Coinbase said on Oct. 13 that its Global Intelligence team participated in Joint Disruption Week in London from Oct. 6–9, working alongside Tech Against Scams, the UK’s National Crime Agency, the U.S. Department of Justice’s Scam Center Strike Force and other international law enforcement partners.
During the operation, investigators targeted accounts, digital infrastructure and payment systems used by West African criminal networks. Coinbase traced illicit financial activity on blockchain rails, supported asset freezes and shared intelligence in real time. The exchange connected blockchain transfers with evidence from fake profiles, messaging accounts and websites to identify relationships that might otherwise appear unrelated.
Targeted schemes included fraudulent cryptocurrency investments, police impersonation and staged video-call arrests designed to pressure victims into sending money. Coinbase Vice President Leah Bressack said: “When we disrupted scam compounds in Southeast Asia earlier this year, we proved that coordinated action across industry and law enforcement works.” She described the effort as “sustained pressure.”
The London event followed a Sept. 3 DOJ announcement that U.S. and British authorities had signed an agreement covering joint investigations into cryptocurrency investment fraud. According to the DOJ, reported losses from online investment fraud reached $8.65 billion in 2025, up 89% from $4.57 billion in 2023, based on FBI Internet Crime Complaint Center figures.
Earlier operations highlighted a broader pattern. On June 4, Coinbase said it froze more than $3 million in cryptocurrency connected to Southeast Asian scam networks. In September, a DOJ operation against Xinbi Guarantee and its vendors restrained over $52 million in cryptocurrency, including two wallets holding about $12 million. FinCEN also flagged $12.7 billion in suspicious activity associated with digital asset investment scams across 33,904 Bank Secrecy Act reports filed by roughly 1,300 institutions between Sept. 8, 2023 and Dec. 31, 2025. FinCEN found that scam proceeds were typically converted into stablecoins—almost exclusively USDT—before moving through decentralized finance services or exchanges outside the United States.
In a separate case on Oct. 13, the DOJ announced the arrests of Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas under an Ohio indictment alleging they helped North Korean IT workers obtain remote jobs at more than 70 U.S. companies. Prosecutors say the scheme generated approximately $3 million and caused affected firms at least another $3 million in legal and system-repair costs.
The indictment describes how overseas workers used stolen or fabricated identities, while domestic facilitators supplied equipment, addresses and financial accounts. Employer-issued laptops were configured for remote access so workers abroad could appear to operate from inside the U.S. Investigators seized approximately 187 laptops and remote-control devices during searches at more than 40 Texas residences between Sept. 21 and Sept. 25 under Operation Lonestar Roundup.
Cryptocurrency also appeared in the alleged payment network. A July 8, 2024 conversation cited in the indictment described using spreadsheets to manage transfers between bank accounts and virtual currencies before sending funds to a defendant. In a related earlier ruling, a federal judge ordered forfeiture of about $212,700 in stablecoins tied to North Korean IT worker payments, including roughly 158,123 USDC and 54,574 USDT. The FBI separately warned that North Korean IT workers increasingly recruit Americans facing financial pressure to help conceal fraudulent employment.
U.S. Attorney David M. Toepfer called the charges “an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”
