US complaint seeks forfeiture of 280 crypto properties tied to North Korean hacks

On August 27, 2020, the United States filed a verified civil complaint in the U.S. District Court for the District of Columbia seeking forfeiture of 280 virtual-currency properties. Investigators alleged that the properties were involved in laundering proceeds from two cryptocurrency-exchange hacks attributed to North Korean actors.

The filing was significant for what it attempted, and for what it did not decide. It put a long list of blockchain addresses and exchange identifiers into a federal forfeiture case, but it was a complaint—not a judgment that the property was forfeitable, not a criminal conviction, and not proof tested at trial. The Justice Department itself said the allegations did not constitute a determination of liability and that the government carried the burden of proving forfeitability.

Two hacks, one alleged laundering network

The complaint separated the alleged conduct into two principal thefts. For a July 1, 2019 hack of an unnamed exchange, the Justice Department said more than $272,000 in alternative cryptocurrencies and tokens was stolen. The pleading described transfers through intermediary addresses and exchanges, including conversion among tokens, tether and bitcoin—a practice it called “chain hopping.”

A second section concerned a U.S.-based company focused on the Algorand blockchain. The complaint alleged that attackers used stolen recovery seeds on September 25, 2019 to recreate wallets belonging to the company and partners. Its table valued the listed stolen assets at approximately $2,467,968.71, including 9,612,652 ALGO, 194,591.33 USDT, 19.6870 BTC and other assets. Those dollar figures are the government’s contemporaneous approximations; the table does not supply a uniform valuation timestamp or price venue, so they should not be treated as independently reconstructed market values.

Investigators alleged that the stolen ALGO was divided through about 109 transactions and sent to roughly 106 accounts at another exchange, where it was converted to bitcoin. The filing said four bitcoin clusters receiving those proceeds were connected to clusters associated with the first theft and with an earlier North Korea-related forfeiture case. It further alleged that at least part of the proceeds moved through the same Chinese over-the-counter traders.

Why the 280-property filing mattered

The institutional message was that a public blockchain trail could support an asset-forfeiture strategy even after thieves changed assets and used multiple venues. The complaint described account records, login information, exchange cooperation and transaction tracing alongside blockchain analysis. Attachment A enumerated 280 defendant properties, but “accounts” was a legal label covering a mixed set of blockchain addresses and exchange user identifiers, not necessarily 280 separate people or 280 conventional bank-style accounts.

The filing also expanded an enforcement sequence already underway. It referenced a March 2, 2020 complaint against 146 virtual-currency accounts linked to a separate theft of nearly $250 million and related hacks. Reuters reported the August 27 action as the U.S. effort to seize 280 accounts, while preserving the distinction that the government said they were tied to North Korean hackers.

For exchanges, the case highlighted two operational choke points: custody credentials and hosted accounts. Stolen recovery seeds allegedly enabled wallet recreation, while exchange KYC records, frozen transactions and account identifiers gave investigators evidence beyond the public ledger. That combination mattered more than any claim that cryptocurrency was either anonymous or automatically traceable.

Market context and limits

The action did not produce an obvious market-wide dislocation in the available venue snapshot. Kraken’s August 27, 2020 report, calculated from its public market data over the UTC reporting day, recorded $303.0 million in total venue trading volume. It listed XBT at $11,299, down 1.4% against the U.S. dollar, and ETH at $381.99, down 1.0%. Those are Kraken-only observations, not a consolidated global close, and they cannot establish that the court filing caused either move.

The verified development on August 27 was therefore procedural but consequential: prosecutors opened a case seeking control of specifically identified digital properties and published their tracing theory. Whether each property was legally forfeitable remained for the court, and the complaint did not by itself establish ownership, liability or recovery for victims.