A regional UK police force has seized 20.21 Bitcoin and other assets valued at more than $1.4 million after tracing the funds to darknet marketplaces active between 2016 and 2019.

UK police recover 20.21 Bitcoin and other assets

Avon and Somerset Police said on Aug. 27 that its Financial Investigation Unit had recovered 20.21 BTC, other digital assets, and money held in a bank account.

The assets had a combined value of £1,032,487.86, or more than $1.4 million, when the police force valued them. Officials did not disclose the amount held in other cryptocurrencies or the bank account, nor did they identify the tokens involved.

Earlier in 2026, a court approved the forfeiture after accepting that the holdings represented proceeds from unlawful conduct. Police pursued the assets under the Proceeds of Crime Act, which allows authorities to recover property obtained through criminal activity.

The unnamed person at the center of the investigation had previously been convicted of money laundering and has since died, according to the statement. Officials did not disclose when the earlier conviction occurred, the offenses connected to it, or whether anyone else was investigated.

At Bitcoin’s current price of about $77,570, the 20.21 BTC alone would be worth approximately $1.57 million. The difference from the police valuation may come from the date on which officials calculated the total, as Bitcoin’s market price has changed since the assets were forfeited. The force did not provide a valuation date or state whether any of the Bitcoin had been converted into pounds.

Blockchain records exposed the darknet funds

Working with the force’s cyber team, financial investigators used specialist tracing methods to follow the assets to several darknet marketplaces operating from 2016 through 2019.

Police did not name the platforms but said law enforcement agencies have since closed all of them. According to the force, the marketplaces facilitated offenses ranging from drug distribution to human trafficking.

The period includes several major darknet enforcement operations. The U.S. Department of Justice closed the AlphaBay market in July 2017 after an international investigation involving authorities in the United States, Thailand, the Netherlands, Lithuania, Canada, the United Kingdom, and France.

Dutch police had secretly taken control of Hansa before closing it alongside AlphaBay. Europol said investigators operated Hansa for about one month, allowing them to collect information about vendors and customers who moved to the platform after the AlphaBay takedown.

Dream Market, another large platform from the period covered by the Avon and Somerset investigation, stopped operating in 2019. The police statement did not say whether the recovered Bitcoin passed through AlphaBay, Hansa, Dream Market, or other marketplaces.

Although darknet services can hide the people behind transactions, public blockchain records retain the movement of Bitcoin between addresses. Investigators can combine that transaction history with exchange records, seized devices, and other financial evidence to identify links between wallets and suspected criminal activity.

Detective Constable Anthony Davis of the Financial Investigation Unit said some people believe cryptocurrency can provide anonymity, conceal wealth, and keep assets outside the reach of police. In practice, he said, the blockchain stores a “permanent record of transactions” that can become “an invaluable source of evidence.”

Davis added that specialist financial investigation skills had become increasingly important for locating and recovering criminal assets held in cryptocurrencies.

UK crypto freezing powers support asset recovery

The operation is Avon and Somerset Police’s largest cryptocurrency seizure since crypto wallet freezing orders became available in April 2024.

The UK government introduced the new powers through changes to the Proceeds of Crime Act. Police can freeze cryptoassets when they have reasonable grounds to suspect a connection to illegal activity, even when authorities have not made an arrest.

Before the amendments, officers could face limits when trying to take control of digital assets during an investigation. The current rules allow authorities to transfer seized tokens into law enforcement-controlled wallets and recover items that could provide access to the funds, including written passwords and storage devices.

Officers may also destroy a cryptoasset when returning it to circulation would not serve the public interest. When the measures took effect, the UK Home Office identified privacy-focused cryptocurrencies as one type of asset that could require such treatment.

A freezing order does not itself establish that an asset is criminal property. In the Avon and Somerset case, the holdings were forfeited only after a court became satisfied that they came from unlawful conduct.

Money recovered under the Proceeds of Crime Act can be directed to policing and community programs. Avon and Somerset Police said the funds may support education, training, early intervention and crime-prevention work.

U.S. cases also rely on blockchain tracing

The British recovery follows several American cases in which investigators used transaction records to locate crypto connected to darknet services.

In January, crypto.news previously reported that the U.S. Department of Justice completed a $400 million forfeiture involving assets seized from Helix operator Larry Dean Harmon. The DOJ said Helix processed more than 354,000 BTC between 2014 and 2017 and helped customers conceal funds associated with darknet markets.

A federal court granted the U.S. government legal ownership of the Helix assets after Harmon pleaded guilty in 2021 to operating an unlicensed money-transmitting business and violating the Bank Secrecy Act. He received a three-year prison sentence in 2024.

In June, U.S. prosecutors charged two alleged operators of the AudiA6 laundering service, which authorities accused of handling more than $389 million in cryptocurrency. Blockchain analysis cited by prosecutors identified about 10,333 BTC deposited into wallets controlled by the service since 2021, including 393.39 BTC sent directly from known darknet markets, ransomware groups, and other illicit sources.

The UK has also handled much larger Bitcoin recoveries. In September 2025, Chinese national Zhimin Qian pleaded guilty after authorities recovered digital wallets containing 61,000 BTC connected to an investment fraud that targeted more than 128,000 people in China. Police discovered the wallets during a 2018 raid after receiving information about the transfer of criminal assets, according to earlier case coverage.

Trump Digital Gold has crashed 99% from its peak after wallets controlling 82.45% of the Solana token’s supply sold their holdings for about $1.01 million.

GOLD wallets sold 82.45% of the token supply

On-chain analyst EmberCN reported on Aug. 29 that wallets linked to the Trump Digital Gold token had sold their entire holdings two hours before the post, receiving 9,784.6 Solana tokens worth approximately $1.01 million.

The wallets collectively controlled 824.54 million GOLD tokens, equal to 82.454% of the asset’s total supply, through a combination of pre-allocation and purchases made shortly after trading began. Such concentrated ownership allowed the connected addresses to sell most of the circulating supply once other traders entered the market.

EmberCN called the wallets the token’s “scammers,” although no law enforcement agency or U.S. regulator had publicly identified the people controlling the addresses at the time of writing. The on-chain analyst’s post also did not name GOLD’s developers or provide evidence linking its creators directly to President Donald Trump, his family, or the Trump Organization.

GOLD was created on Solana at 7:38 a.m., according to the timeline shared by EmberCN. Less than two hours later, an X account using the handle @realtrumpcoins1 posted the token’s contract address, giving traders a direct route to buy the new asset.

The account is associated with a Trump merchandise collaboration, but its connection to branded products does not by itself establish that GOLD was an official Trump project. TrumpStore.com identifies itself as the Trump Organization’s official retail website, while the organization’s website directs customers to TrumpStore.com for its official merchandise. Neither page identified GOLD as an authorized digital asset.

Trump-linked promotion sent GOLD to a $66M peak

At around 9 a.m., the contract-address post from @realtrumpcoins1 prompted a rapid increase in trading, EmberCN said. GOLD’s market capitalization briefly reached $66 million as buyers entered the newly created market.

The token remained volatile over the next several hours before the promotional post disappeared at 11:48 a.m. According to the analyst, the connected wallet cluster began selling at the same time the account deleted the message.

Heavy selling drove GOLD’s market cap from approximately $55 million to $1 million in about 30 seconds. The addresses continued exchanging their tokens for SOL until they had disposed of the full 824.54 million-token position by around 2 p.m.

By the time EmberCN published the findings, GOLD’s market cap had fallen to approximately $700,000, representing a decline of nearly 99% from its $66 million peak. The analyst estimated that the sellers had converted their position into $1.01 million of SOL based on the cryptocurrency’s value at the time.

A separate report citing Lookonchain described 15 wallets as linked to the team and said some of the addresses had bought GOLD before the promotional post appeared. Neither on-chain account identified the owners of the wallets, and the available blockchain records alone do not establish whether the same people controlled the token or the X account.

No public statement cited by EmberCN showed that Donald Trump promoted GOLD himself. The token is also separate from Official Trump (TRUMP), the Solana memecoin launched in January 2025 and publicly promoted through Trump’s verified social media accounts.

GOLD crash follows a familiar Solana token pattern

The concentration of GOLD’s supply left buyers exposed to sales from a small wallet group. Once the holders of more than four-fifths of the supply exited, the token had few buyers capable of absorbing the volume entering the market.

As crypto.news previously explained, Solana launch platforms can make token creation and early trading almost immediate. The same process lets automated buyers, bundled wallets, and insiders acquire large positions before most retail traders find the asset.

Traditional rug pulls involve developers removing liquidity from a decentralized exchange pool. A token can also collapse when connected wallets control most of its supply and sell into demand created by social media promotion, even when liquidity has not been directly withdrawn.

GOLD’s sequence closely resembles an earlier incident involving BARRON, an unofficial token named after Trump’s son. In January 2025, an insider wallet bought 136.35 million BARRON tokens for about $1,048 before exchanging the position for 4,405 SOL worth roughly $1.05 million after the token rallied, according to a report on the dump.

Another politically branded token drew scrutiny in May 2026 after Bubblemaps connected more than 200 newly funded wallets to nearly all of its initial supply. Wallets associated with the Ghanaian former president-themed CWU token sold about $600,000 while related addresses still controlled around 85%, according to the platform’s wallet-cluster findings.

Official Trump has faced separate questions in the United States. In August, U.S. senators called for the Securities and Exchange Commission to examine whether the official token had operated as a “soft rug pull” after falling about 98% from its peak. Nansen data cited by the lawmakers showed that 988,905 of the 1.48 million wallets that bought TRUMP held combined losses of approximately $3.81 billion, as detailed in the SEC probe request.

The lawmakers’ request did not establish that fraud occurred. Any enforcement decision would require regulators to examine the token’s structure, promotion, distribution, and the economic facts surrounding its sale.

U.S. rules leave meme coin buyers with limited protection

For U.S. traders, the SEC’s Division of Corporation Finance said in February 2025 that the offer and sale of meme coins fitting its description generally do not involve securities under federal law. The staff viewed such assets as collectibles purchased mainly for entertainment, social interaction, and cultural purposes rather than investments tied to a business operation.

The SEC staff statement also said holders of meme coins covered by its analysis do not receive the protections of federal securities laws. The assessment is not binding law, and the agency said it would examine the economic reality of any product that uses a meme coin label to avoid securities requirements.

Fraudulent conduct can still lead to action under other federal or state laws even when a token is not considered a security, according to the SEC. Its Office of Investor Education and Advocacy has separately warned that fraudsters may create culture-themed tokens, promote them on social media to raise the price, and then sell their holdings before the attention disappears.

Under the agency’s description of a crypto pump-and-dump, promoters profit from the inflated price while later buyers can suffer steep losses. The investor alert advises traders not to rely solely on social media posts or celebrity associations when deciding whether to buy a crypto asset.

Hyperliquid has received its first reported builder-deployed HIP-4 outcome exchange after OUT completed deployment through the network’s permissionless market framework.

Hyperliquid’s block explorer shows that a successful on-chain transaction registered the Outcome DEX under the name OUT through the HIP-4 deployment framework.

The transaction confirms OUT’s deployment but does not show whether its markets have opened for live trading. No separate announcement or verifiable website detailing its markets, liquidity, or trading activity was available at the time of writing.

Hyperliquid’s HIP-4 framework lets builders create markets

According to Hyperliquid’s developer documentation, HIP-4 lets approved deployers create outcome markets without seeking validator approval for every individual contract. Each market must still follow a template that the validator set has previously approved.

Templates define the basic form of a contract, its available results, and how it settles. Once validators approve one, a deployer can use the same structure to create separate markets that meet its conditions.

A YES/NO template allows traders to choose between two possible results. Multi-result templates can cover questions with several possible answers, although Hyperliquid’s main HIP-4 documentation says multi-outcome support was not included in the initial mainnet release and would arrive in stages.

Hyperliquid’s deployer page, updated on Aug. 13, lists functions for activating a DEX, selecting templates, setting a deployer fee scale, and creating markets. The documentation currently labels its HIP-4 deployer actions as testnet-only, meaning OUT’s deployment should not yet be described as a confirmed permissionless mainnet launch without additional evidence.

As crypto.news previously reported in July, Hyperliquid’s permissionless deployment plan was scheduled to begin on testnet before reaching mainnet. The proposal required market operators to stake 500,000 HYPE and allowed validators to slash deployers for incorrect or delayed settlement, according to the July report.

Separate stakes are required for HIP-3 and HIP-4 operations because one HYPE allocation cannot support both deployments at the same time, according to Hyperliquid’s framework. At current prices, the requirement can create a high entry cost for independent teams seeking to operate both perpetual and outcome exchanges.

HIP-4 outcome contracts remove leverage and liquidations

Hyperliquid introduced HIP-4 on testnet in February before activating its first outcome contracts on mainnet on May 2. A July HIP-4 framework explainer described the products as fully collateralized contracts that settle within a fixed range at expiration.

Unlike perpetual futures, an outcome position does not rely on borrowed funds or recurring payments between long and short traders. HIP-4 has no funding rate, while fully funded positions remove the liquidation process used to close leveraged trades when collateral falls below maintenance requirements.

For a binary market, a YES token settles at 1 if the stated event occurs and at 0 if it does not. The NO side receives the opposite result. A trader buying YES at 0.60 can earn 0.40 per contract if the event happens, while the purchase price represents the maximum possible loss.

Hyperliquid’s documentation describes HIP-4 as a general-purpose tool rather than a system limited to conventional prediction questions. Its fixed-range structure can also support bounded options-style products whose maximum payout and loss are known when the position opens.

Trading takes place through HyperCore, the network’s on-chain order-book engine. HyperCore also runs Hyperliquid’s spot, perpetual, and HIP-3 builder-deployed markets, allowing HIP-4 products to use the same matching infrastructure and order types.

Fees are not charged when an outcome position opens, according to the protocol documentation. Charges can apply when a trader closes, burns, or settles a position, although Hyperliquid waived outcome-market fees during its initial testing period.

Bitcoin and CPI contracts tested HIP-4 settlement

Hyperliquid’s first mainnet HIP-4 product was a recurring Bitcoin binary contract. The market settled each day at 06:00 UTC against the BTC mark price published through HyperCore, providing an objective data point for deciding whether YES or NO tokens received the payout.

The network later expanded the product beyond crypto prices. In May, a U.S. CPI contract allowed traders to take positions on the annual inflation rate reported by the Bureau of Labor Statistics.

The CPI market offered three possible results: below 4.3%, exactly 4.3%, or above 4.3%. It used USDC as collateral and was scheduled to settle from the official BLS release, while early activity stood at about $3,000 in volume and $5,000 in open interest.

Validator-settled markets subsequently covered Federal Reserve decisions and sporting events, according to Galaxy Research. The research firm said validators could publish approved off-chain results through regular network operations, reducing reliance on a separate oracle provider.

Galaxy reported that HIP-4 recorded $2.38 million in 24-hour Bitcoin outcome volume by its 25th day. The total represented about 20% of the combined BTC prediction-market volume measured between Hyperliquid and Polymarket during that period, according to the firm’s June report.

Activity later declined after an early increase tied to World Cup markets. Blockworks data cited in a July market report placed HIP-4 open interest at about $182,000 and cumulative notional activity at approximately $881,000 at the time, though the figures covered a later snapshot and used a different measurement period.

U.S. access depends on event-contract regulation

For American traders, OUT does not carry the same regulatory status as Kalshi, which operates event contracts through a Commodity Futures Trading Commission-registered designated contract market. Hyperliquid has not announced that OUT is registered with the CFTC or available to U.S. users.

Hyperliquid Policy Center and Multicoin Capital addressed the regulatory divide in a July prediction-market rules filing. The groups asked the CFTC to publish clear federal standards for reviewing event contracts and explain publicly why specific contracts are approved or rejected.

Their submission said settlement terms should determine whether a contract falls into restricted categories involving gaming, war, assassination, or unlawful activity. The filing represented an industry policy request and did not give HIP-4 exchanges permission to serve U.S. traders.

State and federal regulators have also disputed whether some sports event contracts qualify as federally regulated derivatives or state-regulated wagers. Kalshi, Crypto.com and Robinhood have faced state challenges over sports-related products even when the contracts were offered through federally regulated market structures.

Hyperliquid users in the United States remain unable to access the protocol, according to an August filing cited by Hyperliquid Strategies. The company said it was unaware of a pending CFTC approval process for the network and warned that a route into the regulated U.S. market could not be assured.

A Solana token promoted under the Real Trump Coins brand collapsed within hours of its launch, according to blockchain analytics and on-chain activity. The episode has quickly sparked scrutiny over the token’s legitimacy and raised questions about whether the brand’s social accounts or website were compromised.

Real Trump Coins—an outlet that US President Donald Trump publicly promoted in 2024—advertised a “Trump Digital GOLD” token on X before deleting related posts on Saturday. Blockchain analytics firm Lookonchain later flagged the launch, alleging that the team behind the token controlled a large portion of the supply and used newly created wallets to dump holdings shortly after launch, causing the token’s value to plunge.

Key takeaways

• Lookonchain says GOLD’s developer and associated wallets controlled about 82.45% of the token supply at the time of the analysis.
• After being acquired by 15 newly created wallets, 224.5 million GOLD was reportedly sold for 3,178 SOL (about $330,000 at the time), contributing to a rapid price collapse.
• DE X Screener data cited in the reports shows GOLD’s market capitalization dropped from roughly $50 million to about $500,000 within hours.
• Real Trump Coins’ website continued promoting the GOLD token after the X posts were deleted, leaving observers to question who initiated the launch and promotion.
• The incident adds to broader concerns around Trump-linked crypto brands as US policymakers debate a regulatory framework for digital assets.

GOLD launch on Solana ends in rapid sell-off

The token surfaced early Saturday after the Real Trump Coins X account—an account that Trump’s official profile follows—posted about the GOLD launch and directed users to RealTrumpCoins.com. Shortly after, Lookonchain flagged the activity, drawing attention to wallet distribution and the token’s early trading behavior.

In a thread referencing the on-chain setup, Lookonchain said the developer held 600 million GOLD while 15 newly created wallets spent $18,657 to buy an additional 224.5 million tokens. Lookonchain also warned that the team “currently controls 82.45% of the total supply,” advising traders to exercise caution.

Lookonchain later reported that those 15 wallets sold all 224.5 million GOLD for 3,178 SOL, describing it as an apparent rug-style extraction of value soon after acquisition. The same analysis estimated the wallets’ profit at roughly $312,000—about 17 times the initial amount invested.

As selling spread, the token’s valuation deteriorated quickly. According to DEX Screener data referenced in the reporting, GOLD’s market capitalization fell from about $50 million to around $500,000 at the time of publication.

For traders, the takeaway is not just that the token declined, but how quickly supply concentration and early transfers translated into market impact. Such a pattern—large holdings clustered near the deployer paired with rapid post-launch selling—often leaves retail buyers with limited exit liquidity.

Real Trump Coins keeps marketing GOLD after X deletion

Real Trump Coins’ connection to the episode matters because Trump has previously promoted the brand. The company’s site continued advertising GOLD at the time of publication, including a claim that it would charge a 4% trading fee and that it would use 99% of those fees to buy back the token in an attempt to push it toward a top-10 ranking by market capitalization.

However, observers noted a mismatch between marketing on the website and the behavior of the brand’s X account. Lookonchain reported that Real Trump Coins promoted GOLD on X and then deleted the related posts on Saturday.

That combination—public promotion followed by deletion, while the website remains active—has fueled speculation that either the token launch was mishandled, or that the brand’s online presence may have been compromised. Some crypto commentators went further, describing the setup as an apparent scam or rug pull, though the reports in circulation included claims that were not independently substantiated within the available facts.

The immediate practical concern for users is how to verify whether token promotions stem from legitimate operators or from unauthorized actors. In incidents like this, “official-looking” social posts may not be enough, and the contract’s distribution, liquidity conditions, and wallet behavior can become the more reliable indicators.

Why the Real Trump Coins tie is under scrutiny

Real Trump Coins was publicly promoted by Donald Trump in September 2024, when he highlighted RealTrumpCoins.com during announcements related to his silver medallions. The website’s terms state that its products are not manufactured, distributed, or sold by the Trump Organization.

Even with that disclaimer, the GOLD incident revived attention on the ecosystem of Trump-linked crypto activity and the potential governance and conflict-of-interest concerns that come with high-profile endorsements. The episode lands as Trump continues to press Congress on crypto oversight, including legislation aimed at establishing a regulatory framework and clarifying whether tokens should be treated as securities or commodities.

In the weeks and months preceding the broader regulatory debate, Trump and his family have backed or launched multiple crypto ventures, including the Official Trump memecoin and World Liberty Financial. The White House has denied impropriety in connection with these efforts, but incidents like the GOLD collapse inevitably intensify public scrutiny of how legitimacy is communicated to retail investors.

Earlier reporting on these policy efforts has emphasized that lawmakers’ decisions could shape how token issuers and promoters are regulated—especially when promotional reach overlaps with political visibility. In that context, the GOLD episode is less about one token’s fate and more about the recurring problem of investor harm when marketing appears to outpace verification.

What to watch next

For now, traders and observers will likely focus on whether the GOLD token’s contract and wallet flows show any further coordinated activity, and whether Real Trump Coins addresses the on-chain behavior that Lookonchain highlighted. More broadly, the incident underscores how quickly reputational risk can spread when high-profile branding intersects with on-chain launches—especially in the absence of clear, verifiable operator confirmation.

INTERPOL has reported 58 arrests, 263 identified suspects and $2.67 million seized after a 22-country operation targeted crypto investment scams, romance fraud and money laundering networks.

According to an official INTERPOL release published on Aug. 25, Operation Jackal IV ran for eight months from November 2025 through June 2026 and focused on the financial systems used by West African organized crime groups.

Authorities from 22 countries across six continents took part in the operation, including the United States, the United Kingdom, Canada, the United Arab Emirates, South Africa, Argentina, Nigeria, Romania, and several European countries.

Investigators focused on groups such as Black Axe and similar criminal organizations accused of running romance scams, fake cryptocurrency investments, business email fraud, and other financial crimes. Police also tracked the shell companies, bank accounts, digital wallets, and outside service providers used to receive or conceal stolen money.

During the operation, INTERPOL helped participating agencies exchange intelligence across borders, analyze financial activity, and coordinate enforcement work. The organization also provided specialist training to investigators handling money laundering cases.

“By following illicit financial flows across borders, we are attacking the very lifeblood of organized crime and making it increasingly difficult for criminal networks to profit from their activities,” said Tomonobu Kaya, director of the INTERPOL Financial Crime and Anti-Corruption Centre.

Interpol crypto scam operation leads to 58 arrests

Operation Jackal IV resulted in 58 arrests and the identification of another 263 people suspected of links to the targeted criminal networks, according to INTERPOL.

In Argentina, federal police uncovered a Crime-as-a-Service network suspected of supplying website domains and money laundering support to West African crime groups. Investigators identified 196 people connected to the operation and arrested 17 suspects.

An INTERPOL Operational Support Team assisted Argentine authorities with the examination of seized information. The team analyzed the material for links among suspects, criminal groups, and overseas partners while helping local investigators develop additional leads.

South African authorities conducted the largest enforcement action reported in the operation, arresting 39 people during raids at seven locations in Johannesburg. Police linked the sites to a group accused of running romance and investment scams against retirees in English-speaking countries.

According to INTERPOL, members of the network handled different stages of the fraud, with some working as “conversion” agents and others serving as “retention” agents. Such roles involved turning initial contacts into paying victims and persuading existing victims to continue sending money.

Police seized $2.67 million, blocked 257 bank accounts, and collected evidence during the Johannesburg raids. An INTERPOL support team also worked in South Africa to help local investigators examine the network’s financial and international links.

The agency’s release lists 17 arrests in Argentina and 39 in South Africa, accounting for 56 of its stated 58 arrests. However, the same release separately reports 11 arrests in Romania, bringing the country-level figures mentioned in the statement to 67. INTERPOL did not explain whether the Romanian arrests were included in its headline total or treated as the result of a connected investigation.

Romanian investment scam allegedly moved €143 million

Romanian police dismantled a call center accused of offering investors large returns from stocks and cryptocurrencies. INTERPOL said the suspects redirected victims’ deposits to electronic wallets under their control rather than placing the money in genuine investments.

Investigators estimated that the group stole and laundered about €143 million worldwide. Police arrested 11 people and seized approximately €330,000 in cash and cryptocurrency, six properties and several luxury watches.

In Italy, investigators identified one person suspected of involvement in a money laundering network operating across Europe. According to INTERPOL, the network used shell companies, remittance services, and cash withdrawals to hide the source of funds.

A single bank account processed €845,000 across 560 transactions involving 20 financial instruments, the agency said. Investigators did not report an arrest in the Italian case, and the inquiry remained tied to the identification of one suspect.

Operation Jackal IV also found that some West African crime groups were buying Crime-as-a-Service tools from outside providers, often through dark web markets. INTERPOL said such arrangements allowed fraud groups to outsource website infrastructure, money laundering, and other technical work instead of managing every part of their operations internally.

In July, crypto.news reported another INTERPOL operation that produced 5,811 arrests and intercepted $293 million in illicit assets across 97 countries and territories. Operation First Light also identified more than 142,000 victims and blocked over 31,000 bank accounts while targeting romance scams, investment fraud and related money laundering.

Thai police uncovered a crypto laundering network during that earlier operation, with INTERPOL saying one wallet processed more than $122.5 million over 10 months. Investigators alleged that the network moved romance scam proceeds through several digital assets and used cross-chain swaps to make the money harder to trace.

U.S. authorities pursue overseas crypto scam proceeds

The United States was among the 22 countries participating in Operation Jackal IV, although INTERPOL’s release did not describe a specific U.S. arrest or asset seizure from the operation.

American authorities have separately pursued overseas networks accused of targeting U.S. residents with similar romance and crypto investment schemes. In July, the Department of Justice sought the forfeiture of $25 million in cryptocurrency recovered through five investigations involving suspected victims in the United States and Canada.

According to the U.S. Attorney’s Office for the District of Columbia, the five cases involved fake cryptocurrency platforms and laundering networks with links to China, Malaysia and Cambodia. Prosecutors said the DOJ’s Scam Center Strike Force had seized more than $800 million since its creation in November 2025.

One of the investigations involved more than 270 suspected victim transfers and approximately $10.4 million in cryptocurrency, while another covered over 200 romance scam victims and $12.1 million in assets. Under the civil forfeiture process, eligible victims may seek compensation if courts approve the government’s claims to the recovered funds.

During a separate June enforcement action, Coinbase froze over $3 million in cryptocurrency tied to alleged Southeast Asian scam networks. The exchange worked with the DOJ, Meta, Microsoft, Starlink and overseas law enforcement agencies to identify financial transfers and online infrastructure linked to romance and investment fraud.

Meta disabled more than 1.4 million accounts, pages and groups connected to suspected scams, while Microsoft suspended about 20,000 accounts. Starlink terminated service for thousands of internet kits associated with suspected unlawful activity, and the Royal Thai Police arrested 63 people linked to scam operations.