On April 8, 2025, the United States Department of Justice effectively dismantled its primary unit dedicated to investigating cryptocurrency-related crimes. Deputy Attorney General Todd Blanche issued a four-page memo disbanding the National Cryptocurrency Enforcement Team (NCET) “effective immediately,” arguing that the previous administration had pursued a “reckless strategy of regulation by prosecution.” The move shifts the burden of digital asset protection squarely onto individual users, exchanges, and the broader crypto community — making personal security practices more critical than ever.
The Threat Landscape
The NCET was established in 2021 under the Biden administration as a joint task force composed of prosecutors from the DOJ’s money laundering and cybercrime units, along with attorneys from district offices across the country. The team played a central role in some of the most significant cryptocurrency enforcement actions in recent years, including the prosecution of Tornado Cash developers, the case against Avraham Eisenberg — who exploited a decentralized trading protocol for over $100 million — and investigations into North Korean state-sponsored actors laundering proceeds from crypto hacks.
The unit’s dissolution does not eliminate cryptocurrency crime. If anything, the timing is notable: April 2025 also saw a MEV bot lose $180,000 to an access control exploit on Ethereum, the PoisonSeed campaign targeting cryptocurrency users through poisoned CRM tools, and malicious npm packages disguised as productivity tools that secretly swapped crypto wallet addresses belonging to Atomic Wallet and Exodus users. These incidents represent exactly the type of threat the NCET was designed to investigate.
Under the new directive, DOJ employees are instructed to focus solely on prosecuting individuals who “victimize digital asset investors” — and to stop pursuing cases against crypto exchanges, mixing services like Tornado Cash, and offline wallets. The memo explicitly references President Trump’s January 2025 executive order on digital assets, which aimed to establish “regulatory clarity” for the industry by scaling back enforcement.
Core Principles
With federal enforcement capacity reduced, the crypto community faces a new reality: security is now primarily a personal responsibility. Several core principles should guide every crypto user’s approach to protecting their assets in this changed environment.
First, self-custody security is non-negotiable. Hardware wallets remain the gold standard for storing significant crypto holdings. Devices from established manufacturers provide offline key storage that is immune to most remote attack vectors. Users should ensure their seed phrases are stored in physically secure locations — never digitally, never in cloud storage, and never shared with anyone.
Second, transaction verification must become habitual. The PoisonSeed campaign demonstrated that even experienced users can fall victim to address poisoning attacks, where malicious actors manipulate CRM tools and email systems to replace legitimate wallet addresses with attacker-controlled ones. Always verify the full recipient address before confirming any transaction, and use address book features where available.
Third, software supply chain awareness is essential. The malicious npm packages discovered in April 2025 — which targeted users of popular wallets by embedding address-swapping code in seemingly legitimate developer tools — illustrate how the software supply chain has become a primary attack surface. Users should only install software from official sources, verify package integrity when possible, and be skeptical of unsolicited installation guides or tutorials.
Tooling & Setup
Building a robust security posture requires the right tools. A hardware wallet should serve as the foundation — Ledger and Trezor remain the most widely recommended options, with models available at various price points. For software interactions, browser extensions like MetaMask should be configured with hardware wallet integration, ensuring that all transaction signing occurs on the dedicated security device rather than on a potentially compromised computer.
Multi-factor authentication is mandatory for all exchange accounts. Authenticator apps (such as Authy or Google Authenticator) provide significantly stronger protection than SMS-based 2FA, which remains vulnerable to SIM-swapping attacks. For users managing large portfolios, dedicated security keys like YubiKey offer the highest level of authentication protection.
Regular security audits of connected applications and authorized spending approvals are equally important. Tools like Revoke.cash allow users to review and revoke token approvals that may have been granted to compromised or unnecessary smart contracts. In an environment where malicious packages can silently modify wallet behavior, periodic review of all active permissions is a critical defensive measure.
Ongoing Vigilance
The DOJ’s policy shift represents a structural change in how cryptocurrency crime will be addressed — or not addressed — at the federal level. While state-level enforcement and international cooperation will continue, the absence of a dedicated federal cryptocurrency enforcement team means that investigations into hacks, exploits, and fraud schemes may proceed with fewer resources and less coordination.
This environment demands heightened community awareness. Sharing information about new attack vectors, reporting suspicious activity to platform operators promptly, and participating in bug bounty programs all contribute to collective security. The crypto industry’s ethos of decentralization has always implied a degree of self-reliance — the DOJ’s decision simply makes that self-reliance more consequential.
Final Takeaway
The disbanding of the NCET does not change the fundamental reality of cryptocurrency security: your keys, your coins. What it does change is the safety net. Users who previously assumed that federal law enforcement would pursue recovery of stolen assets or investigate sophisticated attack campaigns must now recalibrate their expectations. Proactive security — from hardware wallets and multi-factor authentication to supply chain awareness and regular permission audits — has shifted from best practice to necessity.
Disclaimer: This article is for informational purposes only and does not constitute legal or financial advice. Always consult with qualified professionals for guidance specific to your situation.
Blanche calling the previous strategy regulation by prosecution while disbanding the team that went after a $100M exploit is a choice. Eisenberg literally manipulated Mango Markets in broad daylight
Fatima Z. the NCET prosecuted Tornado Cash devs for writing privacy code. calling that reckless is actually one thing I agree with Blanche on, but disbanding the whole team throws the baby out with the bathwater
dismantling the one team that actually prosecuted Tornado Cash devs and went after Eisenberg. brilliant timing with North Korea still actively targeting exchanges
disbanding NCET in the middle of record hack losses is a choice. the timing couldnt be worse
Marcus W. is right – self-custody emphasis is now DOJ policy. This memo essentially tells retail to stop using mixers if they want protection.
blanche called it regulation by prosecution which has some merit, but you need enforcement replacement before dismantling
dismantling without replacement is the move. signal that enforcement is over without saying it out loud. politically convenient
anon_lawyer calling it regulation by prosecution has some truth but disbanding NCET with zero replacement is just vibes based policy. the 4 page memo proves it
blanche memo was 4 pages. you cant unwind years of institutional knowledge in 4 pages. this is vibes based governance
statutory_gap – ending NCET prosecutions on Tornado Cash shifts the entire enforcement philosophy toward protecting retail victims only.
blanche memo was 4 pages because it wasnt supposed to hold up legally. its a press release dressed as policy
statutory_gap 4 pages to reverse years of prosecution expertise. basically a sticky note that says figure it out yourselves lol
without NCET the Eisenberg case might never have happened. $110M exploit and the only reason he got caught was dedicated crypto prosecutors. dumb move to disband
tornado cash prosecution was overreach, eisenberg case was legitimate. you cant treat all crypto enforcement as one thing
tornado cash prosecution and eisenberg are completely different situations. treating all crypto enforcement as one bucket is lazy policy
eisenberg exploiting mango markets for 100M was actual fraud, not ‘regulation by prosecution’. folding the team that handled that stuff is sending a message whether they meant to or not
Karl B. eisenberg got convicted so dropping that case file makes zero sense. the NCET had actual wins and theyre scattering the team over politics
exactly. the NCET did useful work on north korean laundering ops too. throwing that out seems short-sighted
NCET going after north korean laundering was actually useful work. that specific function should survive regardless of politics
libertarian_max the eisenberg case was actual fraud though. prosecuting someone for exploiting mango markets for 100M is not overreach. folding that team loses real expertise
the Blanche memo reads like it was drafted overnight. no transition plan, no replacement unit, just vibes based deregulation
Disbanding NCET while stopping Tornado Cash cases shifts focus to investor victimization only. The $180K MEV bot exploit same month shows the timing is interesting.
disbanding NCET right when bridge hacks hit $2B+ in a year is insane timing. the DOJ basically told every Lazarus subgroup to go wild
statute_drift_ the timing is bad but NCET was more press releases than convictions. actual enforcement happened through OFAC sanctions not DOJ prosecutors