U.S. authorities seized over $25 million in crypto tied to romance scams and investment fraud, filing five civil forfeiture complaints. The move signals rising enforcement pressure on laundering networks.
U.S. authorities seized more than $25 million in cryptocurrency tied to cross-border fraud networks that targeted victims in the U.S. and Canada, the U.S. Attorney's Office for the District of Columbia said July 21. The seizures came through the Secret Service's Cyber Fraud Task Force, and prosecutors have filed five civil forfeiture complaints to permanently confiscate the assets.
The largest case involved a romance scam that affected more than 200 victims, with losses of roughly $12.1 million, officials said. A second case, worth about $10.4 million, stemmed from a network of suspicious wallets flagged by Canadian authorities and shared with the Secret Service. Investigators identified more than 270 suspicious transactions tied to fraudulent investment platforms. The two main cases account for about 85% of the total assets targeted for forfeiture.
The remaining cases involved withdrawal restrictions, fake investment accounts, and tracing of stolen proceeds. Several key money launderers were based in Southeast Asia, investigators said. They observed internet addresses linked to China, Malaysia, and Cambodia – an operational footprint consistent with industrialized scam operations that rely on layered laundering routes across jurisdictions.
The forfeiture actions signal that law enforcement is using civil asset recovery as a primary tool to claw back crypto proceeds, increasing operational risk for laundering networks and intermediaries that handle suspicious flows.
While enforcement moves against fraud networks, institutional players are pushing deeper into digital asset infrastructure. South Korea's Mirae Asset Consulting secured management control of Korbit, one of the country's early exchanges, in a deal valued at about 141.4 billion won. The Fair Trade Commission approved the transaction July 9, citing Korbit's estimated 0.5% share of the domestic crypto trading market. Korbit plans to rebrand as DigitalX and pivot toward a digital asset infrastructure platform, maintaining its operating entity and client deposits. The firm said customer assets will continue to be segregated.
Mirae Asset founder Hyeon-joo Park framed DigitalX as a key pillar of the group's "Mirae Asset 3.0" initiative, with an ambition to connect tokenized real-world assets, security tokens, stablecoins, traditional securities, and digital assets on one platform. The company said the objective is not to outcompete Korea's dominant venues by spot volume, but to combine its securities and asset-management capabilities with Korbit's operational experience.
In DeFi, Uniswap introduced "permissioned pools" built on Uniswap v4, aiming to make regulated on-chain markets more feasible for tokenized securities, funds, and equities. The protocol integrates allowlist verification into automated market maker trading. Superstate, Securitize, and Daugo were named as launch partners. Standard permissionless pools on Uniswap v4 will continue unchanged, the company said.
Russia's largest bank, Sberbank, is also preparing to expand into regulated digital asset services. The lender is developing cryptocurrency trading and digital custody infrastructure targeted at regulated financial institutions, with plans to launch by Dec. 1, according to local reporting. Russia's updated rules governing trading, custody, and payments involving crypto assets take effect Sept. 1, while licensing requirements for intermediaries apply beginning July 2027. Public crypto trading in Russia will restrict assets to those meeting liquidity and market-cap thresholds. Using crypto for domestic payments remains prohibited.
On-chain analyst "Vijinn" reported that the attacker behind the AFX Trade exploit swapped 12,467.4 Ether for Bitcoin. AFX Trade's Arbitrum cross-chain bridge was hacked July 23, resulting in about $24 million in losses, largely in USD Coin. The attacker bridged funds from Arbitrum back to Ethereum in stages before conducting the exchange.
The FBI is investigating a separate malware campaign involving eight downloadable games that infected roughly 8,000 devices and enabled access to about 80 cryptocurrency wallets, with at least $220,000 in digital assets stolen. Court documents allege the activity ran from May 2024 to February 2026. A North Lauderdale, Florida resident, Zaire Dontavius Jamarion Wilkins, 21, financed and promoted the malware operation, investigators said. Victims who installed the games had passwords, wallet authentication data, and browser information harvested. Promotion was conducted via Discord, Telegram, X, and LinkedIn, supported by bots used to locate crypto holders. Wilkins faces a conspiracy charge carrying a maximum sentence of 10 years.
Broader concerns about state-linked theft resurfaced after Chainalysis CEO Michael Gronager said on CNBC that North Korea has been actively stealing Bitcoin to fund nuclear weapons development.
Euler (EUL) spiked more than 100% intraday to as high as $2.73 after Upbit announced a listing in its Korean won market, before easing to around $2.30. The move illustrates how top-tier exchange listings can still drive abrupt liquidity inflow and volatility in mid-cap tokens.
DeFi aggregator Odos said it will shut down all services July 30, with its app shifting into read-only mode starting July 27. Users can view balances and transaction history but cannot initiate new trades. Odos said it has never directly custodyed user funds. Assets held in external wallets such as MetaMask, Rabby, or hardware wallets remain controlled by users' private keys. However, users who created Odos wallets through Google, Apple, or email login were urged to export their private keys or move assets to self-custody wallets before the cutoff.
Odos, which spun out of Semiotic Labs in 2022, said it has routed more than $104 billion in volume across about 15 networks. The company noted a sharp contraction in activity, from about $7.85 billion in monthly volume in December 2024 to a few hundred million dollars by mid-2026. The ODOS token will continue to exist independently of the product shutdown, the company said, describing the Odos DAO and the operating company as separate entities. It warned users to ignore scam communications claiming token migrations or airdrops.
Liquid staking provider Lido said it is investigating a discrepancy found during a recalculation of stETH yield. Lido developers observed an anomaly in the rebase accounting reported by the protocol's oracle: the annualized yield was computed at 2.04% versus an expected 2.15%. Lido attributed the mismatch to 32 ETH from a validator deposit awaiting confirmation that was not reflected in oracle statistics. The missing amount will be incorporated in the next recalculation after a fix is applied. Lido stressed there is no user fund risk and the issue is not related to validator slashing.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.