US Treasury's $10B scam warning shows why crypto is racing to police itself

On June 23, the US Treasury sanctioned nine individuals and 26 entities tied to the Prince Group, a Southeast Asian scam network that cost Americans at least $10 billion in 2024. The same day, the DeFi Education Fund, Security Alliance (SEAL), and Asymmetric Research launched OPSeC, a coalition pledging to harden crypto protocols against the operational attacks that have drained hundreds of millions this year.

Treasury described digital asset investment fraud as one of the most common and lucrative schemes run by these operations. FinCEN called Huione Group a key node for laundering proceeds from cyber heists and virtual currency investment scams. The two actions converge on a single point: the infrastructure that enables DeFi exploits and the infrastructure that enables scam payouts are increasingly the same set of rails.

April 2026 made the argument for a coalition like OPSeC hard to ignore. Nearly $630 million drained across at least 27 reported DeFi exploits, led by the $285 million Drift Protocol hack and the $292 million KelpDAO breach. TRM Labs attributed roughly $577 million in stolen crypto through April to North Korean hackers, 76% of all global hack losses in that period. The Drift hack grew out of a six-month social engineering operation that took 12 minutes to execute. Attackers attended crypto conferences in person, built relationships with contributors, and manipulated Security Council members into pre-signing hidden authorizations. A zero-time-lock governance migration three days before the drain eliminated the last intervention window.

OpenZeppelin’s own analysis argues that recent losses increasingly originate in the operational layers around protocols: signing infrastructure, governance, cross-chain dependencies, and human controls. Code audits never reached those layers. SEAL’s certification framework, launched in 2026, evaluates whether a protocol can defend itself, detect incidents, and respond. It covers multisig operations, treasury management, incident response, DNS security, DevOps infrastructure, and identity controls. OPSeC’s policy function provides a venue for those standards to become legible to legislators rather than remain internal industry infrastructure.

Two Readings of DeFi’s Defensibility

On May 26, Manuel Aráoz, co-founder and former CTO of OpenZeppelin, declared that he considers all of DeFi unsafe. He cited AI coding agents that are “superhuman at finding vulnerabilities” and advised friends and family to exit positions in Aave, MakerDAO, and Compound. Defenders must close every exploitable flaw, he argued, while attackers need only one. AI agents run vulnerability searches in parallel, around the clock, across thousands of contracts simultaneously.

OpenZeppelin’s current CEO, Demian Brener, publicly distanced the company from Aráoz’s exit thesis. He framed AI as a defensive capability alongside an offensive one and reaffirmed the firm’s commitment to continuous, AI-augmented security. OpenZeppelin’s own analysis similarly argues that the most significant losses of the past two years originated in operational layers, not contract code. AI agents are nonetheless moving the remaining technical attack surface toward attackers. Aráoz’s directional read holds even if his conclusion overstates it.

OPSeC’s value over the next twelve months will be determined by whether its certification bar gets enforced. The bull case: protocols that demonstrate operational discipline through phishing-resistant signer controls, time-locked governance, 24/7 incident monitoring, and DNS registry locks trade at a lower risk discount. Capital follows attestation, and the standard becomes self-enforcing because it becomes economically meaningful. The bear case: a fresh nine-figure signer exploit lands before OPSeC produces measurable compliance data. Policymakers treat the coalition as pledge language, and the illicit-finance legislative debate hardens around the worst-case assumptions Treasury’s June 23 action put back on the table.

Treasury has stated that it will continue to take aggressive steps against illicit abuse in the digital asset industry. OPSeC’s window to answer with evidence is open, and it has a closing time.

US Treasury's $10B scam warning shows why crypto is racing to police itself

Two Readings of DeFi’s Defensibility

Explore More

More from AlphaScala

Trading Q&A

Related Tools & Research

Asset Profiles