DOJ Seizes $2.8M in Crypto Tied to Zeppelin Ransomware Scheme

The U.S. Department of Justice has executed a major seizure of cryptocurrency valued at over $2.8 million, along with $70,000 in cash and a luxury vehicle, from an alleged ransomware operator linked to the Zeppelin ransomware campaign [1]. The assets were confiscated through a series of unsealed warrants served in federal district courts across Texas, Virginia, and California, and are reportedly tied to proceeds from global ransomware attacks [2].

Ianis Antropenko, the individual at the center of the operation, is accused of using the Zeppelin ransomware to target individuals, businesses, and public-sector organizations worldwide, including in the United States. Prosecutors allege that he and his co-conspirators engaged in data theft and demanded payment to restore access to compromised systems. The digital assets were held in a cryptocurrency wallet linked to Antropenko, according to court documents [3].

The DOJ alleges that Antropenko attempted to launder the proceeds of his cyberattacks through the now-defunct cryptocurrency mixing service, ChipMixer. The service is said to have been used to obscure the trail of illicit funds. The seizure marks a key step in the DOJ’s ongoing efforts to trace and recover digital assets tied to cybercrime, a growing concern as cybercrime losses in the U.S. reached $16.6 billion in 2024, with ransomware being a major contributor [4].

This enforcement action aligns with the DOJ’s broader strategy to target the financial infrastructure of cybercriminal networks. Since 2020, the DOJ’s Computer Crime and Intellectual Property Section has secured over 180 cybercrime convictions, recovered more than $350 million for victims, and prevented over $200 million in potential ransom payments. The department has increasingly leveraged advanced cryptocurrency tracking tools to freeze and seize assets linked to criminal activity [5].

The case remains under investigation, with the possibility of further arrests or indictments. Antropenko has been formally indicted on charges of conspiracy to commit computer fraud and abuse, as well as money laundering. If convicted, victims of the alleged attacks may see a path to financial recovery and some form of restitution. However, the legal process could take months, and the outcome depends on the court proceedings.

Sources:

[1] Department. (2025). Justice Department Announces Seizure of Over $2.8 Million in Cryptocurrency, Cash and Other Assets. https://www.justice.gov/usao-ndtx/pr/justice-department-announces-seizure-over-28-million-cryptocurrency-cash-and-other

[2] CoinCentral. (2025). DOJ Seizes $2.8 Million in Crypto Tied to Global Ransomware Operation. https://coincentral.com/doj-seizes-2-8-million-in-crypto-tied-to-global-ransomware-operation/

[3] Cointelegraph. (2025). US Authorities To Seize $2.8M Crypto From Alleged Ransomware Operator. https://cointelegraph.com/news/us-authorities-seize-crypto-ransomware-operator

[4] Bitcoinsensus. (2025). Zeppelin Ransomware: DOJ Seized $2.8M Crypto. https://www.bitcoinsensus.com/news/blockchain/zeppelin-ransomware-doj-seized-2-8m-crypto

[5] CryptoDnes.bg. (2025). DOJ Targets Suspected Zeppelin Ransomware Operator, Seizes Millions in Crypto. https://cryptodnes.bg/en/doj-targets-suspected-zeppelin-ransomware-operator-seizes-millions-in-crypto/