In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX flagged accounts. What the numbers mean.
Social Engineering Examples·6 sources
Officials called it the largest US seizure tied to pig butchering scams, and it started with a tip from a crypto exchange. On 18 June 2025, the Justice Department filed a civil forfeiture complaint in Washington, DC, against more than $225.3 million in Tether's USDT stablecoin. It says the money came from crypto investment scams and was laundered through a web of wallets. Officials called it the largest crypto seizure in Secret Service history. The complaint lists about 430 suspected victims. Status: Civil forfeiture complaint filed, final outcome not reported.
OKX and Tether noticed something odd: about 144 OKX accounts, linked to IP addresses in the Philippines, had moved around $3 billion in crypto over a year. The government later called it high-volume money laundering. In 2023, according to court documents, they flagged it to the US Secret Service.
Investigators from the Secret Service and FBI field offices in San Francisco then traced funds from victims of crypto confidence scams across a large spread of blockchain addresses. The operators had split the money over hundreds of thousands of transactions to hide where it came from. The trail ended at more than $225.3 million in USDT, and the Justice Department filed to forfeit it (case 25-cv-01907-AHA, District of Columbia).
The complaint mentions some individuals in its factual allegations. But a civil forfeiture action is brought against property. It doesn't charge anyone with a crime, so no one is named here.
| Figure | What it is |
|---|---|
| $225.3 million in USDT | The property the government is seeking to forfeit |
| About 430 to 434 suspected victims | Listed in the complaint, mostly in the US, plus the UK, Australia and Germany. The press release rounded it to "more than 400" |
| About 60 confirmed victims, roughly $19 million | Victims interviewed by law enforcement, and their losses in the specific transactions traced |
| About $3 billion | Crypto moved through the 144 flagged accounts in a year, per Decrypt. Volume, not loss |
One more thing the record doesn't show: that the money has been finally forfeited, or that any victim has been paid back.
Tip: if you were scammed, keep every wallet address and transaction ID. Recovery is never guaranteed, but cases like this one are built from that trail.
The funds came from pig butchering, the slow-build investment con. It usually goes like this:
The Justice Department said more than 400 people lost money thinking they were making real investments. It asked other victims to report to the FBI's IC3 using complaint code BT06182025.
See also the Simex domain seizure and the Dubai scam compound takedown.
A June 2025 civil forfeiture complaint by the US Justice Department against more than $225.3 million in USDT allegedly tied to crypto investment scams and money laundering.
Tether and OKX flagged suspicious OKX accounts to the Secret Service in 2023. Investigators then traced victim funds through blockchain analysis.
Not by this filing. It's a civil action against the funds, not a criminal case against people.
The record doesn't show final forfeiture or any completed repayment.
Social Engineering Examples. “DOJ's $225M USDT pig butchering seizure (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/doj-225m-pig-butchering-usdt-forfeiture-2025
Reporting on this case describes confidence scammers using fake social-media profiles and stories to gain trust before soliciting money.
Countering rapport-based solicitation: Treat an online contact who introduces an investment opportunity as a fraud risk and verify the person and investment independently.
DOJ alleged that cryptocurrency taken from investors was laundered through exchange accounts.
Countering fraudulent investment requests: Do not transfer cryptocurrency based solely on an online relationship or a platform supplied by that contact.
The complaint alleges that operators dispersed proceeds across many cryptocurrency addresses and accounts and used hundreds of thousands of transactions to conceal their source and control.
Before transferring funds: Obtain an independent second opinion and verify the destination outside the contact's messages.
Court documents, as reported by Decrypt, say Tether notified the U.S. Secret Service in 2023 after Tether and OKX identified more than 144 exchange accounts linked to confidence scams.
After a suspected transfer: Preserve wallet addresses and transaction records when reporting the incident to the relevant exchange and law enforcement.
Browse by what this case has in common with others in the library.
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
In 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
In July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with…
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
GootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that…
Argan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss,…
Attackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the…
CVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters; media exposure across a dozen-plus cities…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence…
A respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11…
Gootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to…
A tech-support operator used fake Microsoft/Apple security pop-ups to scare consumers, often older Americans, into calling an India-based support line…
Prosecutors allege a Ghana-based network used fake female personas, AI video and inheritance stories to take $8M+ from 80+ elderly…