They Scammed Crypto Fraud Victims a Second Time. The DOJ Took $25M Back
The DOJ filed five forfeiture cases in July 2026 covering more than 670 victim transactions, romance scams, and a particularly cruel variant: fraudsters posing as recovery experts who steal from people a second time after their crypto is already gone.
On July 21, 2026, the U.S. Attorney's Office for the District of Columbia filed five civil forfeiture complaints seeking more than $25 million in cryptocurrency. The cases, worked by the Secret Service's Washington Field Office through its Cyber Fraud Task Force, covered romance scams and international investment fraud. One of the five documented something colder than the rest: a fee-based recovery scheme, where the fraudsters posed as the people who could get a victim's stolen crypto back, then took a payment from them and vanished a second time.
Across all five investigations, prosecutors identified more than 670 suspected victim transactions. The romance and investment cases followed a familiar shape: a target is manipulated over weeks or months into believing they're in a real relationship or a legitimate opportunity, gradually persuaded to move money into what they're told are crypto investments, and cut off the moment they try to withdraw. In one case, a victim in the National Capital Region reported the fraud in May 2026 after the operators cut contact the moment withdrawal was requested; investigators traced the funds across multiple addresses to build the forfeiture claim. In another, reported in March 2026, a victim transferred millions of dollars into what they believed was a legitimate account, a second victim tied to the same platform surfaced during the investigation, and a portion of the funds was traced to six frozen cryptocurrency addresses.
The recovery scam is the sharper story because of who it targets: people who already know they've been defrauded. Someone who has lost money to a fake investment platform is actively looking for a way to get it back, which makes them a specific and reliable target for a second scam offering exactly that. The forfeiture complaint for this case sought approximately $285,000, the smallest of the five, but the mechanism is the part worth remembering. Every dollar of it came from a victim who had already been through this once and trusted the wrong person to help them out of it.
The laundering networks behind the other cases traced back to Southeast Asia, with IP addresses pointing to China, Malaysia, and Cambodia, consistent with the region's well-documented scam compound infrastructure. That regional pattern shows up at scale elsewhere too: Interpol's First Light 2026 operation, running from January through April, identified more than 142,000 victims globally, led to 5,811 arrests, and blocked 31,000 bank accounts, including a Thai network in which a single suspect's wallet had processed more than $122.5 million over ten months.
This is one action inside a much bigger operation. The Scam Center Strike Force, launched by U.S. Attorney Jeanine Ferris Pirro in November 2025, has now recovered more than $800 million total. Pirro's own framing was direct: investigators "cut through complex laundering schemes, protected victims, and shut down criminal pipelines." The $25 million in this batch is a small fraction of that total, but it's a useful snapshot of what the pipeline actually looks like at the victim level: romance, fake investment platforms, and now a second wave of scammers positioned to profit from the first wave's damage.
Recovery scams work because they exploit something real: most people who lose crypto to fraud have almost no legitimate path to get it back, and they know it. Legitimate recovery, when it happens at all, comes from law enforcement action like this one, not from a stranger who reaches out promising results for an upfront fee. Anyone offering to recover already-stolen crypto for a payment in advance is running the same scheme this forfeiture case just described.
The Aftermath
The five forfeiture complaints remain in civil court, seeking formal seizure of the traced funds on behalf of victims. The Scam Center Strike Force continues operating, with the DOJ signaling more forfeiture actions are likely as the $800 million total recovered since November 2025 continues to grow. No individual defendants were named in the July 21 filings, which target the funds themselves rather than specific suspects.
COMMENTS