US Federal Crypto Enforcement Actions: Complete Tracker

US Federal Crypto Enforcement Actions: Tracking the Regulatory Reckoning

Federal enforcement against cryptocurrency companies and individuals has produced billions of dollars in penalties, established critical legal precedents, and reshaped the operational landscape for digital asset businesses. Understanding the patterns, priorities, and outcomes of federal crypto enforcement is essential for compliance planning, risk assessment, and strategic decision-making.

This tracker provides a comprehensive analysis of enforcement actions by the SEC, CFTC, FinCEN, DOJ, and OFAC — the five federal agencies that have been most active in crypto enforcement.

Enforcement by the Numbers

The scale of federal crypto enforcement has grown exponentially:

• SEC: Over 200 crypto-related enforcement actions since 2013, with dramatically increased activity from 2022 onward
• CFTC: Over 80 digital asset-related enforcement actions, with record penalties in 2023
• DOJ: Dozens of criminal prosecutions including the largest fraud cases in financial history
• FinCEN: Civil money penalties against exchanges and individuals for BSA violations
• OFAC: Precedent-setting designations of crypto mixing services and wallet addresses

The aggregate penalties from federal crypto enforcement now exceed $15 billion — a figure that reflects both the scale of violations and the regulatory priority assigned to digital asset oversight.

SEC Enforcement: Securities Law Violations

Enforcement Priorities

The SEC’s crypto enforcement program, previously led by the Crypto Assets and Cyber Unit (formerly the Cyber Unit), has focused on:

1. Unregistered securities offerings: Token sales that constituted unregistered securities offerings under the Howey Test
2. Unregistered exchanges: Platforms facilitating trading of digital asset securities without registration
3. Unregistered broker-dealer activity: Entities soliciting investors or facilitating transactions without proper registration
4. Fraud: Material misrepresentations in connection with token sales and crypto investment products
5. Market manipulation: Wash trading, pump-and-dump schemes, and other manipulative practices

Landmark SEC Actions

SEC v. Ripple Labs, Inc. (2020-2024)

• Allegation: Ripple raised over $1.3 billion through unregistered sales of XRP
• Outcome: Partial summary judgment — institutional sales were securities transactions; programmatic exchange sales were not
• Penalty: $125 million civil penalty (reduced from SEC’s requested $2 billion)
• Significance: Established that the manner of sale matters for securities classification; created distinction between primary and secondary market transactions

SEC v. Terraform Labs and Do Kwon (2023-2024)

• Allegation: Securities fraud and unregistered securities offerings related to Terra/LUNA ecosystem collapse
• Outcome: Jury verdict finding civil fraud; $4.5 billion settlement
• Penalty: $4.5 billion in disgorgement and civil penalties
• Significance: Rejected the Ripple distinction between institutional and retail sales; applied Howey Test broadly to all token distribution channels

In re Coinbase, Inc. (2023-ongoing)

• Allegation: Operating as an unregistered securities exchange, broker, and clearing agency by facilitating trading of digital asset securities
• Outcome: Ongoing litigation
• Significance: Tests whether major US exchanges are operating illegally by listing tokens the SEC considers securities

SEC v. Genesis and Gemini (2023)

• Allegation: Unregistered offering of Gemini Earn crypto lending program
• Outcome: Settlement — Genesis parent company entered bankruptcy; Gemini settled
• Penalty: $21 million penalty for Gemini; Genesis bankruptcy distribution
• Significance: Established that crypto lending programs may constitute securities offerings

In re BlockFi Lending LLC (2022)

• Allegation: Offering unregistered securities through crypto lending product
• Outcome: Settlement
• Penalty: $100 million ($50 million to SEC, $50 million to states)
• Significance: First major enforcement action establishing crypto lending as securities activity

SEC Enforcement Patterns

Analysis of SEC crypto enforcement reveals consistent patterns:

• Tokens with development teams: The SEC almost always asserts that tokens associated with identifiable development teams are securities
• Yield products: Crypto lending and staking products that offer returns are targeted as unregistered securities
• Exchange listings: The SEC has moved from targeting issuers to targeting exchanges that list alleged securities
• Celebrity promotions: Multiple actions against celebrities who promoted tokens without disclosing compensation (Kim Kardashian: $1.26 million; Floyd Mayweather and DJ Khaled: combined $767,500)

CFTC Enforcement: Commodity and Derivatives Violations

Major CFTC Actions

CFTC v. Binance Holdings Limited (2023)

• Allegation: Operating an unregistered derivatives exchange, failure to implement AML programs, and willfully evading US law as outlined in the CFTC’s digital commodity regulation framework
• Outcome: Settlement with criminal plea agreement
• Penalty: $2.7 billion (CFTC portion); $4.3 billion total with DOJ and FinCEN
• Significance: Largest CFTC penalty in history; established that offshore exchanges serving US customers are subject to US jurisdiction

CFTC v. BitMEX (2020-2022)

• Allegation: Operating an unregistered trading platform for digital commodity derivatives and failing to implement AML programs
• Outcome: Settlement and criminal guilty pleas by founders
• Penalty: $100 million civil penalty; criminal penalties for individuals
• Significance: First major enforcement action against an offshore derivatives exchange; criminal charges against individual executives

CFTC v. Ooki DAO (2022)

• Allegation: Operating an unregistered trading platform through a DAO structure
• Outcome: Default judgment against the DAO (which did not appear to defend)
• Penalty: $643,542 civil monetary penalty
• Significance: Established that a DAO can be held liable as an “unincorporated association” — precedent for DeFi enforcement

CFTC v. Digitex Futures (2022)

• Allegation: Operating an unregistered exchange and market manipulation by the exchange’s founder
• Outcome: Settlement and criminal charges
• Penalty: $16 million civil penalty; criminal prosecution of founder
• Significance: Combined exchange registration and market manipulation enforcement

CFTC Enforcement Trends

• Expanding offshore reach: The CFTC has successfully asserted jurisdiction over offshore platforms serving US customers
• DeFi enforcement: The Ooki DAO action signals willingness to pursue decentralized protocols
• Individual liability: Increasing focus on personal liability for executives and founders
• Manipulation cases: Growing number of cases targeting wash trading, spoofing, and price manipulation in crypto markets

DOJ Criminal Prosecutions

Historic Criminal Cases

United States v. Samuel Bankman-Fried (2023-2024)

• Charges: Fraud, conspiracy, money laundering, campaign finance violations
• Outcome: Convicted on all seven counts after trial
• Sentence: 25 years imprisonment
• Amount: Estimated $8+ billion in customer losses
• Significance: Largest financial fraud prosecution in US history; demonstrated DOJ’s ability to prosecute complex crypto fraud

United States v. Changpeng Zhao (2023-2024)

• Charges: Failure to maintain effective AML program (BSA violation)
• Outcome: Guilty plea
• Sentence: 4 months imprisonment, $50 million personal fine
• Significance: Criminal prosecution of the world’s largest exchange CEO; demonstrated personal criminal liability for AML failures

United States v. Roman Storm (Tornado Cash) (2023-ongoing)

• Charges: Money laundering conspiracy, sanctions violations, operating an unlicensed money transmitting business
• Outcome: Ongoing prosecution
• Significance: Tests criminal liability for developers of mixing protocols

United States v. Ilya Lichtenstein and Heather Morgan (Bitfinex hack) (2022-2024)

• Charges: Conspiracy to launder approximately 120,000 Bitcoin stolen from Bitfinex (valued at $4.5 billion at time of seizure)
• Outcome: Guilty pleas; Lichtenstein sentenced to 5 years
• Significance: Largest seizure of cryptocurrency in DOJ history

DOJ Enforcement Themes

• Fraud cases: The DOJ has pursued the largest crypto fraud cases as criminal matters, not civil
• AML failures: Criminal prosecution for BSA violations, particularly for exchange operators
• Sanctions evasion: Criminal charges for facilitating sanctions violations through crypto
• Asset forfeiture: Aggressive use of civil and criminal forfeiture to seize cryptocurrency
• International cooperation: Coordination with foreign law enforcement for cross-border cases

FinCEN Civil Money Penalties

Binance (2023): $3.4 billion for willful violations of BSA, including failure to register as MSB, failure to implement effective AML program, and failure to file SARs for suspicious transactions totaling over $898 million

BTC-e (2017): $110 million against the exchange and $12 million against its operator, Alexander Vinnik, for facilitating transactions involving ransomware proceeds, darknet marketplaces, and other illicit activity

BitMEX (2022): $100 million (shared with CFTC) for operating as an unregistered MSB and failing to implement an effective AML program

Larry Dean Harmon / Helix (2020): $60 million against a cryptocurrency tumbling service for operating as an unregistered MSB and facilitating money laundering

OFAC Designations

Tornado Cash (2022): OFAC designated the Tornado Cash smart contracts as SDN property, marking the first sanctioning of autonomous code. The Fifth Circuit partially reversed this designation in 2024, holding that immutable smart contracts are not “property” of a foreign national, though the broader enforcement implications continue to evolve.

Blender.io (2022): Designated for processing more than $500 million in illicit transactions, including proceeds from the Lazarus Group’s $620 million Ronin Bridge hack.

Virtual currency addresses: OFAC has designated dozens of specific cryptocurrency addresses associated with sanctioned individuals and entities, requiring US persons to block transactions involving these addresses.

Enforcement Defense Strategies

Common Defense Arguments

Firms and individuals facing federal crypto enforcement have raised several recurring defenses:

• Fair notice: Due process requires adequate notice of what conduct is prohibited; the SEC’s regulation-by-enforcement approach may deprive respondents of fair notice
• Major questions doctrine: Agency assertion of jurisdiction over an entire industry without clear Congressional authorization may exceed statutory authority
• Commodity classification: The asset in question is a commodity, not a security, placing it outside SEC jurisdiction — a distinction the CLARITY Act seeks to formalize
• Decentralization: The network is sufficiently decentralized that the token is no longer an investment contract
• Personal jurisdiction: Offshore entities may challenge US jurisdiction
• Statute of limitations: Many token offerings occurred years before enforcement action

Effectiveness of Defenses

In practice, these defenses have had mixed success:

• The fair notice defense has been rejected in most SEC actions, though some courts have expressed sympathy
• The Ripple decision provided a partial defense based on the manner of sale
• Offshore jurisdiction has not been a successful defense when the entity served US customers
• Statute of limitations challenges have succeeded in some cases to narrow the scope of enforcement

What This Means for Your Business

For exchanges: Federal enforcement has made clear that serving US customers — even from offshore — triggers US regulatory obligations. Registration and compliance are not optional. Budget for compliance as a percentage of revenue, not as an afterthought.

For token issuers: The enforcement pattern is clear: tokens sold with marketing emphasizing returns, associated with development teams, and lacking current utility will be treated as securities. Structure your offering accordingly or face enforcement risk.

For compliance officers: Document everything. Enforcement defense depends on demonstrating good faith compliance efforts. Maintain records of legal analyses, compliance program implementation, and decision-making processes. The existence of a compliance program (even an imperfect one) significantly affects enforcement outcomes.

For institutional investors: Counterparty due diligence should include assessment of regulatory risk. Invest through regulated channels and with counterparties that have demonstrated compliance. The risks of dealing with non-compliant entities include potential disgorgement, inability to recover assets, and reputational harm.

The pace and scale of federal crypto enforcement show no signs of slowing. The era of regulatory ambiguity is ending, replaced by clear expectations and severe consequences for non-compliance. For a broader view of how US policy compares internationally, see the US vs. EU policy benchmark.