US’s mysterious $15bn crypto haul faces questions in court

In December 2020, some $3.5 billion worth of Bitcoin was taken from its owner in what’s been called the biggest crypto hack ever. Almost five years later, the new holder of the hoard — by then worth over four times more — revealed itself. It was the US government.

What was left unsaid is how US prosecutors came by the tokens, which they allege are the proceeds from a vast criminal empire run by Chinese tycoon Chen Zhi.

“It is the largest financial takedown in US law enforcement history,” said Bradley Simon, a former federal prosecutor who is now a partner at Schlam Stone & Dolan LLP in New York. “There is a complete whodunit mystery as to how the government came into possession of the Bitcoin.”

Now, a case underway in Brooklyn federal court may finally force the government to provide some answers. Dozens of parties are asserting rights to the over 127 000 seized Bitcoin, including people who say they or their family members were victims of terrorist attacks and claim that the tokens were mined in Iran.

Even Chen, the man prosecutors accuse of the crimes that generated the Bitcoin in the first place, is claiming the coins and arguing that the US must come clean on how it got them. The fight over the crypto, which is playing out in public in hundreds of court filings, will eventually be settled by a federal judge.

Just like the criminal case against Chen, whom US prosecutors have charged with wire fraud conspiracy and money laundering (he denies all charges), the showdown over the seized Bitcoin is global in scope. How it gets resolved could have a lasting impact on crypto-crime fighting.

The Bitcoin forfeiture is the biggest in American history. The coins were originally held by an entity which, according to the US, had operations in China and Iran. They represent the proceeds from a criminal group that trafficked workers from across Asia, housed them in compounds in Cambodia and forced them to scam victims around the world out of billions of dollars, prosecutors say.

Chen’s case also goes to the heart of modern crypto law enforcement and the blockchain tools authorities use to track down and retrieve illicit funds. Prosecutors have ample reason for wanting to keep details of the seizure secret: With terrorists, criminal groups and sanctions-hit countries alike using digital assets to launder money and raise funds, being forced to reveal your methods could have massive consequences.

ADVERTISEMENT

CONTINUE READING BELOW

A spokesman for Brooklyn US Attorney Joseph Nocella, whose office filed the criminal case against Chen and the forfeiture, declined to comment on how the Bitcoin was seized. The trove was worth around $15 billion when the US announced the forfeiture in October; the value has since fallen to roughly $9 billion as the price of Bitcoin dropped.

Chinese hacking accusations

The US seizure of the Bitcoin has taken on geopolitical dimensions, with Chinese authorities openly questioning how it was accomplished. A Chinese state cybersecurity agency said in November that the 2020 hack was likely a “state-level hacker operation” led by the US. In February, the same agency leveled broader accusations of hacking and crypto theft against the US.

The 38-year-old Chen was extradited from Cambodia in January to his native China, where he’s been accused of multiple crimes.

A spokesperson for the US Justice Department’s National Security Division said the seizure and China’s actions against Chen “represent a successful disruption of a criminal organization that victimised innocent citizens of both countries,” adding that the US took “legitimate law enforcement actions against Chen Zhi.”

The seizure also touches upon Iran, which has been accused of using crypto to evade sanctions and is now at war with the US. Groups of claimants for the seized Bitcoin allege in court filings that it was mined in Iran with the regime’s backing. They represent victims of terrorist attacks who have won US court judgments against Iran for sponsoring terrorism.

Iran’s permanent mission at the United Nations didn’t respond to requests for comment.

US prosecutors allege that Chen laundered proceeds from his criminal activities through a Bitcoin mining platform called LuBian, which operated in China and Iran and was at one point the sixth-largest in the world. By 2020, he had amassed a “staggering sum” of Bitcoin which was stored in 25 crypto wallets with keys he personally maintained, according to the US.

Prosecutors, however, said in response to claimants’ filings that the seized Bitcoin had “only the most tenuous of connections to any Iranian entity,” without providing specifics.

ADVERTISEMENT:

CONTINUE READING BELOW

Chen’s lawyers filed a motion on March 10 to dismiss the US forfeiture case. They argued that many of the allegations against Chen are “provably and obviously false” and that the US failed to link the tokens to any criminal conduct. They also asked US District Judge Rachel Kovner to force the government to explain how it seized the Bitcoin, saying the US was “hiding” how it got the cryptocurrency. Prosecutors responded that Chen lacks standing in the case and his motion should be rejected.

A spokesperson for Chen and his Prince Group conglomerate, who asked to be unnamed for safety reasons, said the government’s allegations are “simply a distraction from the question DOJ is desperate not to answer: who committed the largest digital asset theft in history by hacking Lubian’s wallets in December 2020, and how did that stolen bitcoin end up in the hands of the US government? The government must be held accountable.”

A lawyer representing LuBian declined to comment.

Illicit flows soar

As the case proceeds, prosecutors will face pressure to divulge more about the Bitcoin seizure, said Tom Clark, a partner at Stewarts Law LLP in London who specializes in asset recovery.

The US “ultimately has to explain how [the Bitcoin] was seized and why it is properly attributable to the alleged wrongdoing, at least to a degree sufficient to withstand adversarial scrutiny,” he said.

LuBian was hacked in December 2020, according to court filings by representatives for the entity and Chen. The exploit, which blockchain analytics platform Arkham Intelligence has said is the biggest in crypto’s history, went unreported for years.

After the hack, the tokens stayed inactive until they were moved to new wallets starting in June 2024, according to blockchain forensics firm Elliptic. The identity of their new owner was unknown until October, when the US announced the criminal case against Chen and filed the forfeiture complaint. The government has argued in court that it’s entitled to keep the Bitcoin.

ADVERTISEMENT:

CONTINUE READING BELOW

In the absence of any official information, speculation around the nature of the LuBian exploit mushroomed, with theories ranging from a “white-hat” hacker stealing the tokens and giving them to the US to a weakness in how LuBian generated its cryptographic keys.

“It remains unclear whether it was a hack, an internal theft, or a government operation,” said Ari Redbord, global head of policy at blockchain research firm TRM Labs.

The forfeiture case is playing out as illicit crypto flows soar, in large part driven by countries seeking ways around sanctions. Last year saw an almost 700% jump in the value of cryptocurrencies received by “sanctioned entities,” according to a January report from blockchain researcher Chainalysis. That helped propel total illicit crypto flows to a record $154 billion.

This evolution means US and European governments now find themselves facing off with sophisticated nation-state actors representing key adversaries. North Korea-affiliated hackers stole $2 billion worth of cryptocurrencies last year, about 50% more than in 2024, Chainalysis estimates. Iran’s powerful Islamic Revolutionary Guard Corps is also making more use of crypto, according to the researcher.

Tipping your hand can mean putting complex, geopolitically sensitive investigations at risk.

“It makes good law enforcement sense to resist disclosing these methods for both investigative and national security reasons,” said James McGovern, a former federal prosecutor who is now in private practice at Vinson & Elkins LLP in New York. “Disclosing such tradecraft could compromise the success of future investigations.”

© 2026 Bloomberg

#USs #mysterious #15bn #crypto #haul #faces #questions #court