Brooklyn Court Orders DOJ to Account for 127,271 Bitcoin

What Happened

On March 24, 2026, Bloomberg reported that a Brooklyn federal court is pressing the US Department of Justice to explain how it came into possession of 127,271 Bitcoin — the largest cryptocurrency seizure in US history, announced in October 2025 and valued at approximately $15 billion.

The case is USA v. Chen Zhi, filed in the Eastern District of New York. Dozens of competing claimants have now filed in the case, including pig butchering victims, victims of Iran-sponsored terrorism arguing the coins were mined in Iran, and Prince Group itself disputing the underlying charges.

The DOJ charged Chen Zhi, founder and chairman of Cambodia's Prince Holding Group, with wire fraud conspiracy and money laundering conspiracy in October 2025. The core allegation: Chen ran a transnational criminal organization that operated forced-labor scam compounds across Cambodia, where trafficked workers were held against their will and compelled to run cryptocurrency investment fraud schemes against victims worldwide.

FBI Director Kash Patel called it one of the largest financial fraud takedowns in history. Chen was arrested in Cambodia and extradited to China in January 2026.

What the announcement left unaddressed was how the US government came to hold the Bitcoin. The coins are the same 127,271 BTC that were hacked from LuBian, a Chinese-Iranian Bitcoin mining operation that at its peak controlled nearly 6% of global hashrate, in December 2020. LuBian spent over $40,000 in the days after the hack sending hundreds of on-chain messages to the attacker's wallets pleading for return of funds and offering a reward.

Nothing came back. The coins sat completely dormant until June 2024, when they moved to new wallets. The DOJ filed its forfeiture complaint sixteen months later.

The largest Bitcoin seizure in history sits in government custody with no distribution plan and no explanation of how it got there.

The Question the DOJ Has Refused to Answer

The DOJ's indictment against Chen is extensive on the alleged crimes but says nothing about how investigators accessed or moved the Bitcoin. Bitcoin requires private keys to transfer. Someone had those keys. The government has not said who or how.

Three theories have circulated since the October 2025 announcement. First: a white-hat hacker exploited the same LuBian key generation vulnerability, stole the coins, and turned them over to US authorities. Second: the FBI independently discovered and exploited the vulnerability in LuBian's key generation algorithm, which Elliptic identified as susceptible to brute-force attack, and reconstructed the private keys without any external hacker involvement.

Third: the US government itself conducted the December 2020 hack, which China's National Computer Virus Emergency Response Center formally alleged in a November 2025 technical report. Chinese state media framed the seizure using the phrase meaning criminals preying on other criminals.

A spokesperson for Prince Group put the core accusation directly: the government's allegations are a distraction from the question it is desperate not to answer, which is who committed the largest digital asset theft in history by hacking LuBian's wallets in December 2020, and how that stolen Bitcoin ended up in the hands of the US government.

The DOJ's National Security Division called its actions legitimate law enforcement and declined to address the specific question of how the Bitcoin was obtained. Tom Clark, a partner at Stewarts Law specializing in asset recovery, told Bloomberg the government will ultimately have to explain how the Bitcoin was seized and why it is properly attributable to the alleged wrongdoing, at least to a degree sufficient to withstand adversarial scrutiny.

The Evidence Problems

An investigation by the International Consortium of Investigative Journalists published in March 2026 identified evidentiary problems in the indictment independent of the Bitcoin provenance question. Several photographs used by prosecutors as evidence of Prince Group's violent methods have no identifiable connection to the organization.

One photo presented as documenting a victim of Prince Group violence depicted a man bound to a lawn chair in a hospital bed. An ICIJ investigation traced the original image to a Mongolian-language website from April 2020, describing an unrelated medical incident where a man got stuck in a lawn chair and required medical assistance.

A second photo showed a man with a head wound, described as a Prince Group victim. On a Zoom call arranged by Prince Group representatives, the man in the photo told ICIJ that his injuries came from a drunken fight in 2015 and that he had never been a victim of organized crime violence.

Hany Farid, a visual forensics expert at the University of California at Berkeley, confirmed the man speaking on the Zoom call was the same person in the indictment photograph. The DOJ declined to comment on the photographs.

What This Means for You

The pig butchering enforcement context is the most directly relevant to OPNorange's audience. The DOJ announcement was presented as a landmark victim recovery action. The reality on the ground is that hundreds of verified pig butchering victims are having their restitution claims rejected.

The primary stated reason is that victims cannot demonstrate direct traceability between their specific fraud losses and the seized Bitcoin, given the laundering complexity involved. One victim attorney told ICIJ that a conversation with DOJ lawyers left him convinced the government was committed to denying claims.

Another said he was told victims would be contacted if and when DOJ determines it appropriate. The $15 billion is in government custody with no distribution mechanism in place.

The LuBian key generation vulnerability is the OpSec thread worth extracting from this case. LuBian was not a small operation. It controlled roughly 6% of global Bitcoin hashrate at its peak and operated industrial-scale mining infrastructure in China and Iran. Its private key generation algorithm was vulnerable to brute-force attack.

That is not a sophisticated nation-state exploit. It is a fundamental cryptographic implementation failure. The coins stayed dormant for four years not because they were hidden or protected but because whoever held them was waiting. The operational lesson: the security of a Bitcoin holding is only as strong as the entropy behind the key generation process.

An algorithm that produces predictable or recoverable keys is not a hardware problem or a custody problem. It is a mathematics problem, and it does not advertise itself.

The civil forfeiture mechanics matter for anyone who follows government Bitcoin holdings. The US government now holds over 324,000 BTC across various seizures. The Prince Group coins alone represent the largest single tranche. There is no statutory framework requiring distribution to victims in cryptocurrency forfeiture cases at the scale and complexity of this one.

Government custody of seized Bitcoin is not the same as victim restitution. It rarely leads there.

What to Watch

The Brooklyn federal court proceedings are the primary indicator. If the judge compels the DOJ to explain how it obtained the Bitcoin, the answer will be the most significant disclosure in the history of US government cryptocurrency operations. Watch for any court order requiring the government to detail its acquisition method.

Watch also for how the competing claimant groups, particularly the Iran terrorism victims asserting the coins were mined with Iranian state backing, affect the forfeiture disposition. If those claims gain traction, the distribution question becomes substantially more complicated than a direct victim restitution framework would suggest.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.