Whole-of-Government Crypto Crime Takedown Playbook
Dismantle transnational crypto crime networks when traditional arrest is impossible
The Whole-of-Government framework coordinates multiple agencies—DOJ, OFAC, FinCEN, and intelligence services—to dismantle crypto crime networks when direct arrest is impossible. Rather than waiting for extradition, the approach simultaneously indicts leadership to freeze their movement, sanctions the organization to cut financial access, dismantles money laundering infrastructure, and executes asset forfeiture. The core insight is that asset seizure deters financial criminals more effectively than the threat of imprisonment. Blockchain tracing enables law enforcement to follow stolen funds through cross-chain conversions, mixing services, and OTC handoffs, building evidence for each intervention layer. The Prince Group case—a $15 billion forfeiture, the largest in history—validated this playbook across every enforcement layer, from criminal prosecution to sanctions to regulatory action.
- Asset seizure deters financial criminals more effectively than the threat of arrest
- Multi-agency coordination multiplies enforcement impact beyond what any single agency achieves alone
- The off-ramp is the chokepoint where crypto crime is most vulnerable to disruption
- Blockchain immutability transforms every on-chain transaction into traceable, admissible evidence
- Non-extraditable adversaries can be financially neutralized without physical custody
- Victim restitution must be designed into enforcement strategy from the start, not added afterward
- Map the Criminal Network via Blockchain TracingDeploy threat hunters and blockchain forensic tools to attribute illicit wallet addresses, trace transaction flows, and build a complete map of the network's financial infrastructure. Focus attribution on the laundering layer—bridges, mixers, and OTC handoffs—not just the initial theft event.Pro tipSpecialists who focus full-time on a single threat actor (e.g., North Korea, Iran) develop attribution depth that general analysts cannot match; build dedicated single-actor teams.WarningWithout solid on-chain attribution, downstream enforcement actions lose legal standing and practical effect.
- Build Intelligence on Leadership and Money Laundering InfrastructureIdentify key figures, organizational hierarchy, government connections, and the facilitators enabling fund movement off-chain. Engage human intelligence sources—including insiders—where on-chain visibility ends.Pro tipInsider access near the top of the organization can provide the decisive intelligence needed for asset seizure, as evidenced by the role of an insider referenced in the Prince Group forfeiture documents.
- Coordinate Multi-Agency Alignment on a Sequenced Action PlanAlign DOJ (prosecution), OFAC (sanctions), FinCEN (regulatory), and intelligence agencies on a unified timeline. Determine the optimal sequence of enforcement moves to prevent network adaptation between actions.Pro tipSanctions applied before indictment can cause leadership to go further underground before sufficient evidence is secured for prosecution; sequence carefully.WarningSiloed action by any single agency allows the network to adapt and reconstitute around the individual pressure point.
- Indict Key Leadership to Create Legal and Diplomatic PressureFile criminal indictments against network leaders to establish grounds for future extradition, limit their international travel, and signal to foreign governments that shielding these actors carries diplomatic cost.Pro tipEven when extradition is unlikely, indictments constrain where leaders can operate globally and may motivate foreign governments to act independently on their own interests.
- Apply OFAC Sanctions to Freeze Organizational AssetsDesignate the organization and key figures under OFAC to freeze accessible assets and cut the network off from the global financial system. Coordinate with allied financial regulators and stablecoin issuers to extend the perimeter internationally.Pro tipCoordinate directly with stablecoin issuers like Tether and Circle to freeze and reissue tokens held in sanctioned wallets, neutralizing stable-value holdings that bad actors prefer for liquidity.
- Dismantle Money Laundering Infrastructure via FinCENTarget primary facilitators—exchanges, OTC brokers, mixing services—through FinCEN regulatory action to destroy the off-ramp capability that converts illicit crypto into usable funds. The off-ramp is the chokepoint.Pro tipDisrupting the off-ramp traps funds on-chain where they remain fully traceable; a strong perimeter at exit points is often more damaging to the network than any upstream enforcement action.WarningMultiple facilitators often operate in parallel; neutralizing one without targeting others allows rapid network rerouting.
- Execute Asset Seizure and Forfeiture as the Primary Enforcement OutcomePrioritize taking the money over securing physical arrests. Use every available technical, intelligence, and legal tool—including exploiting access to private keys through insider intelligence or system vulnerabilities—to identify and forfeit criminal proceeds.Pro tipFinancial criminals are typically more deterred by asset loss than by jail time; shifting enforcement philosophy to money-first maximizes deterrence impact per dollar spent.
- Build a Structured Victim Restitution Fund from Seized AssetsAllocate forfeited assets into a compensation fund—modeled on precedents like the US Vaccine Injury Compensation Fund—where individual victims file verified claims. Use blockchain tracing to link victim wallets to specific criminal compounds, enabling scalable verification.Pro tipBlockchain tracing can associate specific victim addresses with specific criminal operations, enabling claim verification at a scale impossible in traditional financial fraud restitution.WarningSlow restitution erodes public confidence in the enforcement system and leaves hundreds of thousands of victims without recourse despite successful seizure.
The Prince Group, operating out of Cambodia with ties to Chinese national security networks, ran massive scam compounds stealing billions from Americans through social engineering. DOJ indicted ringleader Shenzi, OFAC sanctioned Prince Group, and FinCEN dismantled Wei One—the primary laundering facilitator. The coordinated multi-agency action resulted in a $15 billion asset forfeiture. China subsequently apprehended Shenzi before he could be extradited, apparently to prevent the US from gaining access to evidence implicating Chinese state actors.
Following a ransomware attack that shut down critical US fuel infrastructure, attackers received a Bitcoin ransom payment. FBI and national security agencies used blockchain tracing combined with technical intelligence tools—likely gaining access to private keys—to trace and recover the majority of the ransom without securing physical custody of the attackers, who remained beyond US jurisdiction.
After North Korea stole $1.5 billion in Ethereum from Bybit, blockchain forensic firms tracked conversion of nearly all stolen funds to Bitcoin via ThorChain within 72 hours—a recognized North Korea laundering signature. The rapid cross-chain conversion pattern was identified in real time, enabling law enforcement to begin building an off-ramp perimeter far faster than previous state-sponsored hacks had allowed.
Extracted from Bankless, featuring Ari Redbord, former DOJ prosecutor and Head of Global Policy at TRM Labs. Validated through the Prince Group/Shenzi case, in which coordinated DOJ, OFAC, and FinCEN action achieved the largest asset forfeiture in history at $15 billion, reflecting a documented shift in US law enforcement from arrest-first to asset-seizure-first strategy.