[{"data":1,"prerenderedAt":1234},["ShallowReactive",2],{"tag-asset-recovery":3},[4,706],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":22,"featured":7,"body":23,"_type":700,"_id":701,"_source":702,"_file":703,"_stem":704,"_extension":705},"\u002Farticles\u002F32-crypto-forfeiture-remission-restitution","articles",false,"","Civil forfeiture is not restitution: how crypto victims get paid","How crypto victims get paid after a federal forfeiture: ownership claims, remission, restoration, and restitution, with deadlines and proof requirements.","crypto-forfeiture-remission-restitution","2026-07-18","Nick Kampe",12,"Legal Reference",[17,18,19,20,21],"forfeiture","asset-recovery","victim-rights","restitution","digital-assets","\u002Fog\u002Fcrypto-forfeiture-remission-restitution.png",{"type":24,"children":25,"toc":682},"root",[26,34,39,46,175,191,197,211,225,230,236,259,273,286,292,297,310,340,354,365,394,400,431,461,467,539,544,550,555,560,594,600,607,617,623,632,638,647,653,662,668,677],{"type":27,"tag":28,"props":29,"children":30},"element","p",{},[31],{"type":32,"value":33},"text","When federal law enforcement seizes cryptocurrency from a fraud scheme, victims often assume the government will return the funds. It will not, at least not automatically. Seizure preserves property and forfeiture transfers title to the United States; neither puts money in a victim's hands. Four channels return value to victims: an ownership claim in the forfeiture action, an administrative petition for remission, statutory restoration of forfeited property, and criminal restitution. Each involves a different decision maker, legal burden, and deadline structure. This article maps those channels using the OneCoin remission program as a dated template and explains the documentation required to prove a qualifying loss.",{"type":27,"tag":28,"props":35,"children":36},{},[37],{"type":32,"value":38},"This reference addresses federal law. State forfeiture statutes differ, and every federal program publishes its own rules.",{"type":27,"tag":40,"props":41,"children":43},"h2",{"id":42},"what-channels-actually-return-value-to-a-victim",[44],{"type":32,"value":45},"What Channels Actually Return Value to a Victim?",{"type":27,"tag":47,"props":48,"children":49},"table",{},[50,79],{"type":27,"tag":51,"props":52,"children":53},"thead",{},[54],{"type":27,"tag":55,"props":56,"children":57},"tr",{},[58,64,69,74],{"type":27,"tag":59,"props":60,"children":61},"th",{},[62],{"type":32,"value":63},"Channel",{"type":27,"tag":59,"props":65,"children":66},{},[67],{"type":32,"value":68},"Who decides",{"type":27,"tag":59,"props":70,"children":71},{},[72],{"type":32,"value":73},"What it can return",{"type":27,"tag":59,"props":75,"children":76},{},[77],{"type":32,"value":78},"Controlling law",{"type":27,"tag":80,"props":81,"children":82},"tbody",{},[83,107,130,152],{"type":27,"tag":55,"props":84,"children":85},{},[86,92,97,102],{"type":27,"tag":87,"props":88,"children":89},"td",{},[90],{"type":32,"value":91},"Ownership claim",{"type":27,"tag":87,"props":93,"children":94},{},[95],{"type":32,"value":96},"The court",{"type":27,"tag":87,"props":98,"children":99},{},[100],{"type":32,"value":101},"Specific seized property, if claimant's interest defeats the government's",{"type":27,"tag":87,"props":103,"children":104},{},[105],{"type":32,"value":106},"18 U.S.C. § 983; 21 U.S.C. § 853(n); Supplemental Rule G",{"type":27,"tag":55,"props":108,"children":109},{},[110,115,120,125],{"type":27,"tag":87,"props":111,"children":112},{},[113],{"type":32,"value":114},"Petition for remission",{"type":27,"tag":87,"props":116,"children":117},{},[118],{"type":32,"value":119},"Attorney General's designee",{"type":27,"tag":87,"props":121,"children":122},{},[123],{"type":32,"value":124},"Discretionary share of forfeited value",{"type":27,"tag":87,"props":126,"children":127},{},[128],{"type":32,"value":129},"28 C.F.R. Part 9",{"type":27,"tag":55,"props":131,"children":132},{},[133,138,142,147],{"type":27,"tag":87,"props":134,"children":135},{},[136],{"type":32,"value":137},"Restoration of forfeited property",{"type":27,"tag":87,"props":139,"children":140},{},[141],{"type":32,"value":119},{"type":27,"tag":87,"props":143,"children":144},{},[145],{"type":32,"value":146},"Forfeited funds transferred to the court to pay an existing restitution order",{"type":27,"tag":87,"props":148,"children":149},{},[150],{"type":32,"value":151},"18 U.S.C. § 981(e)(6); 21 U.S.C. § 853(i)(1) via § 982(b)(1)",{"type":27,"tag":55,"props":153,"children":154},{},[155,160,165,170],{"type":27,"tag":87,"props":156,"children":157},{},[158],{"type":32,"value":159},"Criminal restitution",{"type":27,"tag":87,"props":161,"children":162},{},[163],{"type":32,"value":164},"Sentencing court",{"type":27,"tag":87,"props":166,"children":167},{},[168],{"type":32,"value":169},"Judgment against defendant for full loss in qualifying cases",{"type":27,"tag":87,"props":171,"children":172},{},[173],{"type":32,"value":174},"18 U.S.C. §§ 3663A, 3664, 3613",{"type":27,"tag":28,"props":176,"children":177},{},[178,180,189],{"type":32,"value":179},"The first two channels are the most common and easily conflated. An ownership claim asserts superior legal title to specific seized property. A victim remission petition under ",{"type":27,"tag":181,"props":182,"children":186},"a",{"href":183,"rel":184},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F28\u002F9.8",[185],"nofollow",[187],{"type":32,"value":188},"28 C.F.R. § 9.8",{"type":32,"value":190}," is for a person without a present ownership interest in the forfeited property; it seeks a discretionary share of forfeited value based on documented pecuniary loss. A victim may pursue a judicial ownership claim and, where the governing forfeiture statute permits, seek remission. Missing the judicial claim deadline ordinarily ends the right to contest title, leaving discretionary administrative relief as the remaining avenue.",{"type":27,"tag":40,"props":192,"children":194},{"id":193},"the-onecoin-process-a-dated-example-of-a-victim-program",[195],{"type":32,"value":196},"The OneCoin Process: A Dated Example of a Victim Program",{"type":27,"tag":28,"props":198,"children":199},{},[200,202,209],{"type":32,"value":201},"The ",{"type":27,"tag":181,"props":203,"children":206},{"href":204,"rel":205},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-announces-compensation-process-onecoin-fraud-victims-funds-recovered",[185],[207],{"type":32,"value":208},"Justice Department's April 13, 2026 announcement",{"type":32,"value":210}," of a OneCoin victim compensation process illustrates how these programs operate. Several key figures have been sentenced, and the government pursued criminal forfeiture of scheme proceeds. The Department reported that more than $40 million in forfeited assets was available for victim compensation.",{"type":27,"tag":28,"props":212,"children":213},{},[214,216,223],{"type":32,"value":215},"The mechanics highlight program-specific rules. The Justice Department identified Kroll Settlement Administration as the remission administrator. The ",{"type":27,"tag":181,"props":217,"children":220},{"href":218,"rel":219},"https:\u002F\u002Fwww.fbi.gov\u002Fnews\u002Fstories\u002Fcompensation-for-victims-of-onecoin-cryptocurrency-investment-fraud",[185],[221],{"type":32,"value":222},"FBI's June 25, 2026 notice",{"type":32,"value":224}," stated that the program covered people who purchased OneCoin between 2014 and 2019 and suffered a net loss after completed withdrawals. It also identified June 30, 2026 as the filing deadline. That deadline has passed.",{"type":27,"tag":28,"props":226,"children":227},{},[228],{"type":32,"value":229},"Remission deadlines require careful management. General regulations allow petitions until forfeited property is disposed of (28 C.F.R. § 9.8(a)(2)), but specific programs establish firm administrative cutoffs. When the government announces a remission process, counsel should calendar the deadline immediately. Reconsideration under 28 C.F.R. § 9.3(j) in administrative matters or § 9.4(k) in judicial matters is not a cure for a missed deadline; it is available only after denial of a petition.",{"type":27,"tag":40,"props":231,"children":233},{"id":232},"ownership-claims-vs-discretionary-relief-what-is-the-difference",[234],{"type":32,"value":235},"Ownership Claims vs. Discretionary Relief: What Is the Difference?",{"type":27,"tag":28,"props":237,"children":238},{},[239,241,248,250,257],{"type":32,"value":240},"Standing is the dividing line. In civil forfeiture, a claimant must file a verified claim within 30 days of complaint service or of final publication of notice under ",{"type":27,"tag":181,"props":242,"children":245},{"href":243,"rel":244},"https:\u002F\u002Fwww.law.cornell.edu\u002Fuscode\u002Ftext\u002F18\u002F983",[185],[246],{"type":32,"value":247},"18 U.S.C. § 983(a)(4)(A)",{"type":32,"value":249},", and an answer or Rule 12 motion within 21 days after filing the claim under ",{"type":27,"tag":181,"props":251,"children":254},{"href":252,"rel":253},"https:\u002F\u002Fuscode.house.gov\u002Fview.xhtml?edition=prelim&num=0&req=granuleid%3AUSC-prelim-title28a-node89-node213-ruleG",[185],[255],{"type":32,"value":256},"Supplemental Rule G(5)(b)",{"type":32,"value":258},". The claimant must demonstrate Article III standing through a colorable interest in the specific seized property.",{"type":27,"tag":28,"props":260,"children":261},{},[262,264,271],{"type":32,"value":263},"In criminal forfeiture, third parties assert interests via ancillary proceedings. Under ",{"type":27,"tag":181,"props":265,"children":268},{"href":266,"rel":267},"https:\u002F\u002Fwww.law.cornell.edu\u002Fuscode\u002Ftext\u002F21\u002F853",[185],[269],{"type":32,"value":270},"21 U.S.C. § 853(n)(2)",{"type":32,"value":272},", petitions are due within 30 days of final publication of notice or receipt of notice, whichever is earlier. The petitioner must establish by a preponderance of the evidence either a superior vested interest or bona fide purchaser status (§ 853(n)(6)).",{"type":27,"tag":28,"props":274,"children":275},{},[276,278,284],{"type":32,"value":277},"Administrative remission under ",{"type":27,"tag":181,"props":279,"children":282},{"href":280,"rel":281},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-28\u002Fchapter-I\u002Fpart-9",[185],[283],{"type":32,"value":129},{"type":32,"value":285}," is discretionary. The ruling official decides petitions on written documentation. No hearing is held, and denials allow only one reconsideration request. Persons without a present ownership interest in the seized property typically cannot meet the standing or third-party-interest showings required in court; a well-supported remission petition is usually the viable avenue. A victim with a colorable ownership interest should assess the applicable judicial claim deadline and may concurrently request remission as an owner where the regulations allow it. In civil forfeiture, a frivolous assertion of interest risks a fine under 18 U.S.C. § 983(h)(1) of 10 percent of the forfeited property's value ($250 minimum, $5,000 maximum).",{"type":27,"tag":40,"props":287,"children":289},{"id":288},"what-evidence-proves-a-qualifying-loss",[290],{"type":32,"value":291},"What Evidence Proves a Qualifying Loss?",{"type":27,"tag":28,"props":293,"children":294},{},[295],{"type":32,"value":296},"Across remission, restoration, and restitution, proof requirements converge on four elements: acquisition payment, transaction path, net loss calculation, and absence of collateral recovery.",{"type":27,"tag":28,"props":298,"children":299},{},[300,302,308],{"type":32,"value":301},"Under ",{"type":27,"tag":181,"props":303,"children":305},{"href":183,"rel":304},[185],[306],{"type":32,"value":307},"28 C.F.R. § 9.8(b)",{"type":32,"value":309},", victim remission requires documentary proof of five elements:",{"type":27,"tag":311,"props":312,"children":313},"ol",{},[314,320,325,330,335],{"type":27,"tag":315,"props":316,"children":317},"li",{},[318],{"type":32,"value":319},"A pecuniary loss of a specific amount directly caused by the offense or a related offense, supported by documentary evidence including invoices and receipts.",{"type":27,"tag":315,"props":321,"children":322},{},[323],{"type":32,"value":324},"The loss directly resulted from illegal acts rather than lawful conduct during the offense.",{"type":27,"tag":315,"props":326,"children":327},{},[328],{"type":32,"value":329},"The victim did not knowingly contribute to, participate in, benefit from, or act with willful blindness toward the scheme.",{"type":27,"tag":315,"props":331,"children":332},{},[333],{"type":32,"value":334},"The victim has not received compensation from the perpetrator or third parties.",{"type":27,"tag":315,"props":336,"children":337},{},[338],{"type":32,"value":339},"The victim lacks reasonably available recourse to other assets for compensation.",{"type":27,"tag":28,"props":341,"children":342},{},[343,345,352],{"type":32,"value":344},"Recoverable loss is capped at fair market value on the date of loss. No allowance is made for forgone interest or for collateral expenses incurred to recover lost property or to seek other recompense (28 C.F.R. § 9.8(c)). When recognized victims cannot be paid in full because forfeited property is limited, the ruling official should generally grant remission on a pro rata basis, while retaining discretion to set priorities in individual cases (28 C.F.R. § 9.8(f)). Under ",{"type":27,"tag":181,"props":346,"children":349},{"href":347,"rel":348},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F28\u002F9.4",[185],[350],{"type":32,"value":351},"28 C.F.R. § 9.4(c)(2)",{"type":32,"value":353},", every factual statement must be supported by a declaration under penalty of perjury meeting 28 U.S.C. § 1746.",{"type":27,"tag":28,"props":355,"children":356},{},[357,363],{"type":27,"tag":358,"props":359,"children":360},"strong",{},[361],{"type":32,"value":362},"Hypothetical example:",{"type":32,"value":364}," A client invested $60,000 into a fraudulent token scheme between 2021 and 2023, withdrew $12,000 before its collapse, and federal authorities seized the scheme's wallets in 2025. The claim package requires: exchange KYC and transaction logs; bank wire confirmations; transaction hashes linking withdrawals to seized addresses; a net loss calculation of $48,000; and verified declarations disclaiming outside recovery. Claimed losses reflect fair market value on the date of the occurrence of the loss. Any transfers across intermediary wallets must be fully reconciled, as unaccounted movements distort net loss calculations and undermine the perjury declaration.",{"type":27,"tag":28,"props":366,"children":367},{},[368,370,376,378,384,386,392],{"type":32,"value":369},"Establishing this evidentiary chain relies on ",{"type":27,"tag":181,"props":371,"children":373},{"href":372},"\u002Fservices#blockchain-tracing",[374],{"type":32,"value":375},"blockchain tracing",{"type":32,"value":377}," and forensic ",{"type":27,"tag":181,"props":379,"children":381},{"href":380},"\u002Fresources\u002Fdeconstructing-ponzi-blockchain-methodology",[382],{"type":32,"value":383},"deconstruction methodology for scheme-level fund flows",{"type":32,"value":385},". ConsensusIntel's documented ",{"type":27,"tag":181,"props":387,"children":389},{"href":388},"\u002Fmethodology",[390],{"type":32,"value":391},"analysis methodology",{"type":32,"value":393}," governs how transaction paths, cluster attribution, and loss schedules are structured for petitions and court exhibits. Counsel should verify tracing models independently rather than adopting the government's seizure schedules uncritically.",{"type":27,"tag":40,"props":395,"children":397},{"id":396},"duplicate-recovery-intermediaries-and-restitution-the-traps",[398],{"type":32,"value":399},"Duplicate Recovery, Intermediaries, and Restitution: The Traps",{"type":27,"tag":28,"props":401,"children":402},{},[403,405,411,413,420,422,429],{"type":32,"value":404},"Anti-double-recovery rules govern all federal channels. Remission petitioners must attest to receiving no outside compensation; ",{"type":27,"tag":181,"props":406,"children":408},{"href":183,"rel":407},[185],[409],{"type":32,"value":410},"28 C.F.R. § 9.8(g)",{"type":32,"value":412}," requires reimbursement to the Assets Forfeiture Fund if compensation is later obtained from another source. Criminal restitution under the Mandatory Victims Restitution Act (MVRA) is a related but separate obligation. Sentencing courts must order restitution for each victim's full loss without consideration of the defendant's economic circumstances (18 U.S.C. § 3664(f)(1)(A)), defining ",{"type":27,"tag":181,"props":414,"children":417},{"href":415,"rel":416},"https:\u002F\u002Fwww.law.cornell.edu\u002Fuscode\u002Ftext\u002F18\u002F3663A",[185],[418],{"type":32,"value":419},"qualifying victims",{"type":32,"value":421}," as those directly and proximately harmed by the offense. Restitution orders create federal judgment liens; under ",{"type":27,"tag":181,"props":423,"children":426},{"href":424,"rel":425},"https:\u002F\u002Fwww.law.cornell.edu\u002Fuscode\u002Ftext\u002F18\u002F3613",[185],[427],{"type":32,"value":428},"18 U.S.C. § 3613",{"type":32,"value":430},", liability terminates on the later of 20 years from entry of judgment or 20 years after release from imprisonment, and the defendant's estate remains liable upon death. A victim may receive remission proceeds and restitution, but overlapping recoveries trigger the reimbursement duty in § 9.8(g).",{"type":27,"tag":28,"props":432,"children":433},{},[434,436,443,445,451,453,459],{"type":32,"value":435},"Intermediary transactions present distinct complications. In money laundering forfeitures, ",{"type":27,"tag":181,"props":437,"children":440},{"href":438,"rel":439},"https:\u002F\u002Fwww.law.cornell.edu\u002Fuscode\u002Ftext\u002F18\u002F982",[185],[441],{"type":32,"value":442},"18 U.S.C. § 982(b)(2)",{"type":32,"value":444}," shields defendants from substitute-asset forfeiture if they acted merely as intermediaries handling but not retaining property, unless they conducted three or more separate transactions involving a total of $100,000 or more in any twelve-month period. On the victim side, counsel should document continuity through exchanges, payment processors, or OTC desks so the petition can connect the claimed loss to the underlying offense. Subpoenaed transaction data from an ",{"type":27,"tag":181,"props":446,"children":448},{"href":447},"\u002Fservices#exchange-custody",[449],{"type":32,"value":450},"exchange custody and records practice",{"type":32,"value":452}," can substantiate that route; gaps may weaken the causal proof required under § 9.8(b). Analyses prepared for insolvency cannot be reused without adjustment; as shown in our ",{"type":27,"tag":181,"props":454,"children":456},{"href":455},"\u002Fresources\u002Fcryptocurrency-bankruptcy-trustee-checklist",[457],{"type":32,"value":458},"bankruptcy trustee checklist",{"type":32,"value":460},", remission demands net-loss reconciliation rather than general estate tracing.",{"type":27,"tag":40,"props":462,"children":464},{"id":463},"checklist-deadlines-and-documentation-before-filing",[465],{"type":32,"value":466},"Checklist: Deadlines and Documentation Before Filing",{"type":27,"tag":311,"props":468,"children":469},{},[470,480,490,500,510,520],{"type":27,"tag":315,"props":471,"children":472},{},[473,478],{"type":27,"tag":358,"props":474,"children":475},{},[476],{"type":32,"value":477},"Identify the governing channel:",{"type":32,"value":479}," Distinguish between administrative forfeiture notices, civil judicial complaints, and preliminary criminal forfeiture orders.",{"type":27,"tag":315,"props":481,"children":482},{},[483,488],{"type":27,"tag":358,"props":484,"children":485},{},[486],{"type":32,"value":487},"Calendar judicial deadlines:",{"type":32,"value":489}," File civil claims within 30 days of complaint service or of final publication of notice under § 983(a)(4)(A) (answer within 21 days after filing the claim under Rule G(5)(b)), or criminal third-party petitions within 30 days of final publication or actual notice, whichever is earlier, under § 853(n)(2). For remission, monitor published administrative deadlines.",{"type":27,"tag":315,"props":491,"children":492},{},[493,498],{"type":27,"tag":358,"props":494,"children":495},{},[496],{"type":32,"value":497},"Identify deciding authorities:",{"type":32,"value":499}," Note the ruling official, designated administrator, and official submission portal.",{"type":27,"tag":315,"props":501,"children":502},{},[503,508],{"type":27,"tag":358,"props":504,"children":505},{},[506],{"type":32,"value":507},"Compile the loss package:",{"type":32,"value":509}," Assemble unaltered records of fiat wires, exchange logs, wallet addresses, transaction hashes, and net loss calculations.",{"type":27,"tag":315,"props":511,"children":512},{},[513,518],{"type":27,"tag":358,"props":514,"children":515},{},[516],{"type":32,"value":517},"Execute statutory declarations:",{"type":32,"value":519}," Verify all factual statements under penalty of perjury (28 U.S.C. § 1746; 28 C.F.R. § 9.4(c)(2)).",{"type":27,"tag":315,"props":521,"children":522},{},[523,528,530,537],{"type":27,"tag":358,"props":524,"children":525},{},[526],{"type":32,"value":527},"Track late-petition rules:",{"type":32,"value":529}," The ",{"type":27,"tag":181,"props":531,"children":534},{"href":532,"rel":533},"https:\u002F\u002Fwww.justice.gov\u002Fcriminal\u002Fcriminal-afmls\u002Ffile\u002F839521\u002Fdl?inline=",[185],[535],{"type":32,"value":536},"DOJ Asset Forfeiture Policy Manual",{"type":32,"value":538}," states that untimely petitions may be considered for good cause. 28 C.F.R. § 9.8(a)(2) allows victim petitions to be considered until the forfeited property is disposed of.",{"type":27,"tag":28,"props":540,"children":541},{},[542],{"type":32,"value":543},"Case-specific notices control. Verify 28 C.F.R. Part 9 and individual program guidelines before submitting claims.",{"type":27,"tag":40,"props":545,"children":547},{"id":546},"what-limits-apply-and-what-should-counsel-ask-at-intake",[548],{"type":32,"value":549},"What Limits Apply, and What Should Counsel Ask at Intake?",{"type":27,"tag":28,"props":551,"children":552},{},[553],{"type":32,"value":554},"Three structural limits apply. First, remission is discretionary and pool-constrained: claimants have no statutory right to payment or hearing, denials permit only one reconsideration request, and limited forfeited value may prevent full recovery. Second, distributions are strictly limited to forfeited net proceeds rather than gross seized amounts. Third, valuation is pegged to fair market value on the date of loss, excluding subsequent market appreciation.",{"type":27,"tag":28,"props":556,"children":557},{},[558],{"type":32,"value":559},"Practical intake questions:",{"type":27,"tag":561,"props":562,"children":563},"ul",{},[564,569,574,579,584,589],{"type":27,"tag":315,"props":565,"children":566},{},[567],{"type":32,"value":568},"What did the client invest, in what assets, and what returns or withdrawals were received?",{"type":27,"tag":315,"props":570,"children":571},{},[572],{"type":32,"value":573},"Which agency seized the property, what specific addresses were seized, and what published dockets exist?",{"type":27,"tag":315,"props":575,"children":576},{},[577],{"type":32,"value":578},"Does the client hold verifiable title to specific assets, or is the loss general and unsecured?",{"type":27,"tag":315,"props":580,"children":581},{},[582],{"type":32,"value":583},"What primary records survive: exchange exports, bank statements, and wire advices?",{"type":27,"tag":315,"props":585,"children":586},{},[587],{"type":32,"value":588},"Has the client received partial recovery from insurers, civil settlements, or co-defendants?",{"type":27,"tag":315,"props":590,"children":591},{},[592],{"type":32,"value":593},"Did intermediate wallets or payment processors handle funds before reaching seized repositories?",{"type":27,"tag":40,"props":595,"children":597},{"id":596},"frequently-asked-questions",[598],{"type":32,"value":599},"Frequently Asked Questions",{"type":27,"tag":601,"props":602,"children":604},"h3",{"id":603},"q-if-the-government-seized-the-crypto-i-lost-why-do-i-not-automatically-get-it-back",[605],{"type":32,"value":606},"Q: If the government seized the crypto I lost, why do I not automatically get it back?",{"type":27,"tag":28,"props":608,"children":609},{},[610,615],{"type":27,"tag":358,"props":611,"children":612},{},[613],{"type":32,"value":614},"A:",{"type":32,"value":616}," Seizure preserves property and forfeiture transfers title to the United States; neither automatically distributes funds to victims. Recovery requires affirmative action: an ownership claim in court, an administrative remission petition under 28 C.F.R. Part 9, statutory restoration of forfeited property, or a criminal restitution order. Each channel has distinct deadlines and evidentiary burdens.",{"type":27,"tag":601,"props":618,"children":620},{"id":619},"q-what-is-the-difference-between-remission-and-restitution",[621],{"type":32,"value":622},"Q: What is the difference between remission and restitution?",{"type":27,"tag":28,"props":624,"children":625},{},[626,630],{"type":27,"tag":358,"props":627,"children":628},{},[629],{"type":32,"value":614},{"type":32,"value":631}," Remission is a discretionary administrative grant from forfeited assets decided by the Attorney General's designee, with no hearing and a single reconsideration opportunity. When forfeited property is insufficient, the ruling official should generally grant remission to recognized victims on a pro rata basis, but may set priorities in individual cases. For a qualifying offense to which the MVRA applies, restitution is a mandatory judicial sentencing order against the defendant for each victim's full loss, enforceable using civil-judgment procedures. Liability terminates on the later of 20 years from entry of judgment or 20 years after release from imprisonment, and the defendant's estate remains liable for any unpaid balance. Remission draws from forfeited funds; restitution is an obligation of the defendant.",{"type":27,"tag":601,"props":633,"children":635},{"id":634},"q-what-deadlines-matter-after-a-federal-crypto-seizure",[636],{"type":32,"value":637},"Q: What deadlines matter after a federal crypto seizure?",{"type":27,"tag":28,"props":639,"children":640},{},[641,645],{"type":27,"tag":358,"props":642,"children":643},{},[644],{"type":32,"value":614},{"type":32,"value":646}," In civil forfeiture, verified claims are due within 30 days of complaint service or of final publication of notice, and answers or Rule 12 motions are due 21 days after the claim is filed (Supplemental Rule G(5)(b)). In criminal forfeiture, third-party petitions under 21 U.S.C. § 853(n)(2) are due within 30 days of final publication or actual notice, whichever is earlier. Administrative remission deadlines are set by program rules; for example, the OneCoin petition window closed on June 30, 2026.",{"type":27,"tag":601,"props":648,"children":650},{"id":649},"q-can-a-victim-recover-both-through-remission-and-by-suing-the-fraudster-civilly",[651],{"type":32,"value":652},"Q: Can a victim recover both through remission and by suing the fraudster civilly?",{"type":27,"tag":28,"props":654,"children":655},{},[656,660],{"type":27,"tag":358,"props":657,"children":658},{},[659],{"type":32,"value":614},{"type":32,"value":661}," A victim may pursue a civil action and a remission petition. Among the qualification criteria in 28 C.F.R. § 9.8(b), the victim must not in fact have been compensated and must not have reasonably available recourse to other assets (§ 9.8(b)(4)-(5)). If remission is granted and the victim later recovers from a civil settlement or judgment, 28 C.F.R. § 9.8(g) requires reimbursement to the Assets Forfeiture Fund to the extent of the overlapping recovery.",{"type":27,"tag":601,"props":663,"children":665},{"id":664},"q-what-documents-prove-a-cryptocurrency-loss-to-the-government",[666],{"type":32,"value":667},"Q: What documents prove a cryptocurrency loss to the government?",{"type":27,"tag":28,"props":669,"children":670},{},[671,675],{"type":27,"tag":358,"props":672,"children":673},{},[674],{"type":32,"value":614},{"type":32,"value":676}," Official, unaltered transaction records: bank statements, wire confirmations, cancelled checks, and exchange transaction logs, accompanied by on-chain records (wallet addresses and transaction hashes) linking payments to seized wallets. Net loss is computed at fair market value as of the loss date, supported by a declaration under penalty of perjury.",{"type":27,"tag":28,"props":678,"children":679},{},[680],{"type":32,"value":681},"Every forfeiture proceeding turns on its specific procedural posture, docket, and agency regulations. When assessing client recovery options following a federal seizure, the author is available to examine claim viability, loss documentation, and procedural deadlines.",{"title":8,"searchDepth":683,"depth":683,"links":684},2,[685,686,687,688,689,690,691,692],{"id":42,"depth":683,"text":45},{"id":193,"depth":683,"text":196},{"id":232,"depth":683,"text":235},{"id":288,"depth":683,"text":291},{"id":396,"depth":683,"text":399},{"id":463,"depth":683,"text":466},{"id":546,"depth":683,"text":549},{"id":596,"depth":683,"text":599,"children":693},[694,696,697,698,699],{"id":603,"depth":695,"text":606},3,{"id":619,"depth":695,"text":622},{"id":634,"depth":695,"text":637},{"id":649,"depth":695,"text":652},{"id":664,"depth":695,"text":667},"markdown","content:articles:32-crypto-forfeiture-remission-restitution.md","content","articles\u002F32-crypto-forfeiture-remission-restitution.md","articles\u002F32-crypto-forfeiture-remission-restitution","md",{"_path":707,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":708,"description":709,"slug":710,"date":711,"lastUpdated":711,"author":13,"readingTime":712,"category":713,"tags":714,"ogImage":719,"featured":7,"body":720,"_type":700,"_id":1231,"_source":702,"_file":1232,"_stem":1233,"_extension":705},"\u002Farticles\u002F29-huione-infrastructure-seizure-chokepoints","Huione infrastructure seizure: chokepoints beyond the wallet","The June 2026 Huione seizure shows fraud counsel where to look beyond destination wallets: domains, cloud accounts, escrow services, and payment rails.","huione-infrastructure-seizure-chokepoints","2026-06-27",16,"Industry Analysis",[715,716,717,18,718],"blockchain-tracing","money-laundering","subpoena","enforcement","\u002Fog\u002Fhuione-infrastructure-seizure-chokepoints.png",{"type":24,"children":721,"toc":1204},[722,727,733,747,753,767,773,796,802,833,839,844,850,855,861,874,880,885,891,896,902,907,913,926,932,937,942,948,953,958,996,1001,1007,1012,1018,1023,1073,1092,1098,1112,1116,1122,1131,1137,1146,1152,1161,1167,1176,1182,1191],{"type":27,"tag":28,"props":723,"children":724},{},[725],{"type":32,"value":726},"When a fraud victim's funds vanish into a large laundering marketplace, the reflexive question is where the money ended up. The destination wallet feels like the prize: the last address in the trace, the exchange deposit, the fiat conversion. The coordinated U.S. announcements on June 23, 2026 involving Cambodia-based Huione Group show why that reflex can be a trap. The Justice Department seized a cloud computing account that hosted backend infrastructure for Huione Group subsidiaries, FinCEN proposed cutting additional Huione-linked entities off from the U.S. banking system, and OFAC sanctioned nine individuals and 26 entities linked to the Prince Group, which Treasury said used Huione Group to transfer and consolidate scam-derived assets. None of those measures was aimed at a wallet. The seizure and the proposed banking cut-off targeted Huione's operational backbone: servers, hosting accounts, and the payment rails a laundering marketplace needs to run. For fraud and asset-recovery counsel, the lesson is about evidence strategy as much as enforcement news: the assets that make a criminal network identifiable and reachable are often not wallet addresses at all.",{"type":27,"tag":40,"props":728,"children":730},{"id":729},"what-the-june-2026-action-did-and-did-not-establish",[731],{"type":32,"value":732},"What the June 2026 Action Did and Did Not Establish",{"type":27,"tag":28,"props":734,"children":735},{},[736,738,745],{"type":32,"value":737},"The Huione matter has moved through a sequence of public actions since 2025, and keeping the dates and legal character of each step straight matters when you describe the case to a court or a client. These are administrative determinations and investigative actions, not adjudicated criminal findings. FinCEN acts under Section 311 of the USA PATRIOT Act, codified at 31 U.S.C. § 5318A, which authorizes special measures against foreign financial institutions of primary money laundering concern. The ",{"type":27,"tag":181,"props":739,"children":742},{"href":740,"rel":741},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services",[185],[743],{"type":32,"value":744},"Justice Department's June 23, 2026 announcement",{"type":32,"value":746}," describes a seizure of a cloud computing account in an investigation conducted by the FBI's San Francisco Field Office and IRS Criminal Investigation and prosecuted by the Criminal Division's Computer Crime and Intellectual Property Section together with the U.S. Attorney's Office for the Northern District of California. No conviction has been announced in connection with the seizure, and the conduct described in the court documents remains alleged.",{"type":27,"tag":601,"props":748,"children":750},{"id":749},"the-may-2025-finding-and-proposed-rule",[751],{"type":32,"value":752},"The May 2025 finding and proposed rule",{"type":27,"tag":28,"props":754,"children":755},{},[756,758,765],{"type":32,"value":757},"On May 1, 2025, FinCEN issued a finding and notice of proposed rulemaking identifying Huione Group, described as a Cambodia-based corporate conglomerate, as a financial institution of primary money laundering concern. In that ",{"type":27,"tag":181,"props":759,"children":762},{"href":760,"rel":761},"https:\u002F\u002Fwww.fincen.gov\u002Fnews\u002Fnews-releases\u002Ffincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern",[185],[763],{"type":32,"value":764},"NPRM",{"type":32,"value":766},", FinCEN stated its investigation found that Huione Group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including at least $37 million derived from cyber heists conducted by the Democratic People's Republic of Korea, at least $36 million from convertible virtual currency investment scams, and $300 million from other cyber scams. FinCEN also observed that none of the three Huione Group components it examined had published anti-money laundering or KYC policies. These are FinCEN's administrative findings, the official factual predicates for the rule that followed, not decisions of any court.",{"type":27,"tag":601,"props":768,"children":770},{"id":769},"the-october-2025-final-rule",[771],{"type":32,"value":772},"The October 2025 final rule",{"type":27,"tag":28,"props":774,"children":775},{},[776,778,785,787,794],{"type":32,"value":777},"On October 14, 2025, FinCEN issued a ",{"type":27,"tag":181,"props":779,"children":782},{"href":780,"rel":781},"https:\u002F\u002Fwww.fincen.gov\u002Fnews\u002Fnews-releases\u002Ffincen-issues-final-rule-severing-huione-group-us-financial-system",[185],[783],{"type":32,"value":784},"final rule severing Huione Group from the U.S. financial system",{"type":32,"value":786},". The ",{"type":27,"tag":181,"props":788,"children":791},{"href":789,"rel":790},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2025\u002F10\u002F16\u002F2025-19571\u002Fimposition-of-special-measure-regarding-huione-group-as-a-foreign-financial-institution-of-primary",[185],[792],{"type":32,"value":793},"Federal Register text",{"type":32,"value":795}," (90 FR 48295, published October 16, 2025) makes the rule effective November 17, 2025; it is codified at 31 CFR 1010.664. Covered financial institutions may not open or maintain a correspondent account in the United States for or on behalf of Huione Group, and must take reasonable steps not to process a transaction for a foreign bank's U.S. correspondent account if the transaction involves Huione Group. The mechanism matters for your practice. The rule restricts U.S. correspondent-account access. It is not a direct on-chain freeze or a recovery order. FinCEN described Huione Group as a critical node for laundering proceeds of cyber heists and virtual currency investment scams, commonly called pig butchering scams.",{"type":27,"tag":601,"props":797,"children":799},{"id":798},"the-june-23-2026-coordinated-action",[800],{"type":32,"value":801},"The June 23, 2026 coordinated action",{"type":27,"tag":28,"props":803,"children":804},{},[805,807,813,815,822,824,831],{"type":32,"value":806},"On June 23, 2026, three agencies acted on the same day. The ",{"type":27,"tag":181,"props":808,"children":810},{"href":740,"rel":809},[185],[811],{"type":32,"value":812},"DOJ seized the cloud computing account",{"type":32,"value":814}," that hosted backend infrastructure for Huione Group subsidiaries. According to court documents, that account was used to help operate Huione Guarantee, also known as Haowang Guarantee. The department credited the intelligence teams at Chainalysis and Elliptic and Google's CyberCrime Investigation Team with voluntarily providing information. FinCEN ",{"type":27,"tag":181,"props":816,"children":819},{"href":817,"rel":818},"https:\u002F\u002Fwww.fincen.gov\u002Fnews\u002Fnews-releases\u002Ffincen-proposes-sever-h-pay-service-plc-and-other-huione-group-successor",[185],[820],{"type":32,"value":821},"proposed a rule",{"type":32,"value":823}," amending the October 2025 final rule to add Cambodia-based H-Pay Service PLC and any successor entity to the definition of Huione Group, expressly to counter attempts to circumvent the 2025 ban. The same day, the ",{"type":27,"tag":181,"props":825,"children":828},{"href":826,"rel":827},"https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0538",[185],[829],{"type":32,"value":830},"Treasury Department",{"type":32,"value":832}," reported that OFAC sanctioned nine individuals and 26 entities linked to the Prince Group transnational criminal organization, which Treasury described as having used Huione Group to transfer and consolidate scam-derived assets. The DOJ release notes the seizure is part of Operation Riptide, an FBI campaign against the infrastructure and financial networks behind cyber-enabled fraud.",{"type":27,"tag":601,"props":834,"children":836},{"id":835},"what-remains-allegation",[837],{"type":32,"value":838},"What remains allegation",{"type":27,"tag":28,"props":840,"children":841},{},[842],{"type":32,"value":843},"Every description of this conduct in the DOJ release is framed as allegation: that Huione Group subsidiaries assisted transfers of fraud proceeds and their conversion into the legitimate banking sector undetected; that Huione Guarantee operated Telegram channels discussing stolen credit card and identity information, malware-enabled theft, procurement of individuals for human trafficking schemes, and laundering of romance and investment scam proceeds; and that Huione Guarantee provided escrow services to criminals, including cryptocurrency money launderers. The department also reported that law enforcement has continuously traced cyber-enabled fraud proceeds to cryptocurrency addresses attributed to Huione Group, including Huione Guarantee. Tracing language of that kind is an investigative assertion, not a judicial finding, and \"attributed to\" is precisely the kind of probabilistic conclusion an analyst can explain and an opponent can probe. If you cite this action in a filing, attribute it as an allegation or government assertion, with the date and source.",{"type":27,"tag":40,"props":845,"children":847},{"id":846},"mapping-the-chokepoints-five-layers-beyond-the-wallet",[848],{"type":32,"value":849},"Mapping the Chokepoints: Five Layers Beyond the Wallet",{"type":27,"tag":28,"props":851,"children":852},{},[853],{"type":32,"value":854},"The value of the Huione record for your cases is how it separates the network into layers an investigator can act on. A wallet-only picture gives you a long list of addresses and a label. An infrastructure picture gives you accounts, providers, and possible record sources. Five layers are worth internalizing.",{"type":27,"tag":601,"props":856,"children":858},{"id":857},"the-wallet-layer",[859],{"type":32,"value":860},"The wallet layer",{"type":27,"tag":28,"props":862,"children":863},{},[864,866,872],{"type":32,"value":865},"This is where most investigations start and, often, where they stall. On-chain analysis can cluster addresses, identify exchange deposit addresses, and show the logical flow of value, but it produces nothing documentary about people, as ",{"type":27,"tag":181,"props":867,"children":869},{"href":868},"\u002Fresources\u002Fcan-blockchain-transactions-be-traced",[870],{"type":32,"value":871},"how blockchain transactions can be traced",{"type":32,"value":873}," explains in detail. The Huione record shows the ceiling of this layer: even with sophisticated attribution, the government described addresses as attributed to the group rather than proven to be controlled by it.",{"type":27,"tag":601,"props":875,"children":877},{"id":876},"the-escrow-and-marketplace-layer",[878],{"type":32,"value":879},"The escrow and marketplace layer",{"type":27,"tag":28,"props":881,"children":882},{},[883],{"type":32,"value":884},"Huione Guarantee's escrow function is the most instructive piece of the record for counsel. An escrow service may hold deposits, release them on confirmation, and create records of payments and counterparties. If your victim's funds moved through an escrow service, the service's operators and records may be investigative targets, and the escrow addresses are a mapping point between the victim's trace and the network's internal accounting.",{"type":27,"tag":601,"props":886,"children":888},{"id":887},"the-communications-layer",[889],{"type":32,"value":890},"The communications layer",{"type":27,"tag":28,"props":892,"children":893},{},[894],{"type":32,"value":895},"The Telegram channels are operational assets in the same sense a storefront is. Admin accounts, invitation links, and channel metadata can provide leads to individuals, while public channel content can show what the marketplace advertised and how it instructed users. Public content changes or disappears, so make time-stamped captures when you first see a channel.",{"type":27,"tag":601,"props":897,"children":899},{"id":898},"the-hosting-and-domain-layer",[900],{"type":32,"value":901},"The hosting and domain layer",{"type":27,"tag":28,"props":903,"children":904},{},[905],{"type":32,"value":906},"The seized cloud account hosted backend infrastructure, and that is the quiet core of the case. Domains resolve to hosting, and hosting sits in accounts that may contain billing emails, payment instruments, phone numbers, or IP logs. A domain registration or hosting account may provide record leads that an address alone does not. The DOJ action illustrates why an account that operates a marketplace can be an investigative target. Whether civil process reaches a registrar or cloud provider depends on jurisdiction, the provider, and applicable law.",{"type":27,"tag":601,"props":908,"children":910},{"id":909},"the-financial-rails-layer",[911],{"type":32,"value":912},"The financial rails layer",{"type":27,"tag":28,"props":914,"children":915},{},[916,918,924],{"type":32,"value":917},"The FinCEN action and the DOJ's description of converting proceeds into the legitimate banking sector undetected point at the same chokepoint from two directions: the fiat interface. Correspondent banking, payment processors, money services businesses, and exchange accounts are the places where cryptocurrency becomes spendable money and where KYC and record-keeping attach. If your trace ends at a conversion, the records of whoever performed it are the bridge from an address to a person. Flows that move across blockchains before conversion add another layer of complexity, covered in ",{"type":27,"tag":181,"props":919,"children":921},{"href":920},"\u002Fresources\u002Fcross-chain-bridges-asset-tracing",[922],{"type":32,"value":923},"an explainer on cross-chain bridges and asset tracing",{"type":32,"value":925},".",{"type":27,"tag":40,"props":927,"children":929},{"id":928},"why-infrastructure-evidence-can-be-stronger-than-a-wallet-label",[930],{"type":32,"value":931},"Why Infrastructure Evidence Can Be Stronger Than a Wallet Label",{"type":27,"tag":28,"props":933,"children":934},{},[935],{"type":32,"value":936},"Attribution is the weak point of pure on-chain work. Address clustering is heuristic: strong in aggregate, probabilistic in individual cases, and always open to challenge about whether a conclusion that an address belongs to a person is actually grounded. A wallet label, however confidently stated, is an inference. An operational account is different. A cloud account, a domain registration, a payment processor relationship, or a bank relationship may leave identity-bearing records such as billing details, KYC files, and device or IP logs. Where available through appropriate process, those records can corroborate or test an analyst's inference.",{"type":27,"tag":28,"props":938,"children":939},{},[940],{"type":32,"value":941},"There is also an asymmetry worth exploiting. Criminals can mint unlimited addresses, but banking relationships, hosting accounts, and merchant accounts may take time to establish and can create provider records. The DOJ release shows the pattern: the operational target was the account that ran the marketplace. In a private matter, the same logic supports early attention to possible provider records, rather than months of address counting alone. The analyst's question should shift from where the funds went to what assets the network needs to keep operating, and who holds the records for those assets.",{"type":27,"tag":40,"props":943,"children":945},{"id":944},"turning-infrastructure-leads-into-preservation-and-subpoena-targets",[946],{"type":32,"value":947},"Turning Infrastructure Leads into Preservation and Subpoena Targets",{"type":27,"tag":28,"props":949,"children":950},{},[951],{"type":32,"value":952},"Hypothetical example: your client lost $180,000 to an investment scam that directed deposits to a wallet cluster that a tracing analyst tied to an escrow service advertising on a messaging app. The wallet-only plan is to keep following addresses and hope for a lucky break. The infrastructure plan asks five questions. What domains does the service use, and who registered them? What hosting or cloud account serves the site, and what billing identifiers does it carry? What messenger channels and admin accounts does the service operate, and what do invitation links reveal? Which payment processors, money services businesses, or exchanges converted deposits to fiat, and are any U.S.-based? Which accounts received the fiat outflows? Each answer identifies a possible record holder and requires a separate analysis of what process, if any, can reach the records. A lawful production may include an operator name, a phone number, or a bank account that an address list does not itself disclose.",{"type":27,"tag":28,"props":954,"children":955},{},[956],{"type":32,"value":957},"Useful discovery questions for the provider or the opponent, adapted to your theory of the case:",{"type":27,"tag":561,"props":959,"children":960},{},[961,966,971,976,981,986,991],{"type":27,"tag":315,"props":962,"children":963},{},[964],{"type":32,"value":965},"Which wallet addresses received marketplace deposits and which paid out, and over what period?",{"type":27,"tag":315,"props":967,"children":968},{},[969],{"type":32,"value":970},"What brand names, domains, and pages did the operation use, and who administers them?",{"type":27,"tag":315,"props":972,"children":973},{},[974],{"type":32,"value":975},"Who is the registrant of each domain, and what payment method was used at registration?",{"type":27,"tag":315,"props":977,"children":978},{},[979],{"type":32,"value":980},"Which hosting, cloud, or content delivery accounts serve the infrastructure, and what billing and access records do they carry?",{"type":27,"tag":315,"props":982,"children":983},{},[984],{"type":32,"value":985},"What messenger channels and groups are operated, and what account identifiers and IP logs attach to their administrators?",{"type":27,"tag":315,"props":987,"children":988},{},[989],{"type":32,"value":990},"Which exchanges, payment processors, or money services businesses handled conversions, and what KYC and counterparty records do they hold?",{"type":27,"tag":315,"props":992,"children":993},{},[994],{"type":32,"value":995},"Which bank accounts received the fiat withdrawals, and under whose names?",{"type":27,"tag":28,"props":997,"children":998},{},[999],{"type":32,"value":1000},"Direct requests to the institution that holds the records: cloud providers, registrars, messaging platforms, exchanges, payment processors, and banks. For each provider, assess jurisdiction, the governing discovery rules, and statutory limits on disclosure before requesting preservation or serving process. Foreign institutions raise the problems covered in the limitations section below.",{"type":27,"tag":40,"props":1002,"children":1004},{"id":1003},"disruption-is-not-recovery-separate-the-objectives",[1005],{"type":32,"value":1006},"Disruption Is Not Recovery: Separate the Objectives",{"type":27,"tag":28,"props":1008,"children":1009},{},[1010],{"type":32,"value":1011},"Read the June 23 announcement for what it does not promise: it does not announce victim restitution. The announcement describes a seizure intended to disrupt infrastructure, not to repay investors, and disruption, compensation, and forfeiture are different tracks with different evidence requirements. Criminal restitution and forfeiture can return funds to victims, and the DOJ notes that its computer crime section has secured court orders for the return of over $350 million in victim funds since 2020, but that money comes from separate proceedings on their own timelines. Civil recovery for your client depends on your own tracing, freezing steps, and judgment collection against identifiable assets. A government seizure does not substitute for private recovery, and it does not end one. It can help in two ways: the public record names components for further investigation, and an IC3 complaint is a legitimate channel for victims because law enforcement uses those complaints in its investigations. Treat disruption news as context, not recovery.",{"type":27,"tag":40,"props":1013,"children":1015},{"id":1014},"a-reusable-investigation-plan-for-private-counsel",[1016],{"type":32,"value":1017},"A Reusable Investigation Plan for Private Counsel",{"type":27,"tag":28,"props":1019,"children":1020},{},[1021],{"type":32,"value":1022},"Nothing in this plan borrows government powers. You cannot seize a domain, block a bank account, or sanction anyone as a private attorney. You can request preservation, pursue lawful discovery, trace, litigate, and refer matters to agencies that hold the disruptive tools. The plan:",{"type":27,"tag":311,"props":1024,"children":1025},{},[1026,1031,1043,1048,1053,1058,1063,1068],{"type":27,"tag":315,"props":1027,"children":1028},{},[1029],{"type":32,"value":1030},"Fix the starting facts: the victim's bank trail, receipts, communications, and any wallet addresses or transaction identifiers already in hand.",{"type":27,"tag":315,"props":1032,"children":1033},{},[1034,1036,1042],{"type":32,"value":1035},"Commission tracing from the known addresses into the network, and require the analyst to state confidence levels and to separate address facts from attribution, following the discipline in ",{"type":27,"tag":181,"props":1037,"children":1039},{"href":1038},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[1040],{"type":32,"value":1041},"common mistakes in cryptocurrency investigations",{"type":32,"value":925},{"type":27,"tag":315,"props":1044,"children":1045},{},[1046],{"type":32,"value":1047},"Map the operational surface: domains, hosting, messenger channels, escrow pages, payment pages, and advertised payment methods.",{"type":27,"tag":315,"props":1049,"children":1050},{},[1051],{"type":32,"value":1052},"Correlate identity anchors across that surface: registrant details, billing emails, reused usernames, invitation mechanics, and shared admin accounts.",{"type":27,"tag":315,"props":1054,"children":1055},{},[1056],{"type":32,"value":1057},"Preserve before interrogating: time-stamped captures of public pages and channels, preservation requests to providers, and early process where jurisdiction and the governing rules permit it.",{"type":27,"tag":315,"props":1059,"children":1060},{},[1061],{"type":32,"value":1062},"Assess the fiat interface: where conversions occurred, which institutions processed them, and which accounts received the money.",{"type":27,"tag":315,"props":1064,"children":1065},{},[1066],{"type":32,"value":1067},"Choose the forum and theory after the identity evidence exists, from civil claims against identified operators to support for a criminal referral.",{"type":27,"tag":315,"props":1069,"children":1070},{},[1071],{"type":32,"value":1072},"Set expectations with the client: agency disruption may outpace private recovery, funds may keep moving, and everything must be documented for eventual expert testimony.",{"type":27,"tag":28,"props":1074,"children":1075},{},[1076,1078,1083,1085,1090],{"type":32,"value":1077},"For engagements structured around this sequence, ",{"type":27,"tag":181,"props":1079,"children":1080},{"href":372},[1081],{"type":32,"value":1082},"ConsensusIntel's blockchain tracing service",{"type":32,"value":1084}," covers the on-chain and infrastructure layers, and the ",{"type":27,"tag":181,"props":1086,"children":1087},{"href":388},[1088],{"type":32,"value":1089},"documented methodology",{"type":32,"value":1091}," explains how findings are packaged for litigation.",{"type":27,"tag":40,"props":1093,"children":1095},{"id":1094},"limitations-of-this-playbook",[1096],{"type":32,"value":1097},"Limitations of This Playbook",{"type":27,"tag":28,"props":1099,"children":1100},{},[1101,1103,1110],{"type":32,"value":1102},"Several limitations are worth stating plainly. Everything in the DOJ release about the conduct of Huione Guarantee and its operators is allegation, and the cited release announces no conviction. The DOJ release does not name the cloud provider, so the practical mechanics of the seizure are unknown, and you should not extrapolate a template for how any provider will answer your requests. The FinCEN June 2026 action is a proposed rule, not a final one. The ",{"type":27,"tag":181,"props":1104,"children":1107},{"href":1105,"rel":1106},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12794\u002Fdefinition-of-huione-group-a-financial-institution-operating-outside-the-united-states-of-primary",[185],[1108],{"type":32,"value":1109},"Federal Register NPRM",{"type":32,"value":1111}," (91 FR 38340, published June 25, 2026) set comments due July 27, 2026, and its status should be checked before you rely on it to confirm whether FinCEN has finalized the amendment adding H-Pay and successor entities to the Huione Group definition. The existing special measure at 31 CFR 1010.664 remains in effect as to Huione Group as then defined. International process is the hard case: Cambodian and other foreign providers may not respond to U.S. civil subpoenas, and data protection law may block production even from responsive providers. Public wallet labels are contested ground, and attribution language in a government release does not immunize your analysis from challenge. Finally, timing cuts both ways: the on-chain record persists, but operator content and provider records are perishable, and a criminal seizure does not preserve civil claims for you.",{"type":27,"tag":40,"props":1113,"children":1114},{"id":596},[1115],{"type":32,"value":599},{"type":27,"tag":601,"props":1117,"children":1119},{"id":1118},"q-does-the-huione-seizure-mean-my-clients-stolen-funds-will-be-returned",[1120],{"type":32,"value":1121},"Q: Does the Huione seizure mean my client's stolen funds will be returned?",{"type":27,"tag":28,"props":1123,"children":1124},{},[1125,1129],{"type":27,"tag":358,"props":1126,"children":1127},{},[1128],{"type":32,"value":614},{"type":32,"value":1130}," Not by itself. The June 23, 2026 announcements describe disruption actions, not a restitution plan. Recovery for a private victim still depends on identifying specific assets, freezing or attaching them, and obtaining a judgment or settlement. Treat the seizure as context for further investigation, not as a recovery event, and preserve and trace your own evidence promptly.",{"type":27,"tag":601,"props":1132,"children":1134},{"id":1133},"q-the-government-says-funds-were-traced-to-huione-addresses-is-that-proof-the-group-controlled-those-wallets",[1135],{"type":32,"value":1136},"Q: The government says funds were traced to Huione addresses. Is that proof the group controlled those wallets?",{"type":27,"tag":28,"props":1138,"children":1139},{},[1140,1144],{"type":27,"tag":358,"props":1141,"children":1142},{},[1143],{"type":32,"value":614},{"type":32,"value":1145}," No. \"Attributed to\" is an investigative conclusion, not an adjudicated fact. It can support an investigative lead, but it does not by itself prove control. In your own matter, require the analyst to separate what the blockchain shows, that addresses moved value at specific times, from what is inferred, who controlled them, and be prepared to defend each inference.",{"type":27,"tag":601,"props":1147,"children":1149},{"id":1148},"q-can-private-counsel-subpoena-the-same-providers-the-government-used-such-as-cloud-and-hosting-companies",[1150],{"type":32,"value":1151},"Q: Can private counsel subpoena the same providers the government used, such as cloud and hosting companies?",{"type":27,"tag":28,"props":1153,"children":1154},{},[1155,1159],{"type":27,"tag":358,"props":1156,"children":1157},{},[1158],{"type":32,"value":614},{"type":32,"value":1160}," Sometimes. A U.S.-based provider may be reachable through civil discovery for records it may lawfully disclose, but jurisdiction, the applicable discovery rules, and statutes governing electronic communications can limit what private counsel can obtain. A preservation request does not itself compel retention. Foreign providers add problems of service, jurisdiction, and data protection law. Map the infrastructure early, then identify the provider, record type, and available process before content disappears.",{"type":27,"tag":601,"props":1162,"children":1164},{"id":1163},"q-what-is-section-311-and-why-does-a-correspondent-account-ban-matter-for-my-case",[1165],{"type":32,"value":1166},"Q: What is Section 311 and why does a correspondent account ban matter for my case?",{"type":27,"tag":28,"props":1168,"children":1169},{},[1170,1174],{"type":27,"tag":358,"props":1171,"children":1172},{},[1173],{"type":32,"value":614},{"type":32,"value":1175}," Section 311 of the USA PATRIOT Act, codified at 31 U.S.C. § 5318A, lets FinCEN impose special measures on foreign financial institutions of primary money laundering concern. Special measure five, the correspondent-account prohibition, may be imposed only by regulation. Following its May 2025 finding and proposal, FinCEN's October 2025 final rule (31 CFR 1010.664) prohibits covered financial institutions from opening or maintaining a U.S. correspondent account for or on behalf of Huione Group, and requires them to take reasonable steps not to process a transaction for a foreign bank's U.S. correspondent account if the transaction involves Huione Group. The ban closes U.S. dollar correspondent access. It is an access control on U.S. bank clearing, not a recovery mechanism and not a bar on conversion outside that channel, but it explains where the network's U.S. vulnerability sits.",{"type":27,"tag":601,"props":1177,"children":1179},{"id":1178},"q-what-should-my-client-do-today-if-their-funds-went-through-a-similar-marketplace",[1180],{"type":32,"value":1181},"Q: What should my client do today if their funds went through a similar marketplace?",{"type":27,"tag":28,"props":1183,"children":1184},{},[1185,1189],{"type":27,"tag":358,"props":1186,"children":1187},{},[1188],{"type":32,"value":614},{"type":32,"value":1190}," Preserve everything perishable: bank statements, receipts, conversation screenshots, channel and page captures with timestamps, and any wallet addresses or transaction identifiers. If the conduct affected U.S. persons, report it to the FBI's IC3, since those complaints feed investigations. Then have the likely flow traced from the known addresses before more time passes. The on-chain record will wait for you; the operator's content and the provider's records will not.",{"type":27,"tag":28,"props":1192,"children":1193},{},[1194,1196,1202],{"type":32,"value":1195},"The Huione record is a reminder that a laundering network is a business: it has infrastructure, accounts, and providers, and those assets generate evidence that wallets never will. Every case turns on its own facts, timelines, and jurisdictions, so the right move for a specific matter is a conversation about what is actually available. If yours involves funds that passed through a marketplace or escrow service, ",{"type":27,"tag":181,"props":1197,"children":1199},{"href":1198},"\u002Fcontact",[1200],{"type":32,"value":1201},"contact ConsensusIntel",{"type":32,"value":1203}," with the facts and the timeline.",{"title":8,"searchDepth":683,"depth":683,"links":1205},[1206,1212,1219,1220,1221,1222,1223,1224],{"id":729,"depth":683,"text":732,"children":1207},[1208,1209,1210,1211],{"id":749,"depth":695,"text":752},{"id":769,"depth":695,"text":772},{"id":798,"depth":695,"text":801},{"id":835,"depth":695,"text":838},{"id":846,"depth":683,"text":849,"children":1213},[1214,1215,1216,1217,1218],{"id":857,"depth":695,"text":860},{"id":876,"depth":695,"text":879},{"id":887,"depth":695,"text":890},{"id":898,"depth":695,"text":901},{"id":909,"depth":695,"text":912},{"id":928,"depth":683,"text":931},{"id":944,"depth":683,"text":947},{"id":1003,"depth":683,"text":1006},{"id":1014,"depth":683,"text":1017},{"id":1094,"depth":683,"text":1097},{"id":596,"depth":683,"text":599,"children":1225},[1226,1227,1228,1229,1230],{"id":1118,"depth":695,"text":1121},{"id":1133,"depth":695,"text":1136},{"id":1148,"depth":695,"text":1151},{"id":1163,"depth":695,"text":1166},{"id":1178,"depth":695,"text":1181},"content:articles:29-huione-infrastructure-seizure-chokepoints.md","articles\u002F29-huione-infrastructure-seizure-chokepoints.md","articles\u002F29-huione-infrastructure-seizure-chokepoints",1790145013677]