The U.S. Department of Justice and FBI announced on June 10, 2026, the seizure of 13 internet domains run by suspected Chinese intelligence operatives disguised as legitimate consulting firms. The targets were current and former U.S. government and military personnel holding active security clearances, with cryptocurrency used to hide payments.
Fake Consulting Firms as Cover
The operation ran for nearly three years, starting in November 2023. The 13 seized domains bore names like Centrik Global Consulting, Catalyst Global Solutions, GeoIndopacific, SafeSec Group, and Gulf Peace Foundation — all designed to sound credible. Operators posted vague 'research' and 'consulting' jobs on real recruiting platforms, targeting individuals with foreign policy, defense, or national security backgrounds.
Once someone applied, targeting escalated. Three tactics made detection difficult: AI-generated personas — fake headshots and entirely fictitious recruiter identities; encrypted messaging — heavy use of Telegram to avoid traceable email trails; and timing — the operation accelerated during mass federal layoffs, leaving tens of thousands of cleared workers job-hunting.
FBI Special Agent Dan Wierzbicki, head of counterintelligence and cyber at the Washington field office, said tips broke the case. People contacted reported feeling something off — specifically being paid via cryptocurrency or unusual online payment systems instead of a normal employer.
Why Crypto Was Central
This case is not about cryptocurrency as a target but as the tool enabling the scheme. According to the DOJ affidavit, conspirators paid recruits through online accounts registered to fictitious people, using cryptocurrency to conceal identities and the true source of funds. Money moved from outside the U.S. to inside the country without any bank verifying the sender.
This pattern is not isolated. Last month, Taiwanese prosecutors charged a TV journalist accused of receiving USDT payments from an alleged Chinese operative — suggesting stablecoin payments for covert recruitment are becoming documented tradecraft.
After seizures, the FBI replaced all 13 domains with takeover notices. Assistant Director Roman Rozhavsky of the Counterintelligence and Espionage Division said the domains show how far Chinese intelligence services will go — using AI-generated content to trick, recruit, or coerce clearance holders into handing over sensitive information.
Three Red Flags and Regulatory Implications
The DOJ affidavit provides a primary legal source, giving regulators a verified example to cite for stricter KYC requirements on crypto payment platforms. State-level actors are now documented users, challenging the narrative that crypto's illicit use is limited to small-scale criminals.
Assistant Attorney General John Eisenberg warned that these seizures show foreign actors using promises of easy money to lure Americans into revealing classified information. U.S. Attorney Jeanine Ferris Pirro added that the Chinese government has long exploited U.S. government employees through fake companies and job postings.
FBI identified three red flags triggering immediate reporting: unusually high pay for vague research or consulting work; payment in cryptocurrency or through an unverifiable online account; and a recruiter quickly asking for internal reports or non-public documents. Anyone approached with such offers should report to tips.fbi.gov.