The United States government is confronting two major, simultaneous challenges involving its massive Bitcoin holdings, valued at approximately $28 billion. The first involves the historic forfeiture of over 127,000 Bitcoin (worth more than $11.4 billion) linked to an international fraud and sanctions evasion scheme, which is now being claimed by families of 9/11 victims and other terrorism survivors. The second is a security breach where roughly $40 million in cryptocurrency was allegedly siphoned from government-linked seizure wallets, raising serious questions about the security of the proposed 'digital Fort Knox' strategic reserve.
The $11.4 Billion Forfeiture and Legal Battle: Authorities seized the Bitcoin following a complex operation involving the Iran and China Investment Development Group (LuBian.com), which allegedly helped Iran circumvent U.S. sanctions by converting oil and gas into electricity for Bitcoin mining. The funds were originally stolen in late 2020 by an anonymous ethical hacker from the LuBian mining pool, who turned the wallet keys over to U.S. authorities.
The Bitcoin's illicit origins trace back to 'pig butchering' scams orchestrated by Chen Zhi, head of the Prince Holding Group. These scams, involving human trafficking and forced labor in Cambodian compounds, defrauded global victims of billions. Chen was indicted in October for wire fraud and money laundering, arrested in Cambodia, and extradited to China.
On December 26, a coalition led by Noala Fritz—representing hundreds of victims of attacks like the 1983 Beirut bombing, 1998 embassy blasts, and the Iraq war—filed a 75-page lawsuit in New York federal court. They seek the Bitcoin under the Terrorism Risk Insurance Act, holding $23.2 billion in judgments against Iran for supporting groups like al Qaeda and Hezbollah. The lawsuit claims LuBian served as Iran's tool for dodging sanctions. This move has ignited tensions among 9/11 litigants, with attorneys for about 95% of claims advocating for an equitable split of any recovered funds, warning against a chaotic rush. The Justice Department is pushing for full U.S. ownership of the assets as crime-tainted property.
The $40 Million Security Breach and Reserve Vulnerabilities: Separately, blockchain investigator ZachXBT alleged over the weekend that more than $40 million in crypto was siphoned from U.S. government-linked seizure wallets. ZachXBT linked the alleged theft to John Daghita (aka 'Licks'), who has family ties to the executive leadership of Command Services & Support (CMDSS), a private firm contracted by the U.S. Marshals Service (USMS) to manage seized 'Class 2–4' cryptocurrencies. The breach was allegedly revealed during a 'band-for-band' wealth-comparison argument on Telegram, where screen-sharing activity provided a trail to trace the funds.
This incident highlights critical vulnerabilities in the U.S. government's fragmented custody system, which relies on a patchwork of agencies and contractors. A Government Accountability Office (GAO) decision from March 2025 confirmed CMDSS's contract for managing less liquid assets. The breach suggests a process failure rooted in vendor governance or insider access, not a technical protocol exploit. This follows previous scrutiny, including an October 2024 incident where a wallet linked to the Bitfinex hack was drained of approximately $20 million (largely recovered).
The stakes are elevated as U.S. policy shifts toward establishing a long-term Strategic Bitcoin Reserve, moving from a temporary custodian to a permanent holder. Analysts warn that if criminals believe seized funds can be stolen, forfeiture loses its deterrent effect. The alleged theft undermines the credibility needed for Bitcoin to be treated as a sovereign reserve asset, demanding vault-grade security and auditable procedures that the current ad hoc, multi-vendor system may lack.
