Binance Hack Probe: Who Can Recover Billions in Frozen Crypto Across Borders?

Introduction

The Binance hack investigation of October 29, 2026, has raised a fundamental legal question: who can recover billions of dollars in cryptocurrency frozen across national borders? Reuters reported that Tether and Circle had immobilized more than $2.38 billion in stablecoins following suspicious transfers from Binance-linked wallets. Yet the authority to freeze cryptocurrency is different from the authority to seize, confiscate, or return it. Stablecoin issuers can restrict certain tokens through their technical and contractual arrangements, while compulsory asset recovery generally requires competent national authorities, applicable legal procedures, and a determination of who is entitled to the property (Reuters, October 29, 2026).

Binance acknowledged a potential security incident and announced an investigation without conclusively establishing the cause or total financial losses. The reported intervention by Tether and Circle was significant because issuer-controlled restrictions can prevent further transfers of specified stablecoins. Such restrictions do not establish that the assets have been recovered by law enforcement or returned to Binance.

The jurisdictional questions extend across several legal systems. Binance operates through entities regulated in the Abu Dhabi Global Market, Tether International is incorporated in El Salvador while retaining British Virgin Islands contractual governing-law provisions, and Circle maintains American, European, and other issuing arrangements. Potential claimants may reside elsewhere. International law governs aspects of jurisdiction and cooperation between states, but the ultimate distribution of recovered cryptocurrency ordinarily depends on domestic criminal law, property rights, contractual obligations, and judicial procedures.

1. What the Binance Hack Investigation Actually Shows

The suspected incident emerged on October 29, when blockchain investigators identified substantial cryptocurrency transfers from wallets associated with Binance. The activity attracted attention because the amounts involved were exceptionally large and some transfers appeared to involve previously unidentified recipient addresses. Investigators and market participants raised concerns about unauthorized access to exchange-controlled funds.

Binance co-founder Yi He acknowledged reports of a possible security issue and stated that the exchange was investigating. Binance also maintained that user funds were safe, while former chief executive Changpeng Zhao expressed confidence that customers would be protected. These assurances represented the company's public position during an evolving investigation, rather than a completed forensic assessment (The Block, October 29, 2026).

The initial reports combined blockchain observations, statements from companies responding to the incident, and estimates supplied by security researchers. They did not establish a final accounting of the suspected losses. That distinction is necessary because the value of cryptocurrency moving between addresses may differ considerably from the amount ultimately proven to have been stolen.

1.1 Suspicious Transfers and Conflicting Loss Estimates

Blockchain security company Blockaid reported investigating approximately $3.3 billion in suspicious outflows from Binance-associated hot wallets across Ethereum, Arbitrum, and Avalanche. The Block separately described approximately $3.55 billion entering an initially unidentified wallet, with nearly $900 million subsequently moving to other addresses. Coinbase executive Conor Grogan suggested that the amount implicated could reach $5.8 billion (The Block, October 29, 2026).

These figures measure different aspects of the reported activity. An estimate of suspicious outflows concerns transfers leaving identified wallets, while the balance attributed to a suspected recipient may reflect a different collection of transactions. Subsequent movements can also be counted when analysts aggregate activity across several addresses. Without a common transaction set and valuation method, the estimates cannot establish a definitive theft total.

A technical reconstruction published during the investigation suggested possible abuse of Ethereum Improvement Proposal 7702, which permits externally owned accounts to delegate execution to smart contract code. Blockchain researcher Odysseas Lamtzidis, associated with Phylax Systems, reported that a signed delegation preceded substantial transfers from a Binance-labeled wallet. Investigators also described activity involving an address reportedly funded through Tornado Cash (Decrypt, October 29, 2026).

Those observations provide a possible account of the transaction mechanism, not proof of how the relevant authorization was obtained. Compromised signing authority, a malicious authorization signature, or another operational failure could produce different legal and forensic implications. The reported Tornado Cash connection likewise does not identify the perpetrators or establish their nationality.

1.2 How Much Cryptocurrency Was Actually Frozen?

Tether reported freezing approximately 1.567 billion USDT associated with the suspected incident. Circle reportedly immobilized more than $800 million in USDC. Reuters placed their combined intervention above $2.38 billion, based on the information available during the October 29 investigation (Reuters, October 29, 2026).

Binance co-founder Yi He also stated that Ripple had frozen approximately $200 million. Reuters reported that statement but did not independently establish the token composition, affected addresses, or precise mechanism of the additional intervention. It would be premature to combine the reported Ripple amount with the Tether and Circle figures as though all three represented independently audited recoveries.

The reported freezes covered stablecoins subject to issuer-controlled restrictions. Other assets implicated in suspicious transfers, including Ether and various tokens, may require entirely different recovery methods. The total value of cryptocurrency associated with an investigation cannot be used to determine how much remains accessible to suspected offenders or how much can eventually be restored to lawful owners.

At the October 29 reporting cutoff, the central findings concerned suspicious transfers, an ongoing Binance investigation, and substantial stablecoin restrictions. The available public record did not establish a final loss figure, a comprehensive ownership determination, or completed restitution to Binance or its customers.

2. Who Can Freeze or Return the Cryptocurrency?

Several institutions may exercise authority over cryptocurrency implicated in a suspected theft, but their powers arise from different legal relationships. Stablecoin issuers can restrict transfers through administrative functions within their token contracts. Exchanges may suspend withdrawals or restrict assets they hold in custody. National authorities can investigate suspected offenses and, where the law permits, obtain orders to preserve or seize identifiable property.

The legal process may involve several distinct operations. Blockchain tracing identifies transactions and addresses without changing control of the assets. Issuer blocklisting prevents certain token movements, while judicial seizure places property under legally authorized control. Forfeiture or confiscation may subsequently alter ownership, and restitution determines whether and how the property is returned to a legally entitled claimant.

The distinction also concerns enforcement jurisdiction in international law. A state may possess criminal jurisdiction over an offense without having authority to exercise coercive powers within another state's territory. Compelling a foreign entity to surrender assets may require cooperation, recognition of a legal order, or another valid jurisdictional basis. No international institution automatically acquires the power to distribute cryptocurrency because transactions have crossed national borders.

2.1 Tether's Authority to Freeze USDT

Tether issues USDT through token contracts that support administrative restrictions on applicable blockchain networks. Its Token Terms of Sale and Service, updated February 26, 2026, reserve powers to suspend services, restrict wallets, and freeze tokens in circumstances involving legal requirements, contractual violations, or decisions the company considers necessary under its stated policies (Tether, 2026).

These powers must be distinguished according to their legal basis. A freeze imposed pursuant to a binding court order differs from voluntary cooperation with investigators or a restriction justified under contractual provisions. Tether's technical ability to immobilize tokens does not independently establish a governmental power of confiscation.

The company's terms also address rights concerning tokens and other property held through its services. However, provisions governing direct customers do not necessarily establish identical obligations for every person holding USDT acquired on a secondary market. Whether a particular contractual provision binds an affected holder requires examination of the relevant relationship and applicable law.

Freezing USDT ordinarily prevents specified token movements while the restriction remains effective. Subsequent cancellation, reissuance, or transfer of economic value may involve additional technical arrangements and legal authority. Tether's participation in an investigation does not establish that Binance automatically owns the frozen tokens or that an investigator may distribute them without determining the rights of affected parties.

2.2 Circle's USDC Freeze and Legal Obligations

Circle's Stablecoin Access Denial Policy permits address blocklisting in specified circumstances. Its published explanation identifies compliance with applicable law, valid orders from competent authorities, certain urgent government requests, and threats to the security or integrity of its stablecoin network as possible grounds for intervention (Circle, Understand Circle's Stablecoin Blocklisting Process, 2026).

Blocklisting prevents a designated address from sending or receiving USDC under the relevant implementation. Circle expressly distinguishes this operation from reversing a completed transaction. An earlier transfer remains recorded on the blockchain even if the recipient address is subsequently restricted.

Circle's USDC Terms, updated October 15, 2026, distinguish holders with Circle Mint accounts from holders who possess USDC without such accounts. The terms designate the first category as User Type A and the second as User Type B. Circle states that its terms apply to both categories outside the European Economic Area, although certain services and obligations are expressly limited to account holders.

This distinction has consequences for recovery. Under Circle's published terms, direct redemption of USDC for U.S. dollars ordinarily requires an eligible Circle Mint account in good standing. A User Type B holder cannot simply demand direct redemption without satisfying the conditions for establishing that relationship. Restrictions arising from applicable law or proceedings may create additional obstacles.

A reported Circle freeze does not establish which legal ground justified every restricted address. Nor does a company's published policy determine the outcome of a contested ownership claim. The circumstances authorizing the restriction, the identity of the holder, and any applicable governmental order remain relevant to its duration and eventual release.

2.3 Why Ether and Bitcoin Require Different Recovery Methods

Bitcoin and native Ether lack a centralized issuing company with a general administrative function capable of freezing selected address balances. Transactions confirmed under their respective blockchain rules cannot ordinarily be reversed by an issuer or exchange acting independently of the relevant network.

Recovery may nevertheless occur when investigators obtain lawful control over assets or their custodians. A court-authorized seizure may involve private keys recovered during an investigation, cryptocurrency held through a regulated intermediary, or cooperation from an exchange controlling the relevant account. These methods depend on gaining control over the assets rather than changing the underlying blockchain's transaction history.

The technical characteristics of a token can alter the available remedies. Native Ether differs from an ERC-20 stablecoin, while wrapped or bridged representations of cryptocurrency may depend on additional smart contracts or custodial arrangements. Some token administrators possess powers to restrict transfers that do not exist for the underlying native asset.

Consequently, the composition of the suspected Binance losses affects recoverability. Large USDT and USDC balances may be immobilized through issuer intervention, while Ether held in a wallet controlled by an unidentified suspect may require possession of signing credentials or cooperation from an intermediary. These differences prevent a reliable recovery estimate based solely on the reported total of frozen stablecoins.

3. Jurisdiction Over Binance, Tether, and Circle

A suspected cryptocurrency theft can involve several legal systems simultaneously. The conduct may originate in one jurisdiction, affect accounts administered elsewhere, and involve assets issued by companies incorporated or regulated in different countries. Customers may also reside in states with separate rules concerning financial services, criminal offenses, and property rights.

The principles of jurisdiction in international law distinguish a state's authority to prescribe laws, adjudicate legal disputes, and enforce compulsory measures. Territorial conduct, nationality, corporate relationships, and other recognized connections may support different forms of jurisdiction. Establishing one connection does not conclusively resolve the others.

Jurisdiction over a digital asset also requires attention to the persons and institutions controlling it. Corporate incorporation, contractual governing law, regulated custody, and the location of relevant operations may point toward different legal systems. No universally accepted rule makes the location of blockchain infrastructure decisive for every proprietary or enforcement dispute.

3.1 Binance's Abu Dhabi Regulatory and Custody Structure

Binance announced in December 2025 that its global platform would transition to an Abu Dhabi Global Market regulatory structure. The arrangement became effective on January 5, 2026, with three entities operating under the supervision of the Financial Services Regulatory Authority: Nest Exchange Limited, Nest Clearing and Custody Limited, and Nest Trading Limited (Binance, December 8, 2025; Binance, January 2026).

The entities perform different functions. Nest Exchange Limited provides regulated exchange-related services, Nest Clearing and Custody Limited undertakes clearing and custody activities, and Nest Trading Limited provides designated trading and related services outside the principal exchange arrangements. Their distinct roles are relevant when identifying the legal entity responsible for a particular transaction or custodial relationship.

Under Binance's published transition arrangements, Nest Clearing and Custody Limited ordinarily provides custody of user digital assets. Certain exceptions were retained, including specified assets frozen pursuant to earlier official orders and assets associated with particular restricted Canadian customer accounts. The company also described the transfer of existing contractual rights and obligations to the relevant regulated entities.

These arrangements establish an identifiable regulatory and contractual structure. They do not establish which entity legally owned the wallets implicated on October 29, whether those wallets held customer or proprietary assets, or which entity exercised operational control over the affected signing credentials.

The distinction could become decisive in civil litigation or regulatory proceedings. A claim involving an exchange's proprietary treasury may be legally different from a claim concerning assets held for customers by a regulated custodian. Abu Dhabi supervision creates substantial jurisdictional connections, but it does not exclude legitimate foreign investigations or establish exclusive jurisdiction over every affected claimant.

3.2 Tether's Salvadoran Incorporation and BVI Law

Tether International Limited redomiciled from the British Virgin Islands to El Salvador and became Tether International, S.A. de C.V. The company's published token terms identify the corporate transition and the relevant contractual arrangements (Tether, Token Terms of Sale and Service, February 26, 2026).

Tether's terms nevertheless designate British Virgin Islands law as the governing law of specified contractual relationships. The terms also contain dispute-resolution provisions governing disagreements arising from use of the company's services. These provisions create legally significant connections with the British Virgin Islands despite Tether's Salvadoran incorporation.

Corporate domicile and contractual governing law perform different functions. Salvadoran law may govern matters arising from the company's corporate and regulatory status, while the selected BVI law may apply to covered contractual disputes. Neither connection necessarily controls a criminal proceeding brought in another jurisdiction.

A foreign investigator seeking Tether's cooperation must also consider the legal character of the requested action. Voluntary assistance under applicable compliance policies differs from compulsory production of records or seizure pursuant to a legally binding order. Foreign decisions may require recognition, local legal procedures, or cooperation between authorities before enforcement can occur.

Proprietary disputes concerning USDT introduce another level of analysis. The law governing a contractual redemption right may differ from the law applied to a contested ownership claim over tokens held outside Tether's direct custody. The applicable rules depend on the claim, the parties, and the forum considering the dispute.

3.3 Circle's U.S. and European Legal Obligations

Circle's international arrangements distinguish its American issuer, Circle Internet Financial, LLC, from Circle Internet Financial Europe SAS. Circle's published terms identify a dual-issuer arrangement for USDC, with separate documentation governing holders and services in the European Economic Area.

The French entity is authorized as an electronic money institution by the Autorité de contrôle prudentiel et de résolution. It also holds authorization from the Autorité des marchés financiers to provide specified crypto-asset services under the European Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. The additional authorization was granted on April 24, 2026 (Circle, EEA Terms of Use, July 7, 2026; Circle, Licenses, September 8, 2026).

These arrangements are relevant because European rules governing electronic money tokens and regulated service providers differ from the contractual and regulatory provisions applicable to Circle's American operations. Circle's European documentation addresses issuance, custody, transfers, and redemption under the applicable MiCA and French regulatory requirements.

For holders outside the EEA, Circle's October 15, 2026, USDC Terms generally designate Delaware law and applicable U.S. federal law. However, Section 34 establishes special provisions for Singapore customers. Those customers contract with Circle Internet Singapore Pte. Ltd., and the Singapore-specific version of Section 31 designates Singapore law. The applicable contractual counterparty and governing law consequently depend in part on the holder's jurisdiction and the relevant terms (Circle, USDC Terms, October 15, 2026).

The distinctions among the American, European, and Singaporean arrangements affect the identification of contractual obligations, redemption rights, and competent authorities. They do not provide a universal answer to every dispute involving USDC or establish that a particular issuer's domicile determines ownership of tokens held elsewhere.

The United States also enacted the Guiding and Establishing National Innovation for U.S. Stablecoins Act, commonly called the GENIUS Act. On October 21, 2026, the Office of the Comptroller of the Currency announced final implementing regulations and confirmed January 18, 2027, as the effective date of the legislation and its rule (OCC, Bulletin 2026-50, October 21, 2026).

The reported Binance incident occurred before that effective date. The GENIUS Act's future requirements cannot be treated as the operative statutory basis for Circle's October 29 intervention. Any compulsory legal authority exercised at that time must be assessed under the laws and orders applicable when the action occurred.

3.4 Competing Jurisdiction and Enforcement Claims

Several countries may possess legitimate grounds to investigate aspects of the same suspected theft. Territorial conduct, involvement of nationals, affected operations, and other recognized jurisdictional connections can support overlapping criminal jurisdiction, subject to applicable national and international rules.

Civil proceedings raise different questions. A claimant may seek relief against the company responsible for custody, against an alleged wrongdoer, or against an intermediary possessing identifiable assets. The forum hearing the claim may need to determine contractual obligations, proprietary interests, and the applicable law through its own conflict-of-laws rules.

Cryptocurrency's distributed accounting structure complicates attempts to identify a single territorial location for a token. Copies of blockchain records may exist in many countries, while effective control may depend on signing credentials held elsewhere. Neither the location of an individual network node nor the headquarters of one service provider automatically fixes the legal location of the asset.

The distinction between adjudication and enforcement remains decisive. A court may establish jurisdiction over a defendant or dispute yet lack the practical authority to compel an unrelated foreign institution to act. Recognition of foreign judgments, local enforcement proceedings, or official cooperation may be necessary to make the decision effective.

These limits help explain why an investigation involving Binance, Tether, and Circle may require several legal processes. A jurisdiction competent to investigate the suspected offense may not be the same jurisdiction best placed to compel production of records, enforce a freeze, or determine a particular customer's ownership rights.

4. International Cooperation in the Binance Investigation

The international legal dimension becomes particularly significant when investigators require evidence or assistance outside their national jurisdiction. Blockchain transactions may be publicly visible, but identifying the individuals who control addresses often requires information held by exchanges, financial institutions, communications providers, and other intermediaries.

International cooperation can help authorities obtain account records, preserve electronic evidence, identify suspects, and locate assets connected to criminal activity. The evolution of international law in cyberspace has involved applying established jurisdictional principles to digital conduct while developing specialized mechanisms for investigating offenses that cross national boundaries.

The distinction between international cooperation and national enforcement remains essential. A treaty may establish obligations to assist foreign investigators without authorizing those investigators to exercise unrestricted coercive powers abroad. The legal authority needed to preserve evidence may also differ from that required to seize cryptocurrency or transfer property to a claimant.

4.1 The Budapest Convention and Electronic Evidence

The Convention on Cybercrime, adopted in Budapest on November 23, 2001, provides an established treaty framework for addressing specified computer-related offenses. It entered into force on July 1, 2004, and contains provisions concerning substantive criminal law, investigative powers, jurisdiction, and international cooperation (Council of Europe, 2001).

Article 22 addresses criminal jurisdiction, including specified offenses committed within a state's territory. Articles 16 and 29 concern the expedited preservation of stored computer data through domestic and international procedures. Article 31 provides for mutual assistance concerning access to stored data, while Article 35 establishes a network of contact points available continuously to support urgent investigations.

These provisions could be relevant to a suspected cryptocurrency theft requiring information about account access, authorization records, communications, or electronic activity held by foreign service providers. Preservation may protect information against deletion while investigators pursue the legal procedures necessary to obtain disclosure.

The Convention nevertheless distinguishes electronic evidence from property. Article 29 concerns preservation of stored computer data; it does not create a general international power to freeze cryptocurrency balances. Seizure of digital assets and determination of their ownership require a separate legal basis under applicable law.

The treaty's operation also depends on participation, national implementation, and the conditions governing particular forms of assistance. Authorities cannot assume that every relevant country is bound by the same obligations or that treaty participation permits unrestricted cross-border searches. No public evidence established that a particular Budapest Convention request had been issued in connection with the October 29 Binance investigation.

4.2 Mutual Legal Assistance and International Asset Recovery

Mutual legal assistance provides formal channels through which national authorities may request evidence or investigative measures from another state. Depending on the applicable treaties and domestic legislation, assistance may involve financial records, testimony, identification of suspects, searches, or measures concerning property suspected to represent criminal proceeds.

The United Nations Convention against Transnational Organized Crime provides additional mechanisms where its conditions are satisfied. Article 13 addresses international cooperation concerning confiscation. Article 14 governs the disposal of confiscated proceeds or property and includes provisions concerning compensation of victims and return to legitimate owners (United Nations, 2000).

Article 14(2) requires states parties, when acting on a qualifying request under Article 13, to give priority consideration to returning confiscated property to the requesting state so that it can compensate victims or restore property to legitimate owners. This obligation operates within the limits of domestic law and depends on the conditions specified in the Convention. It does not create an unconditional right to receive the confiscated assets.

The Convention's applicability must also be established. Article 3 covers specified offenses and serious crimes meeting the relevant transnational and organized-criminal-group requirements, subject to the Convention's provisions. A suspected cryptocurrency theft does not fall within its scope merely because the assets were transferred across national borders.

INTERPOL provides a complementary police-cooperation mechanism. Its Silver Notice system, introduced in January 2025, enables participating authorities to seek information concerning assets associated with criminal activity. Such notices can assist in locating and tracing property, but they do not independently authorize confiscation or compel a foreign court to recognize a recovery claim (INTERPOL, 2025).

Two newer instruments had not entered into force by October 29, 2026: the Second Additional Protocol to the Budapest Convention on enhanced cooperation and electronic evidence, and the United Nations Convention against Cybercrime adopted in December 2024. Their prospective provisions cannot be treated as operative treaty obligations governing the reported Binance incident.

5. From Frozen Tokens to Legally Recovered Assets

A private stablecoin freeze may preserve assets while investigators establish their origin and identify possible claimants. The subsequent legal process depends on the suspected offense, the location and control of the property, and the powers available to competent authorities. A restriction imposed by an issuer does not automatically become a judicial seizure.

Criminal investigations may lead to temporary restraint, court-authorized seizure, civil forfeiture, or confiscation following criminal proceedings. These mechanisms have different evidentiary requirements and procedural consequences. Persons asserting ownership may be entitled to notice, an opportunity to contest the government's position, or other protections under the governing legal system.

A further distinction concerns adjudicatory jurisdiction in international law. A court may have authority to determine a dispute without possessing an independent power to enforce its decision against foreign persons or property. Cryptocurrency recovery may consequently require several proceedings before a judgment can produce an effective transfer.

5.1 U.S. Seizure, Forfeiture, and Restitution

United States federal law provides mechanisms for pursuing cryptocurrency connected to qualifying criminal conduct. Under 18 U.S.C. § 981, specified property may be subject to civil forfeiture, including property associated with certain fraud and money-laundering offenses. The government must establish that the relevant statutory conditions are satisfied.

Section 983 governs important procedural aspects of civil forfeiture. Under § 983(c)(1), the government bears the burden of establishing forfeitability by a preponderance of the evidence. Section 983(c)(3) requires a substantial connection between the property and the offense when forfeiture is based on the property's use to commit, facilitate, or involvement in criminal conduct.

Section 983(d) also protects qualifying innocent owners. A claimant asserting that defense must establish the relevant ownership interest and satisfy the applicable statutory requirements. The availability of such protection illustrates why cryptocurrency found in a suspicious address cannot automatically be treated as property belonging to the offender.

Investigators may initially seek a seizure warrant under applicable federal procedures. Where cryptocurrency is held by a cooperative issuer or custodian, execution may involve transferring the identified assets into a government-controlled wallet. This establishes legally authorized control but does not necessarily complete the forfeiture process.

Restitution introduces additional legal requirements. Criminal restitution orders, civil forfeiture proceedings, and administrative mechanisms for remission or restoration operate under different statutory provisions. The availability of relief to a particular claimant depends on the governing procedure and the nature of the claimant's legally recognized loss.

Even successful forfeiture does not automatically determine that all recovered cryptocurrency must be transferred to Binance. A court or competent authority may need to consider competing interests, evidence of ownership, prior compensation, and the legal relationship between the suspected offense and the assets.

5.2 Civil Recovery and Proprietary Injunctions

Civil proceedings may offer another method of protecting cryptocurrency while ownership claims are determined. English law provides an important example in AA v Persons Unknown [2019] EWHC 3556 (Comm), a case involving Bitcoin associated with a ransomware payment made following an attack on a Canadian insurance company.

The applicant, an insurer, sought interim proprietary relief against unidentified persons and entities associated with the cryptocurrency. The Commercial Court considered whether Bitcoin could qualify as property capable of supporting a proprietary injunction. The question was significant because cryptocurrency did not fit comfortably within the traditional categories of tangible property and enforceable choses in action.

At paragraphs 59–63, Bryan J accepted that Bitcoin could constitute property for purposes of the interim application. The judgment drew upon the criteria associated with National Provincial Bank Ltd v Ainsworth [1965] AC 1175 and contemporary legal analysis of crypto-assets. The court determined that the requirements for interim proprietary relief were satisfied, without finally resolving every issue concerning ownership or liability.

The Property (Digital Assets etc) Act 2025 subsequently addressed an important classification issue. Section 1 provides that a digital or electronic thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action. The Act received Royal Assent and entered into force on December 2, 2025, extending to England and Wales and Northern Ireland.

The legislation removes a particular obstacle to recognizing property rights but does not establish that every digital object necessarily constitutes property. It also does not provide a comprehensive mechanism for international cryptocurrency restitution. The existence and enforcement of particular rights remain governed by the applicable legal principles.

A proprietary injunction may preserve identifiable assets claimed by the applicant, while a freezing injunction may restrain dealings with assets more generally to protect the effectiveness of proceedings. The two remedies serve different legal purposes. Their availability, territorial reach, and enforceability against foreign entities depend on the circumstances of the case and the court's jurisdiction.

6. Who Is Legally Entitled to the Frozen Cryptocurrency?

Determining legal entitlement may prove more difficult than identifying cryptocurrency movements. Exchange-operated wallets can contain assets associated with numerous customers, while internal records may allocate balances in ways that are not visible on the blockchain. The person controlling a private key does not necessarily possess the entire beneficial interest in the corresponding assets.

The relevant rights depend on the custody arrangement and applicable law. A customer may have a proprietary interest in identifiable assets, a beneficial interest under a trust or similar arrangement, a contractual claim against the custodian, or some combination of these rights. The legal characterization cannot be established solely from the presence of cryptocurrency in an exchange-controlled wallet.

This distinction affects the recovery process. Evidence of account balances, custody agreements, segregated holdings, and prior transactions may be necessary to establish entitlement. Where several persons claim the same assets, the competent court or authority must determine which interests the governing law recognizes and how those interests affect distribution.

6.1 Binance, Customer Assets, and Competing Claims

A suspected loss involving Binance's proprietary cryptocurrency raises different legal questions from one involving customer assets held in custody. In the first situation, the exchange may assert its own property rights. In the second, the customer's rights may depend on contractual terms, custody arrangements, and the law governing the relationship.

Binance's January 2026 transition placed ordinary custody functions for user digital assets principally with Nest Clearing and Custody Limited, subject to published exceptions. That regulatory arrangement identifies an important possible custodian but does not establish that the wallets implicated on October 29 held assets belonging to customers or that a particular Nest entity controlled them.

Identifying the affected property would require evidence concerning the wallets, internal ledgers, transaction records, and applicable agreements. The existence of a regulated custodian cannot substitute for those findings. Nor can a customer account balance alone determine whether the customer has a proprietary interest or a claim enforceable only against the relevant service provider.

Compensation may further complicate the distribution of recovered assets. If Binance reimburses customers before the cryptocurrency is returned, the legal consequences may include assignment, subrogation, or other rights arising under the governing agreement or law. Such mechanisms can affect which party is entitled to pursue subsequent recovery.

Their application cannot be presumed. A compensation payment does not always transfer the same rights, and the relevant legal effect depends on its terms and circumstances. Any recovery arrangement must also address the possibility of duplicate compensation for the same economic loss.

The public information available on October 29 did not establish a comprehensive determination of the ownership of the reported frozen tokens. Without that information, it is impossible to conclude that Binance, its customers, or another claimant possessed an exclusive right to receive the entire amount.

6.2 Binance's SAFU Fund and Customer Compensation

Binance established the Secure Asset Fund for Users, known as SAFU, to provide a reserve for specified losses affecting its customers. The fund is separate from cryptocurrency recovered through an investigation, and its use depends on Binance's published conditions and the decisions made under those arrangements.

In January 2026, Binance described SAFU as holding approximately $1 billion in USDC. That composition subsequently changed. On January 30, Binance announced plans to convert the reserve into Bitcoin, and on February 12 it reported completing the conversion. The fund then held approximately 15,000 BTC, valued at about $1 billion at the time of completion (Binance, February 12, 2026).

The change altered the reserve's exposure to market fluctuations. Unlike the former USDC-denominated holdings, the dollar value of a Bitcoin reserve changes with the price of Bitcoin. Binance stated that it intended to replenish the fund toward its $1 billion target if its value fell below $800 million because of market movements.

The completion figure is historical. It does not establish the fund's exact market value, available liquidity, or legally unrestricted resources on October 29. The relationship between the reserve and the reported suspected losses must also account for the fact that part of SAFU is used in connection with Binance's regulatory capital arrangements in Abu Dhabi.

Binance's published SAFU conditions identify specified categories of eligible loss, including certain incidents involving vulnerabilities in the exchange's internal systems or security procedures. Requests for payment are ordinarily expected within 90 days of an eligible loss. The company retains discretion concerning eligibility and the administration of the fund (Binance, Frequently Asked Questions on Secure Asset Fund for Users, updated February 2026).

SAFU is not equivalent to statutory deposit insurance or an unconditional guarantee covering every customer loss. Its existence does not establish that the suspected October incident met the applicable eligibility conditions or that compensation had been approved or distributed.

The fund's possible role in the Binance investigation also differs from legal restitution. A qualifying customer might receive compensation from Binance while separate proceedings continue against suspected offenders. If assets are subsequently recovered, the distribution process would need to account for the compensation already provided and any resulting legal rights.

7. What Previous Cryptocurrency Recoveries Demonstrate

Earlier cryptocurrency investigations demonstrate that digital assets can be traced, placed under lawful governmental control, subjected to forfeiture proceedings, and returned to persons with recognized claims. The processes have been applied to stablecoins and native cryptocurrencies, although the technical means of obtaining control may differ.

The relevant precedents also expose the limitations of recovery. Identification of suspicious transfers does not necessarily establish ownership, and seizure of cryptocurrency does not complete a forfeiture proceeding. Even after a government obtains legal title, returning the economic value to affected persons may require further administrative or judicial action.

United States proceedings involving Tether and the Bitfinex theft are useful because they document different stages of this process. Their significance lies in the specific legal measures employed, rather than in any assumption that the Binance investigation will produce the same outcome.

7.1 U.S. Recovery Proceedings Involving Frozen Tether

On February 28, 2025, the U.S. Attorney's Office for the Northern District of Ohio announced a civil forfeiture complaint concerning 8,207,578 USDT. Investigators alleged that the cryptocurrency was associated with an investment fraud scheme affecting victims in several American states (U.S. Department of Justice, Northern District of Ohio, February 28, 2025).

According to the Department of Justice, investigators traced cryptocurrency to three addresses and executed a federal seizure warrant in November 2024. Tether assisted by transferring the identified tokens to a law-enforcement-controlled wallet. The cooperation enabled authorities to secure the assets before the forfeiture litigation had been completed.

The government filed its complaint on February 27, 2025, seeking forfeiture of the cryptocurrency. At that stage, the allegations remained subject to proof, and the Department stated that it intended to seek the return of stolen funds to victims if the proceedings succeeded. The announcement did not establish a completed forfeiture judgment or restitution payment.

A later announcement from the District of Maine illustrates a different procedural stage. On March 13, 2026, the Department of Justice reported that approximately $470,735 would be returned to two victims of a cryptocurrency investment scheme. The FBI had seized 470,773 USDT linked to the victims' transfers, and a federal court had subsequently ordered forfeiture of the property (U.S. Department of Justice, District of Maine, March 13, 2026).

The Maine announcement identified a judicial forfeiture order and an intended distribution to victims. It did not independently document the date on which each recipient actually received payment. That distinction is important when evaluating official claims of successful asset recovery.

Both proceedings demonstrate the potential effectiveness of cooperation between law-enforcement authorities and a stablecoin issuer. They also demonstrate why a freeze or seizure should not be described as completed restitution. The legal process may continue after investigators have obtained effective control over the cryptocurrency.

7.2 The Bitfinex Theft and Disputed Victim Entitlement

The 2016 Bitfinex theft involved approximately 119,754 Bitcoin transferred through more than 2,000 unauthorized transactions. In February 2022, the U.S. Department of Justice announced the seizure of cryptocurrency valued at approximately $3.6 billion at the time of recovery, following an investigation into the laundering of the stolen assets (U.S. Department of Justice, February 8, 2022).

Ilya Lichtenstein and Heather Morgan pleaded guilty in August 2023 to offenses arising from the laundering conspiracy. Lichtenstein admitted responsibility for the original unauthorized access to Bitfinex, while both defendants acknowledged participation in laundering activity. The Department of Justice subsequently announced Lichtenstein's sentencing in November 2024.

The investigation demonstrated that substantial quantities of stolen Bitcoin could be located years after the original theft. Authorities obtained control of assets through investigative procedures rather than through an issuer capable of blocking Bitcoin transactions. The operation illustrates a recovery method unavailable through ordinary centralized token-freezing mechanisms.

Questions concerning victim entitlement remained legally distinct. In November 2024, the Department of Justice established a procedure for potentially affected persons to submit information about the consequences of the Bitfinex theft. The government also stated its position that there were no qualifying victims of the offenses of conviction for purposes of the Crime Victims' Rights Act (U.S. Department of Justice, District of Columbia, November 7, 2024).

That position concerned the statutory treatment of the offenses in the criminal proceedings. It did not mean that the original theft caused no financial losses or conclusively resolve every civil or proprietary claim connected to the stolen cryptocurrency.

The distinction is relevant to Binance. A court may determine criminal responsibility and order forfeiture without simultaneously resolving all possible claims arising from the exchange's customer relationships. The identity of the original exchange, the existence of affected accountholders, and the legal consequences of prior compensation may require separate consideration.

The historical cases establish that cryptocurrency recovery is possible, sometimes on a substantial scale. They do not provide a legal presumption that every asset frozen during the October 29 investigation will be returned or identify the persons entitled to receive it.

8. State Responsibility and Sanctions if Attribution Emerges

Previous cryptocurrency thefts have been attributed by national authorities to actors associated with the Democratic People's Republic of Korea. Such findings can raise questions under public international law, particularly where conduct may be attributed to a state or involves persons subject to international sanctions.

The law of state responsibility provides rules for determining when conduct is attributable to a state and when that conduct constitutes a breach of an international obligation. These questions are separate from criminal responsibility under domestic law and from the technical identification of suspicious blockchain activity.

As of October 29, 2026, the available official information did not establish that North Korea, Lazarus, or another state-linked organization was responsible for the reported Binance incident. Earlier incidents attributed to such actors provide historical context but cannot establish responsibility for a new operation without evidence connecting the conduct to the suspected perpetrators.

8.1 North Korean Cyber Operations and State Attribution

On February 26, 2025, the Federal Bureau of Investigation publicly attributed the theft of approximately $1.5 billion in cryptocurrency from Bybit to North Korea. The FBI identified the operation as TraderTraitor and described efforts to move stolen assets through numerous addresses and blockchain networks (FBI, North Korea Responsible for $1.5 Billion Bybit Hack, February 26, 2025).

The United States Department of Justice also announced two civil forfeiture complaints in November 2025 seeking more than $15 million in USDT allegedly associated with North Korean APT38 operations. The complaints concerned cryptocurrency seized in March 2025 and allegedly connected to thefts from several virtual-asset platforms in 2023 (U.S. Department of Justice, November 14, 2025).

These proceedings demonstrate the ability of national authorities to investigate suspected state-linked cryptocurrency theft and pursue assets associated with such conduct. They do not establish that the October 2026 Binance transactions were carried out by the same actors.

The International Law Commission's 2001 Articles on Responsibility of States for Internationally Wrongful Acts identify the relevant attribution principles. Article 4 concerns conduct of state organs, while Article 8 addresses conduct by persons or groups acting on a state's instructions or under its direction or control (ILC, 2001).

The Articles are not themselves a binding multilateral treaty. They constitute an influential codification and development of the law of state responsibility, with significant provisions reflecting customary international law. Their application must account for the status and interpretation of the particular rule involved.

Article 2 identifies two necessary elements of an internationally wrongful act: conduct attributable to the state and a breach of an international obligation binding on that state. Technical evidence suggesting participation by a particular group does not automatically satisfy either element.

Even a well-supported attribution finding would leave the question of the relevant primary obligation. The legal assessment would need to identify a treaty obligation or applicable customary rule allegedly breached by the conduct. The state-responsibility framework does not independently establish that every state-linked cyber theft constitutes a violation of a specific international obligation.

If an internationally wrongful act were established, further questions could arise concerning cessation, reparation, and the invocation of responsibility by an entitled state. Those questions would remain legally distinct from the private rights of Binance or its customers to particular cryptocurrency holdings.

8.2 UN Sanctions, OFAC Restrictions, and Asset Ownership

The Democratic People's Republic of Korea is subject to sanctions imposed through United Nations Security Council Resolution 1718 (2006) and subsequent resolutions. These measures include restrictions on designated persons and entities, prohibited activities, financial transactions, and assets associated with specified programs or sanctions violations (United Nations Security Council, 2006).

The Security Council's 1718 Committee oversees the relevant regime. Applicable asset-freezing measures may require states to restrict funds and economic resources belonging to designated persons or entities and other persons covered by the resolutions' terms. Implementation occurs through national legal measures and competent authorities.

The United States maintains additional sanctions administered by the Office of Foreign Assets Control. American sanctions may restrict dealings with designated persons, entities, and property interests under U.S. law. These restrictions must be distinguished from obligations imposed by the Security Council, even where they address related conduct.

A sanctions freeze does not ordinarily transfer ownership of the affected property to the government. The prohibition on dealing with an asset is legally separate from its confiscation following criminal proceedings and from a final determination of the rights of private claimants.

The applicable sanctions rules may also contain licensing or exemption mechanisms. The precise conditions depend on the regime and the property involved. A judicial order directing the return of cryptocurrency does not automatically eliminate restrictions that independently prohibit dealings with a sanctioned person or entity.

The relevance of sanctions to the Binance investigation would depend on establishing a sufficient connection between the affected assets and persons or property interests covered by an applicable legal restriction. A historical association with North Korean cyber operations would not be enough.

If such a connection were established, authorities might need to coordinate criminal asset-recovery measures with sanctions compliance. The resulting legal process could affect when and how cryptocurrency is released, but sanctions would not independently determine that Binance or any particular customer is entitled to the frozen assets.

Conclusion

The reported freezing of more than $2.38 billion during the October 29 Binance investigation demonstrates the significant capacity of stablecoin issuers to restrict cryptocurrency transfers. Tether and Circle possess technical powers over specified tokens, but those powers do not independently establish ownership or authorize the compulsory distribution of assets to alleged victims.

The ultimate recovery process depends on several legal determinations. Investigators must identify assets connected to unlawful conduct, competent authorities must establish a lawful basis for any compulsory measures, and claimants must demonstrate the rights necessary to obtain restitution. The presence of multiple corporate entities, custodial arrangements, and national jurisdictions can make these determinations more difficult.

International law supplies mechanisms for cooperation between states and limits the exercise of jurisdiction beyond national territory. Treaty-based assistance may support the investigation and recovery of criminal proceeds, while state responsibility or sanctions could become relevant if additional evidence established the necessary conditions. The substantive ownership and restitution questions would nevertheless remain governed principally by applicable national laws and contractual arrangements.

As of October 29, 2026, the available public information established substantial reported stablecoin restrictions but did not conclusively determine the total amount stolen, the legal ownership of the affected assets, or their eventual distribution. Those unresolved questions prevent the frozen amount from being treated as recovered money.

The decisive question is whether the technical control already exercised over the stablecoins can be followed by legally enforceable measures identifying and restoring property to its rightful claimants. Until that process is completed, the reported freezes represent preservation of potentially recoverable assets, rather than proof that Binance or its customers have received restitution.

References

Binance (2025) ‘Update on Binance’s Transition to ADGM’, Binance Announcements, 8 December [online]. Available at: https://www.binance.com/en-AE/support/announcement/detail/f4f57a010f074dae9d34718635aba926 (Accessed: 29 October 2026).

Binance (2026a) ‘Binance’s ADGM Launch Update’, Binance Announcements, 5 January [online]. Available at: https://www.binance.com/en/support/announcement/detail/a4a7d00e88224224b55293be07724334 (Accessed: 29 October 2026).

Binance (2026b) ‘Frequently Asked Questions on Secure Asset Fund for Users (SAFU)’, Binance Support, updated 8 January [online]. Available at: https://www.binance.com/en-IN/support/faq/detail/028799e730294ae4a9b382d60d350116 (Accessed: 29 October 2026).

Binance (2026c) ‘An Open Letter to the Crypto Community’, Binance Blog, 30 January [online]. Available at: https://www.binance.com/en/blog/community/7001232677846823071 (Accessed: 29 October 2026).

Binance (2026d) ‘Binance Completes $1B SAFU Bitcoin Purchase at Average Price Near $70,000’, Binance Square, 12 February [online]. Available at: https://www.binance.com/en-IN/square/post/02-12-2026-binance-completes-1b-safu-bitcoin-purchase-at-average-price-near-70-000-290773529600498 (Accessed: 29 October 2026).

Binance (2026e) ‘Secure Asset Fund for Users (SAFU)’, Binance Academy, updated 24 February [online]. Available at: https://www.binance.com/en/academy/glossary/secure-asset-fund-for-users (Accessed: 29 October 2026).

Circle (2026a) ‘EEA Terms of Use’, updated 7 July [online]. Available at: https://www.circle.com/legal/eea-terms (Accessed: 29 October 2026).

Circle (2026b) ‘Licenses’, updated 8 September [online]. Available at: https://www.circle.com/legal/licenses (Accessed: 29 October 2026).

Circle (2026c) ‘USDC Terms’, updated 15 October [online]. Available at: https://www.circle.com/legal/usdc-terms (Accessed: 29 October 2026).

Circle (2026d) ‘Understand Circle’s Stablecoin Blocklisting Process’, Circle Help Center [online]. Available at: https://help.circle.com/support/en/understand-circle-s-stablecoin-blocklisting-process?id=support_article_view&sysparm_article=KB0011513 (Accessed: 29 October 2026).

Convention on Cybercrime (2001) Adopted at Budapest, 23 November 2001, European Treaty Series No. 185. Entered into force 1 July 2004. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=185 (Accessed: 29 October 2026).

Decrypt (2026) ‘Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion’, 29 October [online]. Available at: https://lumowallet.com/newsroom/binance-drained-of-5-5-billion-in-suspected-hack-tether-and-circle-freeze-1-8-billion (Accessed: 29 October 2026).

European Parliament and Council of the European Union (2023) Regulation (EU) 2023/1114 of 31 May 2023 on Markets in Crypto-Assets, Official Journal of the European Union, L 150, 9 June, pp. 40–205. Available at: https://eur-lex.europa.eu/eli/reg/2023/1114/oj/eng (Accessed: 29 October 2026).

Federal Bureau of Investigation (2025) ‘North Korea Responsible for $1.5 Billion Bybit Hack’, Public Service Announcement I-022625-PSA, 26 February [online]. Available at: https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack (Accessed: 29 October 2026).

Guiding and Establishing National Innovation for U.S. Stablecoins Act (2025) Public Law 119-27, 18 July 2025, 139 Stat. 419. Available at: https://www.govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm (Accessed: 29 October 2026).

High Court of Justice of England and Wales (2019) AA v Persons Unknown [2019] EWHC 3556 (Comm), judgment of Bryan J, 13 December. Available at: https://www.bailii.org/ew/cases/EWHC/Comm/2019/3556.html (Accessed: 29 October 2026).

House of Lords (1965) National Provincial Bank Ltd v Ainsworth [1965] AC 1175.

International Criminal Police Organization (INTERPOL) (2025) ‘INTERPOL Publishes First Silver Notice Targeting Criminal Assets’, 10 January [online]. Available at: https://www.interpol.int/News-and-Events/News/2025/INTERPOL-publishes-first-Silver-Notice-targeting-criminal-assets (Accessed: 29 October 2026).

International Law Commission (2001) ‘Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries’, Report of the International Law Commission on the Work of Its Fifty-Third Session, UN Doc. A/56/10, Chapter IV.

Yearbook of the International Law Commission, 2001, Vol. II, Part Two. Available at: https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf (Accessed: 29 October 2026).

Office of the Comptroller of the Currency (2026) ‘GENIUS Act Regulations: Final Rule’, OCC Bulletin 2026-50, 21 October [online]. Available at: https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-50.html (Accessed: 29 October 2026).

Property (Digital Assets etc) Act 2025 (UK) 2025 c. 29, Royal Assent 2 December 2025. Available at: https://www.legislation.gov.uk/ukpga/2025/29/enacted (Accessed: 29 October 2026).

Reuters (2026) ‘Tether, Circle Freeze $2.38 Billion after Binance Reports Security Incident’, 29 October [online]. Available at: https://www.investing.com/news/stock-market-news/tether-circle-freeze-238-billion-after-binance-reports-security-incident-4985511 (Accessed: 29 October 2026).

Second Additional Protocol to the Convention on Cybercrime on Enhanced Co-operation and Disclosure of Electronic Evidence (2022) Opened for signature at Strasbourg, 12 May 2022, Council of Europe Treaty Series No. 224. Available at: https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=224 (Accessed: 29 October 2026).

Shubnell, J. and Khatri, Y. (2026) ‘Binance Investigating Hack as Suspicious Outflows Reach up to $5.8 Billion’, The Block, 29 October [online]. Available at: https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171 (Accessed: 29 October 2026).

Tether (2026) ‘Token Terms of Sale and Service’, updated 26 February [online]. Available at: https://tether.to/en/legal/ (Accessed: 29 October 2026).

United Nations Convention against Cybercrime (2024) Adopted by the United Nations General Assembly, New York, 24 December 2024, Resolution 79/243. Not yet in force as of 29 October 2026. Available at: https://treaties.un.org/Pages/ViewDetails.aspx?chapter=18&clang=_en&mtdsg_no=XVIII-16&src=TREATY (Accessed: 29 October 2026).

United Nations Convention against Transnational Organized Crime (2000) Adopted at New York, 15 November 2000, 2225 UNTS 209. Entered into force 29 September 2003. Available at: https://treaties.un.org/Pages/showDetails.aspx?objid=0800000280050d3e (Accessed: 29 October 2026).

United Nations Security Council (2006) Resolution 1718 (2006), adopted at the 5551st meeting, 14 October, UN Doc. S/RES/1718(2006). Available at: https://digitallibrary.un.org/record/584729 (Accessed: 29 October 2026).

United States Code (2026a) 18 U.S.C. § 981: Civil Forfeiture. Washington, DC: Office of the Law Revision Counsel, U.S. House of Representatives. Available at: https://uscode.house.gov/us/usc/119-124/t18/s981/ (Accessed: 29 October 2026).

United States Code (2026b) 18 U.S.C. § 983: General Rules for Civil Forfeiture Proceedings. Washington, DC: Office of the Law Revision Counsel, U.S. House of Representatives. Available at: https://uscode.house.gov/view.xhtml?req=%28title%3A18+section%3A983+edition%3Aprelim%29 (Accessed: 29 October 2026).

United States Department of Justice (2022) ‘Two Arrested for Alleged Conspiracy to Launder $4.5 Billion in Stolen Cryptocurrency’, Office of Public Affairs, 8 February [online]. Available at: https://www.justice.gov/archives/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency (Accessed: 29 October 2026).

United States Department of Justice (2023) ‘Husband and Wife Plead Guilty to Money Laundering Conspiracy Involving the Hack and Theft of Billions in Cryptocurrency’, U.S. Attorney’s Office, District of Columbia, 3 August [online]. Available at: https://www.justice.gov/usao-dc/pr/husband-and-wife-plead-guilty-money-laundering-conspiracy-involving-hack-and-theft (Accessed: 29 October 2026).

United States Department of Justice (2024a) ‘Website Related to Multi-Billion Dollar Bitfinex Hack Established’, U.S. Attorney’s Office, District of Columbia, 7 November [online]. Available at: https://www.justice.gov/usao-dc/pr/website-related-multi-billion-dollar-bitfinex-hack-established (Accessed: 29 October 2026).

United States Department of Justice (2024b) ‘Bitfinex Hacker Sentenced in Money Laundering Conspiracy Involving Billions in Stolen Cryptocurrency’, U.S. Attorney’s Office, District of Columbia, 14 November [online]. Available at: https://www.justice.gov/usao-dc/pr/bitfinex-hacker-sentenced-money-laundering-conspiracy-involving-billions-stolen (Accessed: 29 October 2026).

United States Department of Justice (2025a) ‘Ohio Woman Loses Life Savings in Cryptocurrency Investment Scam’, U.S. Attorney’s Office, Northern District of Ohio, 28 February [online]. Available at: https://www.justice.gov/usao-ndoh/pr/ohio-woman-loses-life-savings-cryptocurrency-investment-scam (Accessed: 29 October 2026).

United States Department of Justice (2025b) ‘Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation’, Office of Public Affairs, 14 November [online]. Available at: https://www.justice.gov/opa/pr/justice-department-announces-nationwide-actions-combat-illicit-north-korean-government (Accessed: 29 October 2026).

United States Department of Justice (2026) ‘Department of Justice to Return $470,735 to Victims of Cryptocurrency Investment Scheme’, U.S. Attorney’s Office, District of Maine, 13 March [online]. Available at: https://www.justice.gov/usao-me/pr/department-justice-return-470735-victims-cryptocurrency-investment-scheme (Accessed: 29 October 2026).