US Authorities Seize $2.8M in Crypto from Ransomware Operator

The Justice Department unsealed six warrants on August 14, targeting Ianis Aleksandrovich Antropenko, who allegedly used malicious software to attack victims worldwide.

The operation represents one of the latest efforts by US law enforcement to crack down on cybercriminals who use cryptocurrency to hide their illegal profits. The seized digital assets will likely join the government’s growing crypto stockpile, now worth over $20 billion.

Antropenko faces serious federal charges including conspiracy to commit computer fraud and abuse, computer fraud and abuse, and conspiracy to commit money laundering. Court documents reveal he used something called Zeppelin ransomware to target individuals, businesses, and organizations across the globe, including victims in the United States.

The federal warrants were unsealed in three different district courts spanning Virginia, California, and Texas. Besides the cryptocurrency, authorities also seized $70,000 in cash and a luxury vehicle from Antropenko.

Prosecutors say Antropenko and his partners would break into computer systems, steal data, and then demand payment to give it back. They would typically encrypt the victim’s files and threaten to publish sensitive information or delete it entirely unless ransom was paid.

The investigation revealed sophisticated money laundering techniques used to hide the source of stolen funds. Antropenko allegedly used ChipMixer, a cryptocurrency mixing service that was shut down by international law enforcement in 2023. These services work by mixing different people’s cryptocurrency together, making it harder to trace where the money originally came from.

The criminal operation also involved converting cryptocurrency into cash and making structured deposits to avoid detection by banking authorities. This shows how cybercriminals adapt traditional money laundering methods to work with digital currencies.

Federal agents tracked the stolen funds through blockchain analysis, eventually identifying cryptocurrency wallets containing Ethereum, USD Tether, and USD Coin linked to Antropenko. They also found Binance exchange accounts registered in his name.

The seized cryptocurrency will likely be added to the US national crypto reserve, which was established by an executive order from President Donald Trump earlier this year. Treasury Secretary Scott Bessent recently revealed that the government’s Bitcoin holdings, acquired mainly through criminal asset seizures, total about $20 billion.

Source: @DOJCrimDiv

This case follows several other major cryptocurrency seizures in recent months. Earlier this week, the Justice Department announced seizing about $1 million from the BlackSuit ransomware group. Federal officials are also seeking to claim $2.4 million in Bitcoin seized by the Dallas FBI in April.

The government has shifted toward using seized cryptocurrency assets to build national reserves rather than immediately selling them. This represents a significant change in how authorities handle digital currencies recovered from criminal activities.

The Computer Crime and Intellectual Property Section (CCIPS), which handles these cases, has achieved notable results in fighting cybercrime. Since 2020, the unit has secured convictions for over 180 cybercriminals and recovered more than $350 million for victims of these attacks.

The section has also disrupted multiple ransomware groups, preventing victims from paying over $200 million in ransom demands. This proactive approach represents a shift toward dismantling criminal infrastructure before more damage occurs.

The FBI Dallas and Norfolk Field Offices led the investigation with help from the Virtual Assets Unit, which specializes in cryptocurrency-related crimes. This multi-office approach shows how seriously federal authorities take ransomware threats to American businesses and infrastructure.

International cooperation also played a key role in recent takedowns of major ransomware operations. Similar actions against the BlackSuit group involved law enforcement from the United Kingdom, Germany, Ireland, France, Canada, Ukraine, and Lithuania.

While this seizure marks a significant victory, cybersecurity experts note that ransomware remains a persistent threat to businesses and organizations worldwide. Criminal groups continue to evolve their tactics and rebuild operations even after law enforcement actions.

The case also highlights how blockchain technology, despite promises of anonymity, can actually help authorities track criminal activity. Advanced analysis techniques allow investigators to follow cryptocurrency transactions and identify the people behind illegal operations.

As Antropenko’s case moves through the courts, it serves as a reminder that federal prosecutors are actively pursuing cybercriminals who exploit digital currencies for illegal gain. The defendant remains presumed innocent until proven guilty in court.