The FBI has seized over $2.4m worth of cryptocurrency from the Chaos ransomware gang, with the federal government now seeking forfeiture of the funds.
FBI Dallas revealed it seized 20.2 Bitcoin on April 15, 2025, from a cryptocurrency address associated with a member of the Chaos operator. This was worth $1.7m at the time of seizure.
Upon public disclosure on July 28, the seized Bitcoin was worth over $2.4m.
In a post on X, FBI Dallas noted that Chaos has been linked to ransomware attacks on victims in the Northern District of Texas.
Today, FBI Dallas made public the seizure of over $1.7 million worth of cryptocurrency as part of ongoing efforts to combat ransomware. The seized funds were traced to a cryptocurrency address allegedly associated with a member of the Chaos ransomware group, known as “Hors,” who… pic.twitter.com/uWeIMMGE9J
— FBI Dallas (@FBIDallas) July 28, 2025
Chaos ransomware is believed to have been formed by former members of the BlackSuit/Royal gang. A recent report by Cisco Talos revealed that Chaos has launched a wave of intrusions impacting a wide range of sectors.
US Seeking Forfeiture of Seized Bitcoin
A DoJ statement posted on July 28 revealed that the US government has filed a civil complaint in the Northern District of Texas seeking the forfeiture of the seized cryptocurrency.
“The seized cryptocurrency, now valued at over $2.4m, allegedly constitutes property involved in unlawful activity, or proceeds of or property derived from unlawful activity, including money laundering and extortion related to damage to a protected computer, commonly referred to as a ransomware attack,” the press release read.
In March 2025, US President Donald Trump signed an Executive Order to establish a Strategic Bitcoin Reserve and a US Digital Asset Stockpile.
The reserve is capitalized with bitcoin owned by the Department of Treasury that was forfeited as part of criminal or civil asset forfeiture proceedings.
The federal government also has established structured liquidation policies to ensure that a portion of seized assets is preserved in reserve, while only liquidating assets when necessary to meet operational funding needs or to provide restitution to victims.
To be granted forfeiture of seized crypto, the government must demonstrate evidence linking the assets to criminal conduct.
