Federal prosecutors in Massachusetts filed a civil forfeiture action Sept. 28 seeking roughly 110,270 Tether (USDT), valued at about $47,000, that remains in government custody after investigators traced the stablecoin to a Binance account allegedly used to launder stolen Bitcoin.

The complaint, filed in U.S. District Court for the District of Massachusetts, targets property allegedly derived from wire fraud tied to a June 2023 account-takeover scheme. According to the filing, the perpetrator contacted a beneficiary of a Massachusetts family trust through text messages purporting to come from Coinbase on June 1 and June 2, 2023. The messages induced the beneficiary, who lives in San Diego, to disclose login credentials and account details.

Two wallets within one Coinbase account held a combined 33.7 BTC, worth about $900,000 at the time, according to the filing. The family trust wallet held 28.5 BTC. Federal prosecutors allege all 33.7 BTC moved without the owners' knowledge or consent to multiple external cryptocurrency wallets.

What did investigators trace?

Investigators followed the on-chain trail to 11.203562 BTC deposited into a Binance account across six transactions between June 5 and June 15, 2023. The account, opened roughly May 25, 2023 through Binance Spain S.L., was held in the name of Enrique Mora Morales. Spanish authorities later determined that the identification number used to open the account was unassigned, the complaint states.

About 15 devices accessed the account between May and November 2023. The deposited Bitcoin was converted almost immediately into Monero (XMR), a privacy-focused cryptocurrency whose protocol obscures transaction amounts and counterparty addresses. Roughly 75% of the converted XMR was withdrawn successfully, the filing says, while later attempts involving about 758.552588 XMR were rejected.

Because the BTC-to-XMR path is difficult to follow, investigators concentrated on the Bitcoin leg before the swap. They located Tether that remained in the Binance account after the conversion.

How did the government obtain the USDT?

Binance froze the account at the FBI's request. Prosecutors obtained a seizure warrant on Oct. 30, 2024. On or about Aug. 3, 2026, Binance transferred approximately 110,270 USDT to a government-controlled wallet. The government valued the seized tokens at about $47,000 when it announced the action Sept. 28.

What does the case establish?

The civil complaint seeks forfeiture of the USDT as property allegedly traceable to wire-fraud proceeds. The filing does not identify a criminal defendant, attribute the spoofed Coinbase messages to a named individual, or explain how the perpetrator obtained the victim's phone number. The complaint also does not state whether the seized USDT represents all remaining proceeds from the scheme or whether victims have been compensated.

What happens next?

Under federal civil forfeiture rules, potential claimants may contest the seizure before the court decides whether the assets should be forfeited to the government or returned to victims. The Massachusetts filing opens a contested-proceedings window in which the family trust, any third-party claimants or the nominal account holder may assert an interest in the USDT.

The forfeiture complaint lands against a broader enforcement backdrop: account-takeover fraud and SIM-swap scams remain a leading vector for cryptocurrency theft, and exchanges serving U.S. users have increasingly faced requests to freeze and surrender assets tied to such schemes. The Massachusetts case illustrates how a partial on-chain recovery — 11.2 of 33.7 BTC traced, then swapped into Monero, with only residual USDT left behind — can still produce a federal action years after the original theft.