DOJ Disbands National Cryptocurrency Enforcement Team: What Crypto Users Must Know About Self-Reliant Security

On April 8, 2025, the United States Department of Justice effectively dismantled its primary unit dedicated to investigating cryptocurrency-related crimes. Deputy Attorney General Todd Blanche issued a four-page memo disbanding the National Cryptocurrency Enforcement Team (NCET) “effective immediately,” arguing that the previous administration had pursued a “reckless strategy of regulation by prosecution.” The move shifts the burden of digital asset protection squarely onto individual users, exchanges, and the broader crypto community — making personal security practices more critical than ever.

The Threat Landscape

The NCET was established in 2021 under the Biden administration as a joint task force composed of prosecutors from the DOJ’s money laundering and cybercrime units, along with attorneys from district offices across the country. The team played a central role in some of the most significant cryptocurrency enforcement actions in recent years, including the prosecution of Tornado Cash developers, the case against Avraham Eisenberg — who exploited a decentralized trading protocol for over $100 million — and investigations into North Korean state-sponsored actors laundering proceeds from crypto hacks.

The unit’s dissolution does not eliminate cryptocurrency crime. If anything, the timing is notable: April 2025 also saw a MEV bot lose $180,000 to an access control exploit on Ethereum, the PoisonSeed campaign targeting cryptocurrency users through poisoned CRM tools, and malicious npm packages disguised as productivity tools that secretly swapped crypto wallet addresses belonging to Atomic Wallet and Exodus users. These incidents represent exactly the type of threat the NCET was designed to investigate.

Under the new directive, DOJ employees are instructed to focus solely on prosecuting individuals who “victimize digital asset investors” — and to stop pursuing cases against crypto exchanges, mixing services like Tornado Cash, and offline wallets. The memo explicitly references President Trump’s January 2025 executive order on digital assets, which aimed to establish “regulatory clarity” for the industry by scaling back enforcement.

Core Principles

With federal enforcement capacity reduced, the crypto community faces a new reality: security is now primarily a personal responsibility. Several core principles should guide every crypto user’s approach to protecting their assets in this changed environment.

First, self-custody security is non-negotiable. Hardware wallets remain the gold standard for storing significant crypto holdings. Devices from established manufacturers provide offline key storage that is immune to most remote attack vectors. Users should ensure their seed phrases are stored in physically secure locations — never digitally, never in cloud storage, and never shared with anyone.

Second, transaction verification must become habitual. The PoisonSeed campaign demonstrated that even experienced users can fall victim to address poisoning attacks, where malicious actors manipulate CRM tools and email systems to replace legitimate wallet addresses with attacker-controlled ones. Always verify the full recipient address before confirming any transaction, and use address book features where available.

Third, software supply chain awareness is essential. The malicious npm packages discovered in April 2025 — which targeted users of popular wallets by embedding address-swapping code in seemingly legitimate developer tools — illustrate how the software supply chain has become a primary attack surface. Users should only install software from official sources, verify package integrity when possible, and be skeptical of unsolicited installation guides or tutorials.

Tooling & Setup

Building a robust security posture requires the right tools. A hardware wallet should serve as the foundation — Ledger and Trezor remain the most widely recommended options, with models available at various price points. For software interactions, browser extensions like MetaMask should be configured with hardware wallet integration, ensuring that all transaction signing occurs on the dedicated security device rather than on a potentially compromised computer.

Multi-factor authentication is mandatory for all exchange accounts. Authenticator apps (such as Authy or Google Authenticator) provide significantly stronger protection than SMS-based 2FA, which remains vulnerable to SIM-swapping attacks. For users managing large portfolios, dedicated security keys like YubiKey offer the highest level of authentication protection.

Regular security audits of connected applications and authorized spending approvals are equally important. Tools like Revoke.cash allow users to review and revoke token approvals that may have been granted to compromised or unnecessary smart contracts. In an environment where malicious packages can silently modify wallet behavior, periodic review of all active permissions is a critical defensive measure.

Ongoing Vigilance

The DOJ’s policy shift represents a structural change in how cryptocurrency crime will be addressed — or not addressed — at the federal level. While state-level enforcement and international cooperation will continue, the absence of a dedicated federal cryptocurrency enforcement team means that investigations into hacks, exploits, and fraud schemes may proceed with fewer resources and less coordination.

This environment demands heightened community awareness. Sharing information about new attack vectors, reporting suspicious activity to platform operators promptly, and participating in bug bounty programs all contribute to collective security. The crypto industry’s ethos of decentralization has always implied a degree of self-reliance — the DOJ’s decision simply makes that self-reliance more consequential.

Final Takeaway

The disbanding of the NCET does not change the fundamental reality of cryptocurrency security: your keys, your coins. What it does change is the safety net. Users who previously assumed that federal law enforcement would pursue recovery of stolen assets or investigate sophisticated attack campaigns must now recalibrate their expectations. Proactive security — from hardware wallets and multi-factor authentication to supply chain awareness and regular permission audits — has shifted from best practice to necessity.

Disclaimer: This article is for informational purposes only and does not constitute legal or financial advice. Always consult with qualified professionals for guidance specific to your situation.