The US Department of Justice and FBI announced on June 10, 2026, the seizure of 13 internet domains allegedly operated by suspected Chinese agents as part of a sophisticated scheme to obtain sensitive and classified US government information.
According to court documents and the official DOJ affidavit, the operation, which began in November 2023, involved a network of fake consulting companies that systematically targeted current and former US government and military personnel, particularly those holding active security clearances.
These websites posed as legitimate global consulting firms, offering well-paid “research” and “consulting” opportunities on topics of clear strategic interest to the Chinese government, such as US policy, advanced technology, and national security matters.
The 13 domains seized include:
- centrikglobalconsulting.com (Centrik Global Consulting)
- rightinfoconsult.com (Rightinfo Consulting)
- finnaclevesperconsulting.com (Finnacle-Vesper Consulting)
- cydfconsulting.com (CYDF Consulting)
- pulsewaveglobal.com (Pulse Wave Global)
- catalystglobalsolutions.com (Catalyst Global Solutions)
- thehorizzen.com (Horizzen)
- geoindopacific.com (GeoIndopacific)
- gpf-ina.org (Global Peace Foundation Indonesia)
- safesec-group.com (SafeSec Group)
- thetruthinfo.com (The TruthInfo)
- Vandercons.com
- gulfpeace.org (Gulf Peace Foundation)
How the Scheme Allegedly Worked
According to the DOJ’s affidavit, the operators created professional-looking websites and posted generic “Senior Analyst” and “International Affairs Consultant” positions on platforms such as Upwork, Expertia AI, Hubstaff Talent, and others.
Targets were lured with promises of easy money for writing reports on topics of clear interest to Beijing, often involving US policy, technology, or national security matters. Once engaged, recruits faced increasing pressure to deliver exclusive or classified insights, backed by contracts and NDAs.
Payments were routed through US accounts but originated overseas. The affidavit explicitly notes the use of cryptocurrency transfers alongside traditional methods to hide the true source and identities of the paymasters. AI-generated headshots and fictitious personas further masked the operation.
This isn’t just old-school espionage. It’s modern digital tradecraft that mixes social engineering, AI deepfakes, and blockchain rails for plausible deniability. Encrypted apps like Telegram were heavily used for communication.
US Government Response and Statements
Federal authorities moved swiftly. On June 10, 2026, the FBI replaced the seized domains with official warning pages.
Assistant Attorney General for National Security John A. Eisenberg warned:
These domain seizures offer a glimpse at how foreign actors can use promises of easy money to lure Americans into revealing sensitive or classified information that they are duty-bound to protect. Anyone approached online with offers of easy income for vague ‘consulting’ work should treat those overtures with extreme caution.
U.S. Attorney Jeanine Ferris Pirro stated:
“These sham consulting sites were crafted to deceive, but thanks to the persistent work of our prosecutors and law enforcement partners, this scheme has been stopped in its tracks.”
FBI officials described the sites as part of a deliberate campaign by China’s intelligence services. Assistant Director Roman Rozhavsky highlighted the use of AI-generated content to trick or coerce security clearance holders.
Broader US Actions Against China-Linked Crypto Activities
The case also comes amid growing global scrutiny of how digital assets are being used in sanctions evasion, illicit finance, and cross-border influence operations. Recent enforcement actions targeting platforms accused of facilitating restricted transactions show that regulators are increasingly viewing crypto infrastructure as part of broader national security concerns. For example, the U.S. Treasury recently sanctioned Iran-linked exchange Nobitex over alleged sanctions-evasion activities.
- Sanctions on Crypto-Enabled Networks: The US Treasury’s OFAC has repeatedly sanctioned Chinese entities using crypto for sanctions evasion, money laundering, especially activity linked to Mexican cartels and fentanyl precursor trade.
- Cyber and Espionage Sanctions: Actions against Chinese hackers and botnet operators, such as the 911 S5 network, that relied heavily on cryptocurrency payments.
- Money Laundering Crackdowns: FinCEN has issued advisories on Chinese Money Laundering Networks (CMLNs) that facilitate illicit fund flows, including through crypto.
- Regulatory Pressure: Stricter enforcement on exchanges, citing risks posed by nation-state actors.
Law enforcement agencies are also expanding international cooperation to combat crypto-enabled criminal networks. In one recent operation involving authorities from the United States, UAE, and China, hundreds of suspects linked to large-scale online scam operations were arrested, highlighting the increasingly global nature of crypto-related investigations.
These actions reflect Washington’s view that cryptocurrency is increasingly used not only for financial crime but also as a tool for geopolitical influence and intelligence gathering.
China’s Likely Reaction and Why This Matters for Crypto
Beijing is expected to dismiss the allegations as baseless and politically motivated, describing them as another instance of US “Sinophobia,” a line used in past similar cases.
While the primary targets were government insiders, the use of crypto payments is significant for the crypto community. It shows how nation-state actors view digital assets as an operational security enhancer, enabling faster and harder-to-trace cross-border transfers.
The incident also reinforces concerns around compliance monitoring and transaction transparency. Major exchanges have faced growing pressure to strengthen oversight of cross-border crypto flows, particularly in jurisdictions facing sanctions or heightened regulatory scrutiny, as regulators seek to prevent misuse of digital asset networks.
For the broader crypto industry, this serves as a reminder that the pseudonymity and borderless nature that power innovation can also be weaponized. It will likely fuel further regulatory scrutiny on crypto’s role in money laundering, sanctions evasion, and espionage financing.
Conclusion
The FBI’s action disrupts one vector of alleged Chinese intelligence gathering, but the playbook of fake fronts, AI-generated personas, and crypto payment rails is already evolving.
Security clearance holders, and anyone handling sensitive information, should treat unsolicited high-paying consulting offers with deep skepticism. As governments continue to confront the growing intersection of cyber espionage and digital assets, cases like this highlight how emerging technologies can be leveraged for both innovation and covert influence operations.
