Points of Focus

• All 56 FBI field offices and international law enforcement attachés are engaged; Operation Riptide is ongoing, not a one-time action.
• First VPN Service, active since 2014 across 27 countries and advertised exclusively on Russian-language criminal dark web forums, was the first target seized.
• Americans reported over $11.36 billion in crypto fraud losses in 2025, a 26% increase in a single year.

On June 9, 2026, the US Federal Bureau of Investigation (FBI) announced Operation Riptide, an ongoing coordinated law enforcement initiative targeting criminal actors and the critical services that enable their activities, including infrastructure, tools and services, communications platforms, and financial networks. The operation implements the priorities set out in Executive Order 14390 and President Donald Trump’s Cyber Strategy for America.

The campaign is a sustained nationwide effort targeting not just the hackers carrying out attacks but the criminal support system keeping them in business: the VPNs, the forums, the payment networks, and the servers. All 56 FBI field offices, along with law enforcement attachés worldwide, are now executing this mandate.

Today, the FBI is announcing Operation Riptide, an ongoing, coordinated law enforcement campaign targeting cybercriminal actors and the key services they rely on—their infrastructure, their tools and services, their communications platforms, and their money. Operation Riptide is… pic.twitter.com/ixTp8xMePn

— FBI Cyber Division (@FBICyberDiv) June 9, 2026

The strategic logic is straightforward. Disrupting individual hackers produces marginal results when the underlying infrastructure they rent is left intact. FBI Cyber Division Assistant Director Brett Leatherman stated that the goal is to apply persistent pressure on cyber adversaries and destabilize the criminal ecosystems that enable them, with recent enforcement actions already including arrests, indictments, search warrants, infrastructure takedowns, and cryptocurrency seizures.

First VPN Service was the first target to fall

The first confirmed enforcement action under Operation Riptide was an international seizure and domain takedown of First VPN Service, a virtual private network that had been active since 2014, routing internet traffic through servers in 27 countries.

The service was advertised almost exclusively on known criminal dark web forums, including two of the most prominent Russian-language platforms providing marketplaces for unauthorized system access, stolen credentials, hacking tools, and contraband.

Blockchain intelligence units identified that at least 25 major ransomware collectives, including the Avaddon syndicate, had integrated First VPN’s infrastructure directly into their exploit deployment strategies to mask hosting servers during network intrusions.

Visitors to First VPN Service’s website now see a seizure banner confirming law enforcement has taken control of the domain.

The scale of the problem Operation Riptide is responding to

Last year, Americans filed more than 1 million complaints with the FBI, reporting over $20 billion in losses to cybercrime and online fraud, a 26% increase in losses in a single year.

Crypto-related fraud specifically accounted for $11.36 billion of those losses in 2025, drawn from 181,565 complaints, itself a 21% increase from the prior year. The data points to a highly coordinated criminal ecosystem in which advanced social engineering campaigns, including pig butchering scams, lure retail investors into committing capital to fraudulent smart contracts, with average individual losses running into tens of thousands of dollars per victim.

Blockchain forensics and the end of anonymity as a defense

A critical feature of Operation Riptide is its emphasis on financial forensics. By analyzing blockchain data, FBI agents traced cryptocurrency wallets connected to illegal activity and followed the movement of funds through exchanges and mixing services. Even privacy-focused coins were addressed through a combination of technical expertise and human intelligence.

The approach marks a deliberate shift in law enforcement doctrine. Rather than simply shutting down websites, agencies are increasingly identifying and prosecuting the individuals behind them while seizing their infrastructure.

Operation Riptide demonstrated that digital footprints, no matter how concealed, can be reconstructed through persistent investigative work. Darknet vendors operating under the assumption that encryption and pseudonymity provide immunity from law enforcement are being directly disabused of that assumption.

FBI Criminal Division Assistant Director Heith Janke described June 9 as the beginning of a focused, sustained national effort, with both the Criminal and Cyber Divisions fully committed to the campaign alongside the full international attaché network. Operation Riptide has no announced end date.