U.S. Seizes $2.8M Crypto from Zeppelin Ransomware Operator

U.S. authorities have seized $2.8 million in cryptocurrency from Ianis Aleksandrovich Antropenko, an alleged operator of the Zeppelin ransomware strain, marking a significant enforcement action against cybercrime. The U.S. Department of Justice (DOJ) announced the seizure on August 14, 2025, along with the unsealing of warrants charging Antropenko with conspiracy to commit computer fraud, abuse, and money laundering [1]. The operation included the confiscation of $70,000 in cash and a luxury vehicle, and the seized cryptocurrency—comprising ETH, USDT, and USDC—was directly linked to ransom payments made by victims of the ransomware attacks [2].

The ransomware operation conducted by Antropenko and his network involved encrypting victims’ data and demanding payments in exchange for decryption keys or to prevent the release of stolen information. The DOJ emphasized that these attacks targeted victims both domestically and internationally, highlighting the global reach and sophistication of modern ransomware schemes [3]. The indictment also revealed that the group used advanced tactics to launder funds, including the now-dismantled cryptocurrency mixing service ChipMixer [2].

This case exemplifies the U.S. government’s broader strategy to dismantle the financial infrastructure of ransomware operations. Since 2020, the DOJ has returned more than $350 million in ransom-related funds to victims and secured over 180 cybercrime-related convictions. The assets recovered from Antropenko will be added to the government’s digital asset reserve, established in March 2025 via executive order, which is designed to manage seized crypto through criminal forfeitures [1]. According to Treasury Secretary Scott Bessent, the national crypto reserve is now valued at approximately $20 billion, much of which comes from similar operations [4].

The Antropenko case underscores the dual approach of U.S. law enforcement: not only punishing cybercriminals but also targeting the economic incentives that sustain ransomware attacks. As these operations grow in frequency and complexity, authorities are intensifying their focus on the financial underpinnings of cybercrime. This enforcement action follows a major FBI seizure in Dallas in April 2025, where $2.4 million in Bitcoin was confiscated [4]. These efforts reflect the increasing ability of U.S. agencies to track and confiscate digital assets, even as criminals employ increasingly complex laundering techniques.

The ongoing investigation into Antropenko’s network continues, with law enforcement working to uncover further details about the methods and associates involved in the ransomware operation. The case demonstrates the U.S. government’s growing capacity to respond to cyber threats through both investigative and financial enforcement tools [3]. As the DOJ continues to expand its focus on ransomware, the seizure of assets is expected to play a central role in disrupting the operations and reducing the profitability of cybercrime [1].

Source:

[1] DOJ Seizes $2.8M Tied to Crypto Ransomware Case (https://www.livebitcoinnews.com/doj-seizes-2-8m-tied-to-crypto-ransomware-case/)

[2] U.S. Authorities Seize Crypto from Ransomware Operator (https://cointelegraph.com/news/us-authorities-seize-crypto-ransomware-operator)

[3] U.S. Authorities Raid Ransomware Operator, Seize $2.8M in Crypto (https://cryptoslate.com/us-authorities-raid-ransomware-operator-seize-2-8m-in-crypto/)

[4] DOJ Seizes $2.8M Crypto Tied to Zeppelin Ransomware Scheme (https://www.ainvest.com/news/doj-seizes-2-8m-crypto-tied-zeppelin-ransomware-scheme-2508/)