United States v. Approximately 1,467,761.163191 Usdt
Opinion
UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
UNITED STATES OF AMERICA, Plaintiff, Case No. 25-cv-34 (JMC) v. APPROXIMATELY 1,467,761.163191 USDT, Defendant in rem.
MEMORANDUM OPINION The United States brought this forfeiture action in rem against approximately 1,467,761.163191 USDT (Defendant Property). The Government argues that the Defendant Property is subject to seizure and forfeiture under 18 U.S.C. § 981(a)(1)(C) and 28 U.S.C. § 2461(c) as property “which constitutes or is derived from proceeds traceable” to identity theft, computer fraud and abuse, wire fraud, money laundering, and other related offenses. ECF 12-2 ¶¶ 66–70. The Government has satisfied the requisite notice requirements, yet potential claimants have failed to appear or defend this action. The Clerk of Court entered default, and the Government now moves for an entry of default judgment. The Court finds that the Government has demonstrated its entitlement to such judgment and GRANTS the motion.1 I. FACTUAL BACKGROUND This case arises out of an FBI investigation of a cryptocurrency heist perpetuated by North Korean hackers against a company registered in the British Virgin Islands and headquartered in
Unless otherwise indicated, the formatting of citations has been modified throughout this opinion, for example, by omitting internal quotation marks, emphases, citations, and alterations and by altering capitalization. All pincites to documents filed on the docket in this case are to the automatically generated ECF Page ID number that appears at the top of each page.
Australia. ECF 12-2 ¶ 35. The hackers used U.S.-based computer infrastructure to create accounts for false online personas, including two personas known as John Rafman and Andrychuk Lu. Id. ¶¶ 39–40. Once hired by Company 1, Rafman, Lu, and others used their inside access to steal cryptocurrency, including the Defendant Property. Id. ¶ 33. Specifically, Company 1 gave Rafman the “master key” for two vaults, which contained smart contracts on various blockchains. Id. ¶ 40.
Rafman presumably shared the master key with Lu. On March 15, 2024, Lu used the master key access to execute a function on Company 1’s master smart contract that initiated “an unauthorized transfer of virtual currency assets from the . . . vaults, belonging to Company 1, to wallets controlled by the North Korean IT workers.” Id. ¶¶ 32, 44. To use their Company 1 email accounts, the North Korean hackers used a U.S.-based Internet Protocol (IP) address that they accessed through a virtual private network (VPN) service. Id. ¶ 34. The hackers accessed their email accounts from the U.S. IP address “at least 23 times” between October 5, 2023, and March 15, 2024. Id. ¶ 60. The Company 1-provided email addresses were hosted by Google and the U.S. IP address was “controlled by the U.S.-based internet service provider Quadranet,” likely passing through datacenters within the United States. Id. As the Government represents, “[t]he Defendant Property represents a majority of the funds traceable to the March 2024 exploit and theft of funds from Company 1.” Id. ¶ 38. On or about April 1, 2024, the FBI seized various cryptocurrencies as part of this investigation, including the 1,467,761.163191 USDT that constitutes the Defendant Property. Id. ¶ 62. The Defendant Property was transferred into an FBI-controlled virtual currency wallet and is now in possession of the U.S. Marshals Service. Id. ¶¶ 63–64.
II. PROCEDURAL HISTORY On January 6, 2025, the Government filed a verified complaint asserting a civil forfeiture action in rem against the Defendant Property. ECF 1. One day later, the Court made a probable cause finding and issued a warrant for arrest in rem with regards to the Defendant Property. ECF 3.
On February 6, 2025, the Government commenced notification of this forfeiture online at forfeiture.gov for thirty consecutive days. ECF 5-1 at 1. Verified claims in response to this notice were due no later than April 6, 2025. ECF 9 ¶ 3. No claims based on publication were filed. Id. The Government also sent direct notice to all nine interested parties in the Defendant Property on January 15, 2025. Id. ¶ 13; ECF 9-1; ECF 9-2; ECF 9-3; ECF 9-4.
On June 6, 2025, the Government moved for default judgment. ECF 9. In October 2025, the Court ordered the Government to file a supplemental memorandum with the Court detailing the factual and legal bases for finding that the Defendant Property had the necessary nexus with the United States to satisfy the elements of the underlying criminal statutes. Oct. 16, 2025 Min.
Order. The Government filed its supplemental memorandum for default judgment and an amended verified complaint, to incorporate the additional information the Court requested, on December 22, 2025. ECF 12-2; ECF 13.
III. LEGAL STANDARD The Federal Rules of Civil Procedure authorize a district court to enter default judgment against a defendant who fails to defend its case. Fed. R. Civ. P. 55(b)(2). “Obtaining a default judgment is a two-step process.” United States v. Twenty-Four Cryptocurrency Accts., 473 F. Supp. 3d 1
IV. ANALYSIS The Court finds that default judgment is warranted. As discussed in greater detail below, (a) the Government complied with notice requirements; and (b) the verified complaint contains sufficient information to support a finding by the preponderance of the evidence that forfeiture of the Defendant Funds is appropriate under 18 U.S.C. § 981(a)(1)(C) and 28 U.S.C. § 2461(c). ECF 12-2 ¶ 11.
A. Notice Before the Court enters default judgment, the Government must show that it complied with the notice requirements in the Supplemental Rules. Supplemental Rule G requires two forms of notice in a forfeiture action in rem: notice via publication as well as direct notice to potential claimants. See Fed. R. Civ. P. Supp. R. G(4)(a), (b). Here, the Government has satisfied its obligation as to both publication and direct notice.
First, the Government provided publication notice. Publication notice requires the Government to “describe the property, state the time to file a claim and answer, and name the government attorney to be served with the claim and answer.” Cryptocurrency Accts., 473 F. Supp. 3d at 5 (citing Fed. R. Civ. P. Supp. R. G(4)(a)(ii)). Such notice can be published “on an official internet government forfeiture site for at least 30 consecutive days.” Fed. R. Civ. P. Supp. R. G(4)(a)(iv)(C). In this case, the Government published a notice of forfeiture online at http://www.forfeiture.gov on February 6, 2025. ECF 9 ¶ 12. The publication contained all the required information and was publicly available for thirty consecutive days. ECF 5-1 at 2–3. No claims based on publication were filed.
Second, the Government satisfied the direct notice requirement. Direct notice must be sent “to any person who reasonably appears to be a potential claimant.” Fed. R. Civ. P. Supp. R. G(4)(b)(i). Actual notice is not required, but the government must send direct notice “by means reasonably calculated to reach the potential claimant.” Id. G(4)(b)(iii)(A). When the government attempts to provide notice and “hear[s] nothing back indicating that anything ha[s] gone awry,” then it is reasonable to assume that service was effective. Jones v. Flowers, 547 U.S. 220, 226 (2006). On January 15, 2025, the Government represents that it sent notice to all nine interested parties in this case via e-mail. ECF 9 ¶ 13; ECF 9-1; ECF 9-2; ECF 9-3; ECF 9-4. By ensuring that each identified potential claimant had at least one unreturned mailing, the Government has satisfied its burden to provide direct notice of this action and met all the notice requirements.
B. Adequacy of Complaint As described above, default judgment in a civil forfeiture action in rem requires the Government to fulfill two requirements. First, the Government must demonstrate that its forfeiture action adequately “aris[es] from a federal statute.” Fed. R. Civ. P. Supp. R. G(1). Second, its complaint must satisfy the six elements set forth in Supplemental Rule G(2): “(a) be verified; (b) state the grounds for subject-matter jurisdiction, in rem jurisdiction over the defendant property, and venue; (c) describe the property with reasonable particularity; (d) if the property is tangible, state its location when any seizure occurred and—if different—its location when the action is filed; (e) identify the statute under which the forfeiture action is brought; and (f) state sufficiently detailed facts to support a reasonable belief that the government will be able to meet its burden at trial.” Rule G(1) effectively collapses into (G)(2)’s requirements, so the Court addresses the Rules collectively below.
The Government has filed a verified compliant “identifying the statute under which the forfeiture action was brought and describing the Defendant Propert[y] in extensive detail.”
Cryptocurrency Accts., 473 F. Supp. 3d at 6–7; ECF 12-2 ¶¶ 62–70 (describing the funds that constitute the Defendant Property, where the funds were transferred, and the statutory provisions under which forfeiture is sought). The Court also finds that the complaint properly establishes the bases for subject-matter jurisdiction and venue. Under 28 U.S.C. § 1355(a), district courts “have original jurisdiction . . . of any action or proceeding for . . . forfeiture, pecuniary or otherwise, incurred under any Act of Congress”—in this case, 18 U.S.C. § 981. Further, under 28 U.S.C. § 1345, “the district courts shall have original jurisdiction of all civil actions, suits or proceedings commenced by the United States.” This being a civil forfeiture action initiated by the United States, the Court is satisfied that it has subject-matter jurisdiction. Additionally, venue can be established under 28 U.S.C. § 1395(b) and (c). Under 28 U.S.C. § 1395(b), a civil proceeding for forfeiture “may be prosecuted in any district where such property is found” and, under subsection (c), “[a] civil proceeding for the forfeiture of property seized outside any judicial district may be prosecuted in any district into which the property is brought.” Because the Defendant Property was seized outside of any judicial district and is now under the control of the U.S. Marshals Service in this district, the Court finds that venue is proper here. ECF 12-2 ¶¶ 63–64. Finally, the Court finds that it has in rem jurisdiction over the Defendant Property held by the U.S. Marshals Service. See United States v. All Assets Held in Acct. No. XXXXXXXX, 330 F. Supp. 3d 150, 156 (D.D.C. 2018) (“Traditionally, when exercising in rem jurisdiction, the defendant property is physically present within the court’s territorial jurisdiction.”); United States v. $299,218.48 in U.S. Currency, 742 F. Supp. 3d 1
The final element is whether the Government has alleged sufficient facts in its complaint to “support a reasonable belief that the government will be able to meet its burden of proof at trial.”
Fed. R. Civ. P. Supp. R. G(2)(f); see Mingzheng Int’l Trading, 324 F. Supp. 3d at 41 (interpreting this rule to require that the complaint “establish a reasonable belief that the government could prove by a preponderance of the evidence that [Defendant Property is] subject to civil in rem forfeiture”). Supplemental Rule G(2) “does not articulate an onerous standard,” but instead establishes a “low bar” that is appropriate at the default judgment stage “where a court should exercise greater flexibility in judging factual allegations.” Mingzheng Int’l Trading, 324 F. Supp. 3d at 51–52.
The complaint satisfies this low bar. The Government alleges, among other bases, that the Defendant Property is subject to forfeiture pursuant to 18 U.S.C. § 981(a)(1)(C) and 28 U.S.C. § 2461(c) because it is property “constituting or derived from proceeds traceable to” wire fraud under 18 U.S.C. § 1343. ECF 12-2 ¶ 66. The wire fraud statute requires that a defendant “transmit[] or cause[] to be transmitted” a wire transmission “in interstate or foreign commerce . . . for the purpose of executing [the] scheme or artifice” to defraud. 18 U.S.C. § 1343. It is well-established that the wire “transfer need not be the scheme’s objective; it need only be a step in the plot.” United States v. White, 737 F.3d 1121, 1129 (7th Cir. 2013).
The complaint describes in detail a scheme by North Korean hackers to illicitly access the Defendant Property through the use of U.S.-based computer infrastructure, including by using a VPN to lease a U.S. IP address. In doing so, the perpetrators transmitted wire communications in interstate or foreign commerce as part of their scheme to defraud Company 1. Specifically, the hackers “leased U.S. IP addresses from U.S. internet service provider Quadranet . . . to effectuate their criminal scheme.” ECF 13 at 22. During the course of the heist, from about October 5, 2023, to March 15, 2024, the hackers accessed their Company 1 email addresses from their U.S.-based IP address at least 23 times, including four logins on the day of the heist. Id. at 23. The hackers’ fraudulent use of the U.S. IP address to send emails constituted transmissions in interstate or foreign commerce as part of their scheme to gain access to Company 1’s vaults. Id.; see United States v. Jameson, 371 F. App’x 963, 966 (10th Cir. 2010) (holding that downloading and sending images from a specific U.S.-based IP address satisfied the statutory requirement of communications in interstate or foreign commerce); United States v. Wasson, 426 F. Supp. 3d 822, (D. Kan. 2019) (holding that use of a U.S.-based IP address and Google account constituted uses of facilities of interstate commerce). Accordingly, the Government has met its burden to show that it could prove at trial that the Defendant Property constitutes the proceeds of wire fraud under 18 U.S.C. § 1343 and is forfeitable under 18 U.S.C. § 981(a)(1)(C).
The Court finds that the Government has thus met its burden under Supplemental Rule G(2) and alleged facts sufficient to establish a reasonable belief that it would be able to prove its forfeiture claim by a preponderance of the evidence. As a result, both Supplemental Rules G(1) and G(2) are satisfied.
* * * Because the verified complaint states a claim for forfeiture in rem pursuant to Supplemental Rules G(1) and G(2), the Government has complied with the notice requirements of Supplemental Rule G(4), and no claimant has appeared in this action, the Government’s motion for default judgment, as supplemented, is GRANTED. It is further ORDERED: 1. That default judgment is hereby entered against all persons or entities claiming an interest in the Defendant Property; 2. That the Defendant Property shall be forfeited to the United States of America and no right, title, or interest in the following property shall exist in any other entity or person; 3. Title to the Defendant Property is vested solely in the United States; 4. That the Defendant Property shall be disposed of according to law; and 5. That no additional action is required, and this matter is dismissed. The Clerk of Court is directed to close this case.
A separate order accompanies this memorandum opinion.
SO ORDERED.
__________________________ JIA M. COBB United States District Judge Date: February 6, 2026
Case-law data current through December 31, 2025. Source: CourtListener bulk data.