Last spring the FBI quietly seized 20.2 Bitcoin from a wallet linked to a Chaos ransomware affiliate known as Hors. In just three months the take, worth about $1.7 million, has grown in value to $2.4 million.
But the size of the haul isn’t the only notable aspect of this operation. The law enforcement agency’s latest win against a prolific ransomware gang hints at a much bigger experiment, one that could redefine how the United States handles illicit digital assets and how ransomware groups approach their business model.
This seizure is among the first high-value test cases for the Strategic Bitcoin Reserve, a federal policy enacted via Executive Order in March 2025. Under this policy, digital assets confiscated through criminal or civil forfeiture are no longer automatically auctioned and converted to fiat currency. Instead, a portion is retained in a US-managed reserve, with liquidation occurring only under defined conditions, for example, to fund operational needs or pay victim restitution.
The DOJ alleges the funds are the proceeds of money laundering, extortion, and other crimes tied to ransomware campaigns targeting victims in the Northern District of Texas.
Chaos itself is no small player, but it is believed to be a splinter group formed by veterans of the BlackSuit/Royal syndicate, quite a reminder that ransomware crews adapt and rebrand as quickly as law enforcement dismantles them. Cisco Talos recently reported that Chaos has expanded its attack surface, targeting industries across various sectors with increasingly sophisticated intrusion techniques (Talos Intelligence, 2025).
Instead of liquidating all seized assets at auction, which was the default approach for cases like Silk Road, the government will now hold a portion in reserve, liquidating only when necessary to fund operations or deliver restitution to victims.
From a deterrence perspective, this policy reframes the risk-reward equation for ransomware actors. If their stolen crypto is more likely to be traced, seized, and repurposed than successfully laundered, the appeal of high-value attacks could diminish over time. In volatile markets, holding can mean restitution payouts grow rather than shrink, giving victims a potential upside instead of locking in a low auction price.
The DOJ must still win the forfeiture case, proving that the Bitcoin is directly tied to criminal conduct. This evidentiary threshold, which involves tracing specific coins through blockchain forensics to identify ransomware attacks, is part of what makes these cases both challenging and precedent-setting. If successful, this will become one of the first major contributions to the Strategic Bitcoin Reserve, setting a precedent for how future ransomware seizures are handled.
This policy experiment merges financial strategy, cybersecurity enforcement, and digital asset geopolitics, to turn confiscated Bitcoin into a building block in America’s digital-era reserves. This policy shift also dovetails with a broader US strategy: treating digital assets not just as property to be disposed of, but as instruments of state resilience and financial positioning.