website seizures at 503 fake investment websites. The two figures describe the same campaign from different angles, and the distinction matters for victims: a seized website stops new victims from landing on that page, but it does not by itself return money already sent.

The roundtable came less than two weeks before the November 3 midterm elections, with early voting already open in many states, Unchained notes, and Reuters framed the event as an anti-fraud message ahead of that vote. That political timing does not change the enforcement figures, but it explains why the administration chose a White House stage, with the president, the attorney general, the FBI director, Pentagon chief Pete Hegseth, and Homeland Security Secretary Markwayne Mullin present, according to Reuters and the pre-event reporting. Readers should weigh the claims accordingly: the restrained total is documented on a Justice Department page, the prevented-losses total is a presidential claim, and the nationwide initiative is a structural announcement whose results will show up in future prosecutions, not in the roundtable itself.

The scale behind the roundtable: 1 million complaints, $11.366 billion

The complaint figures explain why the administration is treating this as a national problem rather than a niche crypto problem. The FBI Internet Crime Complaint Center received more than 1 million internet-crime complaints in 2025, up about 17 percent from the 859,532 it logged in 2024, according to Unchained, citing the center's data. Within that total, the center counted 181,565 complaints involving cryptocurrency in calendar year 2025, with $11.366 billion in reported losses, up 22 percent from 2024, TokenPost reports. Those crypto-involved figures cover complaints with any cryptocurrency connection, TokenPost cautions, and do not isolate investment scams run through overseas scam centers, so the total is broader than the losses tied to the strike force's focus. AMBCrypto, citing DeFiLlama data, puts 2026 losses so far at $2.345 billion across 305 incidents, a different measure again, covering reported crypto losses in 2026 rather than FBI complaints. The three totals measure different things, and conflating them would overstate what the strike force has recovered.

What to watch next is also clear from the gaps in the roundtable itself. The first marker is victim restitution: how much of the $938,460,156.82 under restraint is actually returned, and to whom, since the Justice Department page lists returning funds as a goal but the roundtable gave no restitution total. The second is prosecutions filed under the new nationwide initiative, which will show whether dozens of prosecutors across 94 offices produce cases beyond the strike force's existing Southeast Asia work. The third is the website and compound counts: whether the 503 seized sites and 20 dismantled compounds are replaced as fast as they are taken down, which is the usual pattern in scam-center enforcement. The fourth is the prevented-losses claim: whether the $1.6 billion figure is ever broken down into warned victims, blocked transfers, and seized funds, or remains a single presidential total. Until those markers resolve, the accurate state of play is a documented $938.5 million restrained, a claimed $1.6 billion prevented, and a newly nationwide prosecutorial structure aimed at the scam centers behind both numbers.

This article is news reporting and is not investment advice.

Sources

Not financial advice. This content is for information and education only. See our disclaimer, editorial policy and disclosures.

MABOnChain Daily Brief

The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.

Loading the signup form…

Prefer chat? Join us on Telegram Watch on YouTube

Keep reading

DeFi

Aerodrome and Velodrome Merge Into Aero, a Spot Exchange Across Seven Chains

October 22, 2026 · 4 min read

Aerodrome and Velodrome have officially merged to launch Aero, an onchain spot exchange across Ethereum mainnet, Base, Robinhood Chain, Ink, OP Mainnet, Arc, and Arbitrum, according to a Wednesday statement reported by The Block on October 21, 2026. The seven networks together handle about $120 billion a month in decentralized exchange trading, the project said. Existing AERO tokens convert one for one into the new AERO, VELO converts at about 0.044 new AERO, and holders must migrate by hand through upgrade portals because nothing converts automatically.

Markets

NEAR Jumps 7% as Business Launch Targets Private Crypto Treasuries

October 21, 2026 · 4 min read

NEAR rose about 7% to $5.31 on October 21, 2026, a day after NEAR Protocol launched NEAR Business, a private treasury platform that lets teams pay staff and vendors, swap assets and allocate capital across more than 35 blockchains while keeping payroll and treasury balances confidential from the market but legible to auditors, according to NEAR and Stocktwits reporting. The move also landed as a House of Stake vote opened on cutting annual issuance from 2.5% to 1.6% over 24 months, and as NEAR Intents passed $32 billion in cumulative volume in the third quarter of 2026.

Web3

Solana Alpenglow Goes Live on Mainnet in Biggest Consensus Switch Since Launch

October 21, 2026 · 4 min read

Solana has activated Alpenglow, its first major consensus upgrade, on mainnet on October 21, 2026, replacing the TowerBFT voting system it has used since launch with a new protocol called Votor that targets transaction finality in about 150 milliseconds, down from roughly 12.8 seconds. CryptoBreaking, citing the Solana Foundation Alpenglow dashboard, put activation at about 1:54 pm UTC, in epoch 1064, while the dashboard reading at press time showed finality of about 6.6 seconds and throughput of about 4,721 transactions per second, a reminder that the 150 millisecond figure is a target to converge toward, not an instant day one measurement. The second Alpenglow phase, Rotor, which would replace the Turbine block propagation system, does not activate with Votor and remains unscheduled.

Markets

Standard Chartered Signs Definitive Deal to Take Full Ownership of Zodia Custody

October 21, 2026 · 4 min read

Standard Chartered has signed definitive agreements to acquire 100% of Zodia Custody, the institutional digital asset custodian it helped create, turning a takeover first agreed in principle in May into a binding deal. Standard Chartered I H Limited will acquire 100% of Zodia Custody UK Limited, the parent of Zodia's regulated operating entities in Singapore, Hong Kong, Australia, the United Arab Emirates and Luxembourg, subject to regulatory approvals and customary closing conditions, with financial terms undisclosed. After completion, Zodia's custody business joins the bank's Securities Services division, while its software and professional services assets move to Zodia Solutions, a new independent entity under SC Ventures backed by bank investors including Northern Trust, NAB Ventures, SBI Ventures and Emirates NBD.

Regulation

OCC Finalizes First GENIUS Act Stablecoin Rule, Sets January 18, 2027 Start Date

October 21, 2026 · 5 min read

The U.S. Office of the Comptroller of the Currency has issued the first final rule implementing the GENIUS Act, setting reserve, redemption and capital standards for payment stablecoin issuers under its jurisdiction, effective January 18, 2027. Issuers must hold reserves at least equal to their outstanding stablecoins and generally redeem within two business days, while the agency dropped a proposed presumption that affiliate rewards deals violate the law's yield ban, leaving existing rewards programs to case-by-case review. The rule covers national banks, federal savings associations, federal branches and nonbank firms seeking federal qualified issuer status, with a $5 million capital floor, while anti-money-laundering rules will follow in separate rulemaking with the Treasury.

DeFi

Aave Backs Tokenized SpaceX Shares as Collateral With Strict Guardrails Ahead of 2.43 Billion Share Unlock

October 21, 2026 · 5 min read

Aave risk adviser LlamaRisk has backed listing tokenized SpaceX shares, trading as SPCXc, as collateral on Aave V4's Equities Hub on Base, but only under the hub's toughest terms: a 55% collateral factor, a 6.5% maximum liquidation bonus, a 1,000 basis point risk premium and a 37,000 token supply cap worth about $5.8 million. The caution reflects SpaceX's four months of public trading history and a lock-up calendar that releases 2.43 billion shares, 84% of the current float, between October 26 and December 8, 2026. SPCXc would be collateral-only, with USDC the only borrowable asset, and larger liquidations would depend on redemptions or derivatives hedges because onchain depth is thin.

Scam Alerts

Drift Exploiter Sends Another $46M in ETH to Tornado Cash, Two-Day Total Hits $109M

October 21, 2026 · 4 min read

Wallets linked to the April 2026 Drift Protocol exploit sent about 18,800 ETH, worth roughly $46 million, into Tornado Cash on October 21, 2026, according to blockchain tracker Onchain Lens, taking the two-day total to 44,510 ETH, worth about $109 million. The move follows the roughly $61 million first tranche on October 20 that MABOnChain reported, and Arkham Intelligence labeled wallets still held about 56,569 ETH, worth roughly $138 million, after the latest deposits. Drift has attributed the April attack, which cost about $295 million, to a North Korean threat group, and victims are claiming through a DFX recovery token scheme that started with a pool of about $3.1 million.

Regulation

France Proposes MiCA Rules to Hold Crypto Platforms Liable for DeFi Access Failures

October 21, 2026 · 4 min read

France's Treasury, AMF, Banque de France and ACPR published a joint response on October 21, 2026 to the European Commission's MiCA review consultation, proposing that crypto platforms which actively connect customers to DeFi protocols should face liability for certain client losses when they fail to vet protocols or ignore known risks. The proposal would also move supervision of significant crypto firms to ESMA, lower the 15 million daily active user threshold for significant status, and rework MiCA's stablecoin categories after zero asset-referenced tokens were authorized. The Commission's report to EU lawmakers is due by June 30, 2027.

Regulation

UK High Court Lets 16,000 Victims Appeal Ruling on 61,000 Seized Bitcoin in Qian Zhimin Case

October 21, 2026 · 4 min read

The UK High Court has granted about 16,000 Chinese fraud victims permission to appeal its October 12, 2026 ruling that Chinese law governs property claims over more than 61,000 Bitcoin seized in the Qian Zhimin money laundering case, according to PANews reporting on October 21 that cited Caixin. The appeal keeps alive the victims' bid to claim a share of a stash worth about 3.8 billion pounds, after the original ruling said their claims must be tested under Chinese law rather than English property law. Lawyers at the follow-up hearing also discussed litigation costs from the earlier dispute and how individual applicants can continue or withdraw their claims.

Markets

Ether ETFs Pass $1.08B in October Outflows, Biggest Monthly Drain of 2026

October 21, 2026 · 4 min read

U.S. spot Ether ETFs have shed $1.08 billion so far in October 2026, the biggest monthly outflow of the year and the largest since November 2025, after Tuesday added $26 million to the drain, according to SoSoValue data reported by Cointelegraph. The withdrawals have erased September's $832 million in net inflows and left year to date net inflows at about $485 million, while Ether has fallen 9.7% in October to $2,438. Bitcoin funds moved the other way at the start of the week, pulling in $527 million on Monday before adding $23 million on Tuesday.

Scam Alerts

Fake Ngrave Security Alerts Drain $2.56M From 70 Wallets

October 21, 2026 · 4 min read

Belgian hardware wallet maker NGRAVE disclosed on October 19, 2026 that attackers hijacked a third party push notification provider for its LIQUID companion app and sent fake security alerts to users on October 17, tricking them into entering recovery phrases on a counterfeit website and draining about $2.56 million from 70 wallets across four blockchains. Bitcoin accounted for $1.77 million of the losses, followed by $454,000 in XRP, $316,000 in Ethereum based assets and $18,000 in Stellar. NGRAVE says its ZERO hardware wallets were never compromised, and its chief executive admitted the company had absolutely and utterly failed in its most basic security duty.

Markets

Zcash Jumps 10% as NU7 Locks In Mainnet Activation for 25-Second Blocks

October 21, 2026 · 4 min read

Zcash jumped about 10% on October 21, 2026, trading near $1,260, after developers set the mainnet activation height for NU7, the network upgrade that cuts Zcash block times from 75 seconds to 25 seconds. The activation height is the block number at which every node switches to the new rules, and NU7 pairs the threefold speedup with a Network Sustainability Mechanism that routes 60% of each block's transaction fees into a reserve paid back out over time. ZEC has gained roughly 45% in the past week and about 138% over 30 days, pushing its market capitalization back above $20 billion for the first time since 2016.

Scam Alerts

Qubic Restarts Blockchain and Opens Recovery Claims After $1.4M Wallet-Seed Hack

October 21, 2026 · 4 min read

Qubic has restarted its blockchain and opened a recovery-claims platform after a wallet-seed vulnerability drained about $1.4 million in QU tokens from 1,404 accounts, the project said in its latest update. The network resumed processing ticks at 8:00 pm on October 19, advancing past tick 85,371,949 where it was halted on Sunday, October 18, after the project’s Computor validators approved a recovery plan and the first batch of recovered funds was returned to verified owners. Qubic says 87.1% of the stolen tokens stayed immobilized on the paused network while 12.9% went to MEXC, which froze the receiving account, and it warns that any wallet created with its web wallet before version 4.26.4, released October 19, should be treated as insecure. Affected users have until May 1, 2027 to submit claims through the project’s sole official reclaim site.

Markets

CME Logs First Trades in Bitcoin Cash and Uniswap Futures With FalconX-GSR Debut Block Trade

October 21, 2026 · 4 min read

CME Group confirmed on October 20, 2026 that FalconX and GSR executed the first block trade in its new Bitcoin Cash and Uniswap futures, with trading now underway on the world's largest derivatives venue. The launch extends CME's single-asset crypto futures lineup to 11 tokens and makes UNI the first DeFi protocol token with standalone CME futures, in standard 10,000-UNI and micro 1,000-UNI sizes trading 24 hours a day. CME's crypto futures and options business has averaged more than 242,000 contracts a day in 2026, about $7.9 billion in notional value, with its five earlier altcoin futures this year adding nearly $2 billion in year-to-date notional.

Markets

SkyAI Sells Entire Solana Treasury, Launches $201.3M Tender Offer

October 21, 2026 · 5 min read

SkyAI, the Nasdaq-listed company formerly known as Sharps Technology, has sold its entire Solana treasury and launched a $201.3 million cash tender offer to repurchase up to 95% of its shares and warrants, according to an October 19, 2026 SEC filing. The company held $223.8 million in cash and zero SOL as of October 16, reversing a strategy that at its peak held more than 2 million SOL bought for over $400 million. The $3-per-share offer expires October 29, but major shareholder Bastion Trading, with about 9.99% of the stock, is refusing to participate and wants at least $3.50 plus an independent review of the SOL sales.

Regulation

Ireland Moves Another 500 BTC From Clifton Collins' Seized Wallets to Coinbase Prime

October 20, 2026 · 4 min read

A wallet linked to convicted Irish drug trafficker Clifton Collins moved 500 BTC, worth about $41.5 million, to Coinbase Prime on October 20, 2026, the fifth 500-BTC tranche recovered from his long-thought-lost Bitcoin fortune this year. Blockchain intelligence firm Arkham Intelligence flagged the transfer; about 2,500 BTC have now moved from the wallets in 2026, while roughly 3,500 BTC worth about $290 million remain. Collins bought about 6,000 BTC in 2011 and 2012 at roughly $5 each, printed the private keys on paper and hid them in a fishing rod case, and lost access in 2017. Ireland's Criminal Assets Bureau, with help from Europol's European Cybercrime Centre, began opening the wallets in March 2026.

Markets

Stablecoin Transfers Quadruple to $891B in Q3 as U.S. Banks Test the Rails, Coinbase Study Finds

October 21, 2026 · 4 min read

Research conducted for Coinbase by The Block Pro Research found that adjusted stablecoin transfer volume hit $891 billion in the third quarter of 2026, more than four times the level of early 2023, with over $400 million moving per hour and 73% of volume settling outside U.S. banking hours. The study, titled The Always-On Dollar, says seven of the ten largest U.S. banks have tested stablecoins or tokenized deposits for settlement, with the remaining three announcing plans to do so, while 293 million blockchain addresses now hold stablecoins, more than the combined card bases of American Express and Discover.

Scam Alerts

ZachXBT Says 87% of FreedomXMR Inflows on Hyperliquid Are Illicit Funds

October 20, 2026 · 4 min read

Blockchain investigator ZachXBT said on October 20, 2026 that more than 87% of the funds flowing into FreedomXMR, a centralized exchange service on Hyperliquid Core, are tied to illicit activity, according to reporting by crypto.news and PANews based on his published investigation. ZachXBT traced more than $20 million in inflows above a $10,000 review threshold to ransomware payments, cryptocurrency exploits, malware and social engineering attacks, including the September 2026 incidents at DCENT Wallet, Fetch.ai and Axelar, plus an October exploit on the Gamdom gambling platform. He also alleged the service's operator sourced Monero liquidity through KuCoin, identifying more than 3,000 deposits from associated addresses.