Case Library / Phishing / DOJ's $225M USDT pig butchering seizure (2025)
PhishingSmishing (SMS Phishing) Documented incident

DOJ's $225M USDT pig butchering seizure (2025)

In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX flagged accounts. What the numbers mean.

Share:

Social Engineering Examples·6 sources

Officials called it the largest US seizure tied to pig butchering scams, and it started with a tip from a crypto exchange. On 18 June 2025, the Justice Department filed a civil forfeiture complaint in Washington, DC, against more than $225.3 million in Tether's USDT stablecoin. It says the money came from crypto investment scams and was laundered through a web of wallets. Officials called it the largest crypto seizure in Secret Service history. The complaint lists about 430 suspected victims. Status: Civil forfeiture complaint filed, final outcome not reported.

Key takeaways

  • This was a case against the money, not against people. Nobody was charged by this filing.
  • Tether and the exchange OKX spotted the activity and told the Secret Service in 2023.
  • About 60 victims were interviewed. Together they'd lost roughly $19 million in the transactions traced in the complaint.
  • The "$3 billion" figure in some coverage is account volume. It isn't a loss, a seizure or a refund.

What happened

OKX and Tether noticed something odd: about 144 OKX accounts, linked to IP addresses in the Philippines, had moved around $3 billion in crypto over a year. The government later called it high-volume money laundering. In 2023, according to court documents, they flagged it to the US Secret Service.

Investigators from the Secret Service and FBI field offices in San Francisco then traced funds from victims of crypto confidence scams across a large spread of blockchain addresses. The operators had split the money over hundreds of thousands of transactions to hide where it came from. The trail ended at more than $225.3 million in USDT, and the Justice Department filed to forfeit it (case 25-cv-01907-AHA, District of Columbia).

The complaint mentions some individuals in its factual allegations. But a civil forfeiture action is brought against property. It doesn't charge anyone with a crime, so no one is named here.

The numbers, and what they mean

Figure What it is
$225.3 million in USDT The property the government is seeking to forfeit
About 430 to 434 suspected victims Listed in the complaint, mostly in the US, plus the UK, Australia and Germany. The press release rounded it to "more than 400"
About 60 confirmed victims, roughly $19 million Victims interviewed by law enforcement, and their losses in the specific transactions traced
About $3 billion Crypto moved through the 144 flagged accounts in a year, per Decrypt. Volume, not loss

One more thing the record doesn't show: that the money has been finally forfeited, or that any victim has been paid back.

Tip: if you were scammed, keep every wallet address and transaction ID. Recovery is never guaranteed, but cases like this one are built from that trail.

The scam behind the money

The funds came from pig butchering, the slow-build investment con. It usually goes like this:

  • a stranger gets in touch through a messaging app, social media, a dating app or a "wrong number" text
  • a friendship or romance grows over time
  • talk turns to a crypto platform showing fat, rising balances
  • small early withdrawals are sometimes allowed, to build trust
  • then bigger and bigger deposits, until the money is gone

The Justice Department said more than 400 people lost money thinking they were making real investments. It asked other victims to report to the FBI's IC3 using complaint code BT06182025.

What stops it

  • Investment tips from someone you only know online? Assume fraud.
  • Check the person, the platform and the wallet address yourself, before sending anything.
  • Get a second opinion from someone outside the relationship.
  • If it goes wrong, save wallet addresses and transaction records, then contact the exchange and law enforcement quickly.
  • Exchanges and stablecoin issuers: this case shows what flagging suspicious accounts early can do.

See also the Simex domain seizure and the Dubai scam compound takedown.

Common questions

What was the $225 million pig butchering seizure?

A June 2025 civil forfeiture complaint by the US Justice Department against more than $225.3 million in USDT allegedly tied to crypto investment scams and money laundering.

How was the money found?

Tether and OKX flagged suspicious OKX accounts to the Secret Service in 2023. Investigators then traced victim funds through blockchain analysis.

Was anyone charged?

Not by this filing. It's a civil action against the funds, not a criminal case against people.

Have victims been repaid?

The record doesn't show final forfeiture or any completed repayment.

Sources
Cite this case

Social Engineering Examples. “DOJ's $225M USDT pig butchering seizure (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/doj-225m-pig-butchering-usdt-forfeiture-2025

Attack Chain & Defense
1Rapport
What happened

Reporting on this case describes confidence scammers using fake social-media profiles and stories to gain trust before soliciting money.

The control that would have stopped it

Countering rapport-based solicitation: Treat an online contact who introduces an investment opportunity as a fraud risk and verify the person and investment independently.

2Transfer and alleged laundering
What happened

DOJ alleged that cryptocurrency taken from investors was laundered through exchange accounts.

The control that would have stopped it

Countering fraudulent investment requests: Do not transfer cryptocurrency based solely on an online relationship or a platform supplied by that contact.

3Dispersal allegation
What happened

The complaint alleges that operators dispersed proceeds across many cryptocurrency addresses and accounts and used hundreds of thousands of transactions to conceal their source and control.

The control that would have stopped it

Before transferring funds: Obtain an independent second opinion and verify the destination outside the contact's messages.

4Detection
What happened

Court documents, as reported by Decrypt, say Tether notified the U.S. Secret Service in 2023 after Tether and OKX identified more than 144 exchange accounts linked to confidence scams.

The control that would have stopped it

After a suspected transfer: Preserve wallet addresses and transaction records when reporting the incident to the relevant exchange and law enforcement.

Quick Facts
Victim
The unsealed civil forfeiture complaint identifies approximately 430-434 suspected victims (rounded to more than 400 in the DOJ press release), described in the complaint as located primarily in the United States, with additional victims in the United Kingdom, Australia, and Germany.
Of these, law enforcement interviewed about 60 confirmed victims who collectively lost roughly $19 million in the transactions specifically traced in the complaint; the complaint recounts millions of dollars in victim losses overall.
Location
United States
(case filed in U.S. District Court for the District of Columbia); per the unsealed complaint, victims are located primarily in the United States, with additional victims in the United Kingdom, Australia, and Germany; the laundering accounts are linked to IP addresses in the Philippines.
Date
June 2025 (complaint)
Impact
Property sought for forfeiture: more than $225.3M in USDT.
BasismeasuredExact USDT total in the civil forfeiture complaint
Separately, Decrypt reported that 144 exchange accounts deposited about $3B in cryptocurrency over one year; that transaction volume is not a victim-loss or repayment figure.
Status
Documented incident
Case Type
Real-World Incident
Sector
Consumer / General Public, Cryptocurrency & Digital Assets, Financial Services & Insurance
Threat Actor
Organized Crime
Explore more

Related Cases

Browse by what this case has in common with others in the library.