Earlier this week, we spoke with a physician who operates a busy medical practice in New York.

Thousands of patient records. Employees handling sensitive information every day.

He had never heard of the New York SHIELD Act.

He is not alone.

Many New York businesses do not realize that the SHIELD Act applies to them and imposes legal obligations to protect personal information.

There is another problem. The statute was enacted in 2019 for a cybersecurity environment that no longer exists.

Today, according to the NSA and other Five Eyes cybersecurity agencies (June 22, 2026 statement):

“Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months.”

Yet the SHIELD Act still requires businesses to implement and maintain “reasonable safeguards” to protect sensitive information.

What qualifies as “reasonable” in an era of AI-driven cyberattacks is becoming one of the most important questions facing New York businesses.

Whether the law has kept pace with technology or not, the legal obligation remains.

What the SHIELD Act actually requires

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act was signed into law on July 25, 2019 (NY Senate, S5575B).

The data security provisions became effective on March 21, 2020 (S5575B, § 6)

New York already had a law requiring businesses to respond after a data breach occurred.

The SHIELD Act went further. It imposed a legal duty to protect personal information before a breach happens:

“Any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.” See N.Y. Gen. Bus. Law § 899-bb(2)(a). [Emphasis added].

It applies broadly to businesses of all sizes, including:

1. medical practices/healthcare providers
2. financial institutions;
3. law firms;
4. investment advisers;
5. startups;
6. family offices; and
7. co-op/condo boards

The law is triggered by the residency of the individual whose data is collected; not by the location of the business.

As a result, even out-of-state companies could be covered if they hold personal information about New York residents.

The standard is simply “reasonable safeguards.” The problem is that the statute never defines what “reasonable” means.

It certainly does not explain what reasonable security looks like in an age of AI-driven cyberattacks ( which the NSA warned in 2026 are evolving on a timeline measured in months, not years).

The statute gives categories, not a level

Instead of providing a definition, the statute describes a compliance framework that businesses can follow.

The cybersecurity provisions require a business to “designate one or more employees to coordinate the security program.” § 899-bb(2(b)(ii)(A)(i).

The law also requires businesses to:

• Identify “reasonably foreseeable internal and external risks.”
• Assess “the sufficiency of safeguards in place to control the identified risks.”
• Train and manage “employees in the security program practices and procedures.”
• “Adjust[] the security program in light of business changes or new circumstances.”

Notably, the statute outlines these requirements but never defines what qualifies as a “reasonable” safeguard in practice.

That question has become increasingly important as AI-driven cyber threats continue to evolve.

The technical safeguards focus on a business’s systems and controls. The statute requires businesses to:

• Assess “risks in network and software design.”
• Assess “risks in information processing, transmission and storage.”
• Detect, prevent, and respond to “attacks or system failures.”
• Regularly test and monitor “the effectiveness of key controls, systems and procedures.”

The physical safeguards address the protection and handling of data. Businesses must:

• Assess “risks of information storage and disposal.”
• Detect, prevent, and respond to “intrusions.”
• Protect against “unauthorized access to or use of private information during or after the collection, transportation and destruction or disposal of the information.”

See N.Y. Gen. Bus. Law § 899-bb(2)(b)(ii)(B)-(C).

A 2019 standard meets a 2026 threat

On June 22, 2026, the National Security Agency and allied cyber security agencies published a joint statement:

“Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months” (NSA, Five Eyes Cyber Security Agencies Statement, June 22, 2026). {emphasis added].

Agencies drove the point home with another observation:

“Cyber risk assumptions can become outdated in months, not years” (Id.).

That creates an obvious problem. The New York SHIELD Act was enacted in 2019.

It was written for a cybersecurity environment that no longer exists.

Today’s threat landscape is being reshaped by AI at a pace measured in months, not years.

Yet the law remains in force. The fact that technology has evolved does not relieve businesses of their obligations.

If anything, it raises the bar. What is “reasonable” security is measured against what a business knew, or should have known, about foreseeable risks.

Following a public warning from the NSA, it is becoming increasingly difficult to argue that AI-enabled cyberattacks are unforeseeable.

The SHIELD Act already requires businesses to adjust their security programs for “business changes or new circumstances.”

A risk assessment prepared before June 22, 2026 and never revisited may therefore present its own compliance problem.

In short, the threat environment has changed dramatically. The legal obligation to maintain reasonable safeguards has not.

What information triggers the duty

“Private information” is far broader than most New York businesses assume.

It includes traditional identifiers such as Social Security numbers, driver’s license numbers, and payment card data.

But the statute also covers biometric information, health insurance information, and “medical information” concerning an individual’s “medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.”

Even login credentials can qualify.

A “user name or e-mail address in combination with a password” that provides access to an online account is protected under the statute as well. (§ 899-aa(1)(b)).

“Private information” is broader than most owners assume.

Two important qualifications apply.

First, the SHIELD Act recognizes that not every business has the same resources.

A “small business” is generally one with less than 50 employees (less than $3 million in annual revenue) or or less than $5 million in total assets.

Such businesses are only required to maintain safeguards that are “appropriate for the size and complexity” of the business. (§ 899-bb(1)(c), (2)(c)).

Second, some businesses could qualify for a statutory safe harbor.

An entity that is already subject to and compliant with regulatory frameworks such as HIPAA, the Gramm-Leach-Bliley Act, or 23 NYCRR Part 500 is deemed compliant with the SHIELD Act’s data security requirements. (§ 899-bb(1)(a), (2)(b)(i)).

The key point is that the safe harbor depends on actual compliance. It is not enough to operate in a regulated industry.

A business must be able to demonstrate that it is complying with the applicable regulatory framework.

No private right of action — and why that is not comfort

The SHIELD Act has teeth. A business that fails to maintain “reasonable safeguards” may face enforcement by the New York Attorney General and civil penalties of up to $5,000 per violation.

The statute also states that “Nothing in this section shall create a private right of action.”

That does not mean a business can’t be sued after a breach.

Plaintiffs often bring negligence claims instead, and the SHIELD Act could become a benchmark for what constitutes reasonable cybersecurity.

In practice, your compliance records can become either your strongest defense or the plaintiff’s strongest exhibit.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

After a cryptocurrency theft, victims are often told the same thing:

A tracing report is needed.

A few weeks later they were sent a PDF document which looked professional and showed where the stolen cryptocurrency had ended up.

The victim now knows exactly where the money has gone, but the money is still missing.

A mistake that we frequently come across is the idea that crypto tracing and cryptocurrency recovery are identical. Yet they aren’t.

The tracing process shows how stolen assets move around the blockchain, and for them to be recovered, legal authority is needed so that the assets can be seized and then given back to the victims.

When we have been dealing with people who have been victims of crypto theft, many of them spend a good deal of time and money getting trace reports even though they never first consider some of the important questions mentioned below.

Who actually has the power to get the money back?

The response is a surprise to a great many victims.

A private forensic company is able to trace blockchain transactions but it cannot send out subpoenas since it doesn’t have the authority to do so.

It is impossible to obtain seizure warrants, it cannot require a cryptoexchange to do anything, and it also can’t start federal forfeiture proceedings.

The authority is given to law enforcement agencies and prosecutors through 18 USC § 981 (civil forfeiture).

This distinction is critical.

It might be possible to discover where the stolen assets ended up. Yet merely tracing them does not result in a legal duty on an exchange or stablecoin issuer to freeze the funds (or return them to the victim).

That is to say, a tracing report usually marks the start of a recovery strategy but is not the strategy itself.

The 2025 Internet Crime Report by the FBI states that the Internet Crime Complaint Center (IC3) received 181,565 complaints concerning cryptocurrency, the amount of losses being over $11.3 billion. (FBI IC3, 2025 Internet Crime Report, p. 52)

Since crypto-related crime is still increasing, it is important for victims to know what is possible through tracing and why legal authority under 18 U.S.C. § 981 is usually more important than blockchain analytics alone.

What a tracing report can and can’t do

An analyst is able to track stolen coins through swaps and mixers until they get to a custodial exchange using public ledgers. Yet that marks only the start of the recovery, not its end.

The FBI was blunt when it stated that: “Private sector recovery companies cannot issue seizure orders to recover cryptocurrency.” (FBI PSA, Aug. 11, 2023).

Furthermore, FBI said that “Cryptocurrency exchanges only freeze accounts based on internal processes or in response to legal process.” Id.

The same alert describes the failure mode: “Recovery scheme fraudsters charge an up-front fee and either cease communication with the victim after receiving an initial deposit or produce an incomplete or inaccurate tracing report and request additional fees to recover funds” (FBI PSA, Aug. 11, 2023).

A genuine forensic vendor is not a scammer, but it must be understood that a tracing report is not a recovery tool.

If there is no seizure warrant or court order, the report will not result in any exchange or financial institution having a legal obligation to take any action.

Who can actually seize stolen crypto

The Federal Civil Forfeiture statute set out in 18 USC § 981 states that “Any property, real or personal, which is derived from or consists of proceeds traceable to” wire fraud (for example, Sections 1029, 1030, 1032, or 1344) and other “specified unlawful activity” (18 U.S.C. § 981(a)(1)(C)).

“Any property subject to forfeiture to the United States under subsection (a) may be seized by the Attorney General…”(18 U.S.C. § 981(b)(1)).

Moreover, “Seizures pursuant to this section shall be made pursuant to a warrant obtained in the same manner as provided for a search warrant under the Federal Rules of Criminal Procedure…” (18 U.S.C. § 981(b)(2)). [emphasis added].

The statute also covers “The property was lawfully seized by a State or local law enforcement agency and transferred to a Federal agency.” (18 U.S.C. § 981(b)(2)(C)).

That is the only approach available to a district attorney’s cybercrime unit, not one that is operated by a private tracing firm lacking the power to issue subpoenas or seizure warrants.

It should be noted that the term ‘private party’ is not mentioned anywhere in the text of 18 USC § 981 (‘Civil Forfeiture’).

What a real recovery looks like

Recent cases handled by the Secret Service illustrate how crypto seizure cases function.

In one instance, the agents confiscated the funds that had been obtained through investment fraud from an account at a foreign bank.

The U.S. Attorney filed a civil forfeiture complaint, and a settlement provided that “$7 million of the seized funds would be forfeited to the United States, allowing victims to petition to recover on their losses” (U.S. Attorney’s Office, E.D. Va., Mar. 21, 2025).

In December 2025 the same office recovered stablecoins that Secret Service agents had seized “from three cryptocurrency wallets” (U.S. Attorney’s Office, E.D. Va., Dec. 5, 2025).

On July 21, 2026, the U.S. Attorney for the District of Columbia filed five civil forfeiture complaints covering more than $25 million in cryptocurrency seized by Secret Service agents (U.S. Attorney’s Office, D.C., July 21, 2026).

Each case started with tracing, but these cases stand for the principal that to successully recover the funds you need a federal agencies with § 981 power.

How victims are paid

The money that has been forfeited is returned to the victims by means of remission or restoration.

In order to be considered a victim, one must demonstrate “a financial loss amounting to a specific figure…and that the loss is supported by documentary evidence such as invoices and receipts.” (28 C.F.R. § 9.8(b)(1)).

Moreover, the monetary loss endured by a victim… is to be restricted to the fair market value of the property from which the victim was deprived as of the date on which the loss occurred. No account shall be made for the interest lost or for any incidental expenses incurred in recovering the lost property or in seeking other compensation.” (28 C.F.R. § 9.8(c)). [emphasis added].

Where a private law firm fits

The FBI notes that “Victims can also choose to pursue civil litigation to seek recovery of their funds” (FBI PSA, Aug. 11, 2023).

That path works usually works when a counterparty is located inside U.S. jurisdiction: an exchange, stablecoin issuer, bank, or domestic account holder.

Depending on the facts, counsel could file a temporary restraining order (TRO) over identified assets, file a complaint, and pursue injunctive relief.

When the funds are located at an offshore exchange with no U.S. presence, only an agency with seizure authority under § 981 can act.

What to do this week

1. The most important information you can give is details of the transaction. This includes the cryptocurrency address, the amount and type of cryptocurrency, the date and time, and the transaction ID (hash) (FBI, Guidance for Cryptocurrency Scam Victims, Aug. 24, 2023).
2. Make sure to write to each exchange and ask them to keep the records and to hold the funds until a legal procedure has been carried out. “Cryptocurrency exchanges only freeze accounts based on their internal procedures or as a result of a legal process” (FBI PSA, Aug. 11, 2023). Requesting that the funds be frozen could give you additional time.
3. Check the forensic engagement to verify that the forensic vendor will provide exhibits suitable for use in an affidavit, will file freeze requests, and will assist with an agency referral. Make sure that all of these points are included in your engagement letter to the forensic firm.
4. Look at the corresponding counterparts in the United States. Any domestic exchange, issuer, or bank which holds your money could be a suitable target for a TRO or a civil suit.
5. It is important to keep all your receipts since remission requires documentary proof of “a pecuniary loss of a specific amount…and that the loss is supported by documentary evidence including invoices and receipts.” (28 C.F.R. § 9.8(b)(1)).
6. Be careful about anyone offering to recover your money since they might be engaging in another scam (FBI, August 24, 2023).

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

A fraudulent wire transfer is not complete as soon as the money leaves your account.

For a few hours, the funds remain in the recipient’s account, and the bank can still freeze them.

FBI and the Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) have two programs designed for this short window: (i) Financial Fraud Kill Chain; and (ii) the Rapid Response Program.

Both require the victim to act quickly.

The 72-hour window, in the government’s words

According to FinCen’s Program Fact Sheet dated April 15, 2026 – “FinCEN is most likely to be able to interdict or recover funds when fraudulently induced wire transfers are reported to law enforcement within 72 hours of the transaction” (FinCEN, Rapid Response Program Fact Sheet, Apr. 15, 2026, p. 2).

The time frame set out in FinCEN’s email-compromise advisory is even more strict: “FinCEN has been more successful in recovering funds when victims or financial institutions report BEC-unauthorized and fraudulently induced wire transfers to law enforcement within 24 hours.” (FinCEN, FIN-2019-A005, July 16, 2019, p. 8).

The reason is often structural: [Wire] transactions are irrevocable, making financial institutions and customers unable to cancel payments or recall funds.” (FIN-2019-A005, p. 8).

FBI’s Internet Crime Complaint Center (IC3) agrees: “If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents” (FBI IC3, 2025 Internet Crime Report, Apr. 2026, p. 17).

What the Financial Fraud Kill Chain does

“Established in 2018, the IC3 RAT streamlines communications with financial institutions and FBI field offices to assist in the freezing of funds for victims of fraudulent domestic and international transactions” (IC3 Report, p. 17).

For domestic Kill Chain Process – “IC3 RAT will expand the FFKC process beyond the initial recipient bank if information is provided during the FFKC initiation on “second hop” transactions to other domestic or international accounts to request freezes on as much of the lost funds as possible.” (IC3 Report, p. 17).

In 2025 the kill chain was initiated on 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58 percent success rate; 3,574 of those incidents were domestic and 326 international (IC3 Report, p. 17).

What FinCEN’s Rapid Response Program does

When the funds left the country, FinCEN takes over.

According to FinCen’s Fact Sheet dated April 15, 2026 – “Since its inception in 2015, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network’s (FinCEN) Rapid Response Program (RRP) has facilitated the interdiction of $1.8 billion and the recovery of over $1 billion in stolen proceeds on behalf of 5,790 U.S. victims.” (RRP Fact Sheet, p. 1).

Two rules matter for victims.

First, “Please do not contact FinCEN directly”; the program activates only when law enforcement refers a complaint filed at IC3 or with the Secret Service (RRP Fact Sheet, p. 1).

Second, the complaint must contain details information about the victim. That information includes victim’s and beneficiary’s account names and numbers, both banks and their countries, the date, currency, amount, and a summary of the fraud (RRP Fact Sheet, p. 2). Incomplete information could delay investigation process.

How the wire gets out: five attack vectors

Business email compromise once dominated kill chain cases.

“However, in 2025, the [Kill Chain] process saw a rise in Tech Support and Account Takeover (ATO) initiations.”

Furthermore, “AT)-related incidents can contain upwards of 50 or more transactions to different recipient accounts at multiple banks happening simultaneously via ACH transactions” (IC3 Report, p. 17). [emphasis added].

The way fraud occurred matters because it could affect who is responsible for the loss.

1. Bank’s “fraud department.” “The scammer falsely informs the victim their computer and financial accounts have been accessed by a foreign hacker and the victim must move their money to a “safe” third-party account, such as an account with the Federal Reserve or another US Government agency.” (FBI PSA, “Phantom Hacker” Scams, Sept. 29, 2023). In this situation, the victim would be initiating/authorizing the wire transfer.
2. Phishing links. “Cyber criminals use advertisements that imitate legitimate companies to misdirect targets…. fraudulent URL appears at the top of search results…When targets click on the fraudulent advertisement link, they are redirected to a phishing website that closely mirrors the legitimate website…target enters login credentials, the cyber criminal intercepts the credentials.” (FBI PSA, Apr. 24, 2025).
3. Account takeover. “Once the impersonators have access and control of the accounts, the cyber criminals quickly wire funds to other criminal-controlled accounts, many of which are linked to cryptocurrency wallets; therefore, funds are disbursed quickly and are difficult to trace and recover. In some cases, including nearly all social engineering cases, the cyber criminals change the online account password, locking the owner out of their own financial account(s).” (FBI PSA, Nov. 25, 2025).
4. Malware/ Remote-access software. The FBI lists credentials obtained “via malware on the victim’s device” among ATO methods (FBI IC3, Account Takeover Fraud). In the tech-support variant, the scammer installs remote-desktop software and “can lock the victim out of their computer or place a black screen as they conduct unauthorized wire transfers” (FBI PSA, Nov. 10, 2022).
5. Business email compromise. Criminals “insert themselves into communications by impersonating a critical player in a business relationship or transaction” and alter the payment instructions (FIN-2019-A005, p. 6). BEC losses reported to IC3 in 2025: $3,046,598,558 (IC3 Report, p. 9).

The first 72 hours: what to do

1. Call the bank (Use number on your card or statement). Contact the originating institution “as soon as fraud is recognized to request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity” (FBI IC3, Domestic Financial Fraud Kill Chain Process). Get the wire reference number.
2. File at ic3.gov the same day. “It is vital the complaint contain all required data in provided fields, including banking information” (FBI PSA, Nov. 25, 2025). File “Regardless of the amount lost” (IC3 Report, p. 17).
3. Lock the intruder out. “Reset all credentials and passwords that may have been exposed,” from a device you trust (FBI PSA, Nov. 25, 2025).
4. Preserve everything. Save emails, texts, phone numbers, wire confirmations, and screenshots; the FBI asks for the caller’s name, contact methods, and the receiving account numbers (FBI PSA, Sept. 29, 2023).
5. Send nothing more. Scammers “may instruct the victim to send multiple transactions over a span of days or months” (FBI PSA, Sept. 29, 2023).
6. Get the bank’s timeline in writing. When was the recall sent, and what did the beneficiary bank answer? That record decides what can still be frozen and, later, who bears the loss.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Consider a hypothetical. An investor opens a wallet one morning and finds that a six-figure balance of USD Coin (USDC) is gone.

All of his USDC was moved in five transactions to addresses the investor has never seen, without a single click or signature.

The first instinct is to ask Circle (issuer of USDC) to freeze the funds and reverse the transfer. The problem is that an issuer generally can’t do it.

This article explains why and what the GENIUS Act now requires of stablecoin issuers.

It also examines legal mechanisms available to freeze stolen USDC and pursue its recovery.

These could include providing notice to the issuer, getting assistance from (i) federal authorities through an asset forfeiture referral; (ii) obtaining a temporary restraining order (“TRO”) in New York Supreme Court; and (iii) navigating reissuance process in coordination with Circle and authorities.

Why Circle can’t simply reverse a stolen USDC transfer

The short answer is custody.

Once USDC reaches an external wallet, the tokens are controlled by whoever holds that wallet’s private key (not by the issuer).

The issuer does not have keys to a third party’s address. USDC is a token on a public blockchain; the issuer maintains the smart contract, but it does not hold the balances recorded in it.

What an issuer can do is block.

In an April 10, 2026 proposed rule, the Financial Crimes Enforcement Network (“FinCEN”) and the Office of Foreign Assets Control (“OFAC”) explained: “For example, a stablecoin issuer may be able to prohibit specific wallet addresses from interacting with the stablecoin and its smart contract. ”

Furthermore, Fincen and OFAC stated that “Applying such controls to a particular wallet address would effectively prevent the holder of a stablecoin from transferring, redeeming, or otherwise moving the stablecoin.” ([2]).

Finally, FinCEN notes that “In some cases, including when required by a lawful order, stablecoin issuers reissue stablecoins equivalent to burned or frozen funds to different wallets as part of efforts to recover and return funds to victims of criminal activity.” ([2]).

Whether a stablecoin issuer can do that for a given contract is a technical question a court may need to resolve on evidence.

What GENIUS Act requires of stablecoin issuers

The Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), Public Law 119-27, was signed on July 18, 2025 ([1]).

Section 4(a)(“Compliance with Lawful Orders”) says that “A permitted payment stablecoin issuer may issue payment stablecoins only if the issuer has the technological capability to comply, and will comply, with the terms of any lawful order.” ([1]).

Under §5901 (16). Definitions …”Lawful Order” is defined as “any final and valid writ, process, order, rule, decree, command, or other requirement issued or promulgated under Federal law, issued by a court of competent jurisdiction or by an authorized Federal agency pursuant to its statutory authority, that—(A) requires a person to seize, freeze, burn, or prevent the transfer of payment stablecoins issued by the person…” ([1]).

The definition is federal; a New York state-court order rests on New York law, discussed below.

The Act is not yet fully effective; under Section 20 it takes effect on the earlier of 18 months after enactment or 120 days after final regulations ([1]).

Even so, FinCEN stated that “”Additionally, with some regularity, Federal court orders require stablecoin issuers to burn and reissue an equivalent amount of stablecoins to a government-controlled wallet” ([2]).

Step one: report to IC3 and put the issuer on notice

File a complaint with the FBI’s Internet Crime Complaint Center (“IC3”) asap after your incident (include all details relevant to unauthorized crypto transfer).

In 2025, the IC3 Unit received 181,565 complaints involving cryptocurrency with $11.366 billion in reported losses ([6]).

FBI specifically encourages investors who suspect that criminals exploited DeFi smart contract to report to IC3 or a local field office ([7]).

At the same time, counsel should send the issuer, among other things, (i) a written notice of the theft; (ii)tainted blockchain addresses; (iii) the victim’s ownership claim. Also send the request that the addresses be blocked/frozen pending legal process.

Step two: work with federal authorities toward forfeiture

Forfeiture is how the government takes title to stolen stablecoins and returns them to victims.

On June 18, 2025, the Department of Justice (“DOJ”) filed a civil forfeiture complaint against more than $225.3 million in cryptocurrency tied to investment-fraud laundering.

“The Department of Justice thanks Tether for its … assistance in this investigation”, further described the effort as made “all with the eye toward making victims whole” ([4]).

Victims then recover through remission or restoration administered by DOJ’s Money Laundering and Asset Recovery Section. The agency reported returning “more than $13 billion in forfeited assets to victims” since 2000 and publishes a model petition under 18 US Code. § 981e)(6) ([5]).

The government decides whether and when to act. Accordingly, a well-prepared referral from counsel and former federal investigators matters (supported by blockchain analytics and crypto title reports); however, no outcome can be promised.

Step three: seek a TRO in New York Supreme Court

New York is a natural forum.

Circle Internet Group, Inc. lists its business address as One World Trade Center, New York, NY 10007 in its SEC filings ([11]).

New York State Department of Financial Services (“NYDFS”) lists Circle Internet Financial, LLC as licensed since September 2015. NYDFS also list Circle Internet Trust Company, LLC as chartered since July 2026 ([12]).

Under Civil Practice Law and Rules (“C.P.L.R.”) 6301 (“Grounds for Preliminary Injunction and Temporary Restraining Order (TRO) – “A temporary restraining order may be granted pending a hearing for a preliminary injunction where it appears that immediate and irreparable injury, loss or damage will result unless the defendant is restrained before the hearing can be had.” ([8]).

C.P.L.R. 6313(a) states that “Upon granting a temporary restraining order, the court shall set the hearing for the preliminary injunction at the earliest possible time.” Furthermore, the court may require an undertaking – “Undertaking. Prior to the granting of a temporary restraining order the court may, in its discretion, require the plaintiff to give an undertaking in an amount to be fixed by the court…” ([9]).

Depending on the facts, the relief sought against the unknown thief and the issuer may include restraining any transfer from the identified addresses.

Where the evidence shows it is technically feasible, directing the issuer to burn the frozen tokens and issue replacements to a court-supervised wallet.

Where the thief is a non-domiciliary or has secreted property, C.P.L.R. § 6201 also supplies grounds for attachment ([10]). “Grounds for attachment. An order of attachment may be granted in any action…when (1) the defendant is a nondomiciliary residing without the state, or is a foreign corporation not qualified to do business in the state…” Step four: from frozen to returned

A freeze is just the midpoint.

Frozen USDC comes back to a victim in one of two ways. Either through the federal forfeiture action, in which the government forfeits the tokens and a victim petitions for remission or restoration ([5]).

Or, alternatively, through a court order directing the issuer to burn the blocked tokens and reissue an equivalent amount to a wallet the court or the victim controls (mechanism FinCEN describes as already used with some regularity by federal courts ([2]).)

Which path applies depends on whether the government has opened a case and how quickly the freeze was obtained.

Contact US

Call +1 212 457 9797, email info@dilendorf.com, or request a consultation. Bring the wallet addresses, transaction hashes, dates, any IC3 complaint number, and every message exchanged with the issuer or exchange.

This article does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Search the 136-page Standard Form 86 for the words “cryptocurrency,” “bitcoin,” or “digital asset” and you will find nothing.

Many applicants take that to mean crypto is irrelevant to the security clearance process. It isn’t.

SF-86 asks about (i) foreign financial interests; (ii) tax compliance; (iii) debt problems; (iv) self-employment; (v) unauthorized computer access, etc. And a crypto portfolio can touch every one of those categories. ([1]).

Defense Office of Hearings and Appeals (“DOHA) judges have already denied clearances in cases where Bitcoin was central to unresolved debt, tax issues, or the purchase of illegal drugs. ([5], [6]).

Below are the actual questions (quoted from the form), and what they mean for federal employees, contractors, and military members who own crypto.

The certification you sign before the questions start

SF-86 begins with a clear warning. The form states that falsifying/concealing a material fact is a felony and that agencies “generally fire, do not grant a security clearance, or disqualify individuals who have materially and deliberately falsified these forms” ([1]).

SF-86, Penalties for Inaccurate or False Statements (verbatim)

The U.S. Criminal Code (title 18; section 1001) provides that knowingly falsifying or concealing a material fact is a felony which may result in fines and/or up to five (5) years imprisonment. In addition, Federal agencies generally fire, do not grant a security clearance, or disqualify individuals who have materially and deliberately falsified these forms, and this remains a part of the permanent record for future placements.

The same instructions add a line that crypto holders should read twice: “responses to this form may be compared with your responses to previous SF 86 questionnaires” ([1], [2]).

For example, a crypto wallet omitted from a 2017 SF-86 but disclosed in 2026 is the type of inconsistency the form is designed to identify.

Statute itself carries fines and imprisonment of up to 5 years for materially false statements in any matter within federal jurisdiction ([12]).

Section 20A: your offshore exchange account is a foreign financial interest

Section 20A is the question most crypto holders get wrong, because it never says “exchange” or “token.” It says this:

SF-86, Question 20A.1 (verbatim)

Have you, your spouse or legally recognized civil union/domestic partner, cohabitant, or dependent children EVER had any foreign financial interests (such as stocks, property, investments, bank accounts, ownership of corporate entities, corporate interests or exchange traded funds (ETFs) held in specific geographical or economic sectors) in which you or they have direct control or direct ownership? (Exclude financial interests in companies or diversified mutual funds or diversified ETFs that are publicly traded on a U.S. exchange.)

The word is “EVER,” in capitals, with no seven-year lookback.

That could be a challenging question for cryptocurrency holders.

Consider an applicant who received dozens of airdrops, moved assets across multiple exchanges, interacted with decentralized finance (DeFi) protocols.

In some cases, DeFi transactions could involve liquidity pools, validators or protocols connected to foreign jurisdictions.

Developing a complete history of potentially foreign financial interests could require reviewing years of wallet activity, exchange records, smart-contract interactions, and blockchain data.

The adjudicator may then analyze those facts under Guideline B (Foreign Influence), which identifies as a security concern “substantial business, financial, or property interests in a foreign country, or in any foreign-owned or foreign-operated business that could subject the individual to a heightened risk of foreign influence or exploitation” ([3]).

SF-86, Question 20A.1 follow-ups (verbatim)

Provide the type of financial interest.

Provide the date acquired.

Provide how the financial interest was acquired (such as purchase, gift, etc.).

Provide the cost (in U.S. dollars) at time of acquisition.

Provide the current value (in U.S. dollars) or the value at the time control or ownership was sold, lost or otherwise disposed of.

Are there any co-owners of this foreign financial interest?

Now try answering those questions for a crypto portfolio built over multiple years.

Digital assets may have been acquired through purchases, airdrops, forks, staking rewards, liquidity mining, DAO participation, exchange migrations, or DeFi transactions.

Section 26: the crypto tax years

Section 26 asks about bankruptcy, gambling, taxes, liens, and delinquent debt.

For crypto holders, one question stands out:

SF-86, Question 26.3 (verbatim)

In the last seven (7) years have you failed to file or pay Federal, state, or other taxes when required by law or ordinance?

The IRS treats digital assets as property, puts a yes-or-no digital asset question on Form 1040.

Any taxes income from staking, mining, airdrops, and sales ([8]).

The guideline addresses unexplained wealth.

“Unexplained affluence, as shown by a lifestyle or standard of living, increase in net worth, or money transfers that are inconsistent with known legal sources of income” is its own disqualifying condition, so a crypto windfall you cannot document is a problem even when you owe nothing ([3]). Section 26.7 then asks whether you “defaulted on any type of loan” or had “bills or debts turned over to a collection agency,” which is how leveraged crypto positions surface ([1]).

What DOHA judges have already said about crypto

In June 2025, DOHA judge denied a clearance to an applicant with more than $97,000 in delinquent federal taxes.

The applicant testified that, “[b]elieving that his cryptocurrency investment returns would cover his owed back taxes,” he withdrew $300,000 from a crypto account to purchase a home.

The judge found that it was not clear if the applicant’s tax payments accounted for his “large amount of profit from crypto currency” sales.

The decision noted that this was “not documented.” The judge further observed that “[e]qually unclear are his mounted losses from his gambling in crypto currency” ([5]).

In July 2024 another applicant lost his clearance over a $38,431 charged-off loan.

He “took the money from this loan and invested it in the bitcoin cyber-currency market, with the hopes that it would increase in value.” The judge found the debt to be unresolved ([6]).

The lesson from these decisions is straightforward: cryptocurrency itself is not disqualifying. However, but failing to document/properly report crypto activity on Form SF-86 could be.

For clearance purposes, owning crypto is rarely the issue. Explaining it and documenting it is.

After the clearance: the disclosures do not stop

Clearance holders have continuing reporting duties under Security Executive Agent Directive 3.

Federal employees who file financial disclosures reports must generally report virtual currency held for investment.

Office of Government Ethics treats cryptocurrency as “property held . . . for investment or the production of income,” subject to applicable reporting thresholds. ([9]).

Crypto is not treated as a “publicly traded security.” That means even a small cryptocurrency holding can create a conflict if the employee is involved in a matter that could affect its value ([10]).

FinCEN has also announced its intent to amend the FBAR rules to cover virtual currency held in foreign accounts ([11]).

Contact Us

Questions about cryptocurrency and security clearances? Contact Max Dilendorf at +1 212 457 9797 or info@dilendorf.com, or use our contact page.

Max Dilendorf also advises individuals outside the government sector on cryptocurrency-related disclosure and compliance issues. His represents investment advisers, hedge fund professionals, and other regulated financial industry employees.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Around July 29, 2026, unknown group of attackers gained unauthorized access to Liechtenstein’s Register of Beneficial Owners.

They copied records of approx. 31K+ legal entities, including companies, foundations, and trusts ([1]).

For U.S. families and family offices that hold assets through those structures (including crypto), this is not a tale about how European compliance works.

It is a personal security event, and the next wave of attacks could happen by email, phone, and video call.

This article explains what information was exposed and who may be affected.

It also explores how ordinary data can could become more sensitive when combined with information available through US public databases (e.g., ADV filings submitted by investment advisers to the SEC).

With today’s advanced AI-powered search and pattern-recognition tools, bad actors can uncover insights that would have been difficult to identify just a few years ago.

Finally, it talks about the steps that families with asset protection trusts in Liechtenstein,Cook Islands, Nevis, and other trust-register jurisdictions should consider reviewing now.

This article also touches upon a question that offshore asset protection trust attorneys are increasingly asked after incidents like this: if trust assets are compromised as part of a cyberattack (e.g., account takeover involving a trust bank account or cryptocurrency wallet,), who bears the loss?

Many readers would be surprised to learn that many trust agreements are either silent on this issue or have provisions, placing the risk of loss on someone other than the trustee.

For a more detailed discussion of that issue, see our article, “AI Cyberattacks and Asset Protection Trusts: Who Bears the Loss?“

What was taken

According to the Liechtenstein government, compromised records included names of legal entities and identifying information about their beneficial owners, including names, DOBs, nationalities, countries of residence, etc. ([1]).

The government’s incident response review determined that intrusion was made possible by a flaw in the system’s authorization controls ([2]). Officials described the incident as highly sophisticated attack. ([3]).

For families that use offshore structures, the significance of the breach is beyond the loss of data.

Whoever got these records may now have verified information of who owns or controls thousands of private wealth structures (together with personal information that could be used in phishing, social engineering and impersonation).

How Cybercriminals Build a Targeted List

Beneficial ownership data becomes far more sensitive when it can be matched with info available from other public sources.

For example, every U.S. investment adviser registered with the US Securities and Exchange Commission has to file Form ADV. Much of the information disclosed in those filings is publicly available through SEC’s portal ([4], p. 12).

The issue is that Form ADV shows not only the identity of an advisory firm and its key personnel, but also the firm’s AUM, approx. number of client accounts, and portion of assets that attributed to non-U.S. clients ([5], pp. 13-14).

When combined with beneficial ownership records, this information can provide a road map for cybercriminals.

Recent cyber warnings (e.g., NSA Five Eyes report) and the fallout from the Liechtenstein breach highlight how investment advisers could become attractive targets for sophisticated cyberattacks.

Aggregated public records can identify HNW, where they operate, and professionals who advise them.They could also trace the entities through which they hold and manage assets.

That, in turn, could increase the risk of targeted phishing, business email compromise, impersonation, and other social engineering attacks.

FinCEN has already warned that criminals combine generative-AI images with “stolen personally identifiable information” to build fake identities that pass customer identification and due diligence controls ([7], pp. 2–3).

The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025 with $20.877 billion in reported losses; personal data breach alone accounted for $1.31 billion; business email compromise was apprx. $3.05 billion ([8], pp. 6–8).

Five Eyes Warning

Liechtenstein breach did not occur in isolation.

Just weeks before news of the incident emerged – on June 22, 2026, the NSA and its counterparts in the United Kingdom, Canada, Australia, and New Zealand issued a joint statement on artificial intelligence and cyber risk ([9]).

“Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months.” — Five Eyes Cyber Security Agencies Statement, June 22, 2026 ([9])

Five Eyes agencies urged organizations saying “Breaches will occur. Preparedness helps you contain them quickly and prevent escalation into major operational and financial crises.”

The guidance was even more than blunt: “Test response plans, train and prepare teams, and assume breaches will occur” ([9]).

For many families with domestic/offshore asset protection trusts, that advice is no longer theoretical.

If the organization never rehearsed how to verify and respond to such a request, it could be exactly the type of target the Five Eyes warning was describing.

Family offices, trustees, and advisers should consider running tabletop exercises and updating their business continuity and incident response plans. This could help to address AI-enabled fraud and attacks.

Cook Islands, Nevis, Liechtenstein: what to review in an existing offshore trust

Liechtenstein register exists because anti-money-laundering rules now require most jurisdictions to record who stands behind a structure ([1]).

The lesson is not limited to Liechtenstein.

Families with offshore structures in foreign jurisdictions (Cayman Islands, Cook Islands, Nevis, Jersey etc.) should assume that similar information exists in trustee records, banking files, and due diligence databases.

Each database has valuable identity information. Each can become a target. Choose your jurisdiction wisely.

The takeaway is not to abandon offshore planning. It is to choose the jurisdiction, trustee, and structure carefully. You should understand that cyber risks are now as important as legal, creditor and tax risk.

In our experience, many U.S. domestic and offshore trusts were drafted long before today’s cyber threats emerged, i.e., the Five Eyes’s Report.

If the trust agreement is silent or unclear on cyber risk and loss allocation, a fresh review of the trust agreement would not hurt.

Depending on the trust instrument and governing law, cyber-related gaps can often be addressed through amendments, trust protector action, or other mechanisms.

If a structure no longer serves its purpose, orderly wind-down could be appropriate.

U.S. tax and reporting consequences should be reviewed before any assets are moved. U.S. tax and reporting obligations should be reviewed before any assets are moved.

When a trustee loses the money: who bears the loss

If a trustee wires trust assets to a fraudster impersonating a settlor, protector, or adviser, the first document to read is the trust agreement.

Many clients are surprised to learn that, for example, New York Banking Law § 100 authorizes a trust company to act in a fiduciary capacity and to “receive, take, manage, hold and dispose of” trust property according to the terms of the trust.

The statute, however, DOES NOT expressly say that the trustee must protect (or has a duty to safeguard) trust assets from foreseeable account takeovers, deepfakes, or other cyber fraud schemes.

That should raise an obvious question: if New York does not clearly address those duties by default, what exactly do the default rules say in Delaware, South Dakota, the Cook Islands, Nevis, or another offshore jurisdiction?

From our experience, most settlors and beneficiaries have no idea.

To be sure, trust statutes establish guardrails. Delaware, for example, allows a trust instrument to modify a fiduciary’s powers, duties, standard of care, indemnification rights, and liability ([15], § 3303(a)).

New York goes even further. Under New York E.P.T.L. § 11-1.7, a provision that relieves a fiduciary from liability for failing to exercise reasonable care, diligence, and prudence is void as against public policy ([16]).

These statutory frameworks provide useful guidance.

However, they don’t fully address a critical modern question – does a trustee have affirmative duty to protect trust assets from AI-enabled fraud, account takeovers, or other cyber threats? And if those safeguards fail, is the trustee responsible?

That is why families should not rely on default rules.

If the settlor expects the trustee to follow specific cybersecurity procedures or pick-up the risk of loss due a cyber-event like an account-takeover, those expectations should be written directly into the trust agreement.

If your trust agreement does not address cybersecurity risks, Dilendorf Law Firm can help evaluate whether an amendment, decanting, or other trust modifications may be appropriate.

Likewise, if your trust has suffered losses as a result of a cyber incident, account takeover, or related fraud, please contact us to discuss your potential claims and evaluate your legal options.

What to do in the first 30 days

1. Confirm your exposure. Liechtenstein instructed legal entities to notify their beneficial owners in writing, with letters going out since August 4, 2026; questions may be directed to the Office of Justice at vwbpfragen@llv.li ([1]). Ask your trustee or foundation council for a copy of the notice and a list of the data fields involved.
2. Upgrade Security. CISA advises highly targeted individuals to use phishing-resistant FIDO security keys or passkeys. Review CISA guidance for more personal cybersecurity tips ([10]).
3. Account Security. Increase security controls for bank and investment accounts. ,
4. Review the trust instrument. Review trust agreements to understand trustee’s cyber responsibilities and who bears the risk of loss from an account takeover.

Contact Us

To discuss an offshore or domestic asset protection trust, a breach notice, or losses involving a trustee or custodian, contact Max Dilendorf at +1 212 457 9797 or info@dilendorf.com. You may also reach us through our contact page.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Regulated employers and government agencies increasingly ask about crypto holdings and activities on job applications, renewal forms, and background questionnaires.

The questions could appear straightforward, but for individuals who have been involved with crypto for several years, the answers get more complex.

A disclosure may involve multiple exchanges, offshore trading platforms, self-custody wallets, token investments, staking activities, or participation in crypto projects.

This article examines common situations that can make crypto-related disclosures challenging. It explains how Dilendorf Law Firm helps applicants provide accurate, complete, and defensible responses.

Who gets asked about crypto, and why

Regulators treat crypto as investment property that can create conflicts of interest.

The U.S. Office of Government Ethics (“OGE”) determined in 2018 that crypto “property held . . . for investment or the production of income” must be reported on federal financial disclosure reports, naming the exchange or platform where it is held ([1]).

The same logic applies to private-sector job application/renewal forms.

Traders and analysts at hedge funds and registered investment advisers file holdings reports within 10 days of becoming an “access person.”

After that, the filing comes in every 12 months, plus quarterly transaction reports listing every account holding securities for them ([8]).

Registered representatives at broker-dealers certify on Form U4 that their answers are “true and complete to the best of my knowledge” and accept “a continuing obligation to amend and update” the form ([9]).

Federal employees, contractors, and clearance holders complete the Standard Form 86 (SF-86). This form asks, among other things, about foreign financial interests, self-employment, tax compliance, debts, and civil court actions ([10]).

Bank and fintech compliance staff face a statutory bar on anyone convicted of an offense involving “dishonesty or a breach of trust or money laundering” ([12]).

Five situations where the truthful answer gets complicated

Clients come to Dilendorf Law Firm with one of these fact patterns, and often with several.

1. An exchange closed or froze your account citing KYC or AML rules. Exchanges are money transmitters subject to anti-money-laundering programs and suspicious activity reports(“SAR”) filings ([3]).

Under SAR regulations, crypto exchanges “are prohibited from disclosing to a person involved in the transaction that a suspicious activity report has been filed” ([4]).

So as an exchange’s customer, you will never find out that the exchange filed SAR form with FinCen (unless you hear from FinCen directly – which hopefully will never be the case).

The CFPB has found that platforms “sometimes cite boilerplate user agreement language to absolve themselves of responsibility” for frozen accounts ([7]).

You are left with a closure notice (sometimes citing alleged violations of KYC/BSA regulations), no explanation, and a form asking whether any account was ever restricted.

2. Your crypto sits on a foreign exchange or in an offshore entity. The SF-86 asks if you have “EVER had any foreign financial interests (such as stocks, property, investments, bank accounts . . .)” under your direct control ([10]).

FinCEN explained that that a foreign account holding only virtual currency “is not reportable on the FBAR” today but that it “intends to propose to amend the regulations” to cover it ([5]).

How to list a non-U.S. exchange account depends on the form’s wording and your prior answers.

3. A past tax year never accounted for your crypto. Every Form 1040 filer must answer the digital asset question, and “taxpayers must report all income related to their digital asset transactions” ([6]).

The SF-86 separately asks whether, in the last seven years, you “failed to file or pay Federal, state, or other taxes when required by law” ([10]).

For example, an unreported staking reward or an unfiled amended return can turn a holdings question into a tax-compliance question.

4. Your holdings conflict with the job. OGE determined that because crypto and stablecoins are not publicly traded securities, “no de minimis exemption applies,” so an employee holding any amount may not work on a matter that could directly and predictably affect its value ([2]).

Fund codes of ethics impose pre-clearance and reporting duties of their own ([8]).

Deciding what to divest, disclose, or recuse from before the start date is a legal judgment.

5. You built, advised, or lost money in a crypto venture. Form U4 asks if you are “engaged in any other business either as a proprietor, partner, officer, director, employee, trustee, agent or otherwise” ([9]).

Moreover, the SF-86 requires all self-employment for ten years ([10]).

A token launch, a DAO role, or a mining operation belongs on those forms. The same could be true for aftermath of a hack or fraud: the SF-86 asks about judgments, liens, debts over 120 days delinquent, and any civil court action in ten years ([10]).

How to answer truthfully

Answer the questions that were actually asked. You should be disclosing information only that it responsive to the question; don’t characterize unexplained account closure as legal misconduct or violation unless the finding of law was actually made.

Gather the closure notice, statements, tax returns, and prior forms first, and check every new answer against every earlier one.

For example, the SF-86 guide warns that “responses to this form may be compared with your responses to previous SF 86 questionnaires” ([11]). Amend when facts change.

The stakes are high. Knowingly and willfully making a materially false statement in a matter within federal jurisdiction can result in criminal penalties, including up to five years’ imprisonment ([13]).

The the SF-86 warns that agencies “generally fire, do not grant a security clearance, or disqualify individuals who have materially and deliberately falsified these forms” ([10]).

Contact Us

To discuss a job application, renewal, clearance, or disclosure question involving crypto, contact Max Dilendorf at +1 212 457 9797 or info@dilendorf.com, or use our contact page.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Asset protection trusts (domestic and offshore) were designed to keep assets away from creditors.

In 2026, a different question is becoming just as important: can the trustee protect those assets from cybercriminals?

If a criminal gains control of the trust’s bank, brokerage, or custody account, who bears the loss? Does the trustee absorb that risk, or do the beneficiaries?

These issues are best addressed in the trust agreement from the outset. Waiting for a judge or arbitrator to determine responsibility after trust assets have been compromised is a far less desirable outcome.

Why the Question Matters Now

The threat to trust accounts is no longer theoretical. The federal agencies that track the evolving AI risks are measuring the timeline in months.

On June 22, 2026, the Five Eyes cyber security agencies, led by the National Security Agency (“NSA”), warned that:

“Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months. In this environment, cyber resilience is integral to advancing business continuity, market confidence, and long-term value” ([1]). [emphasis added]

The same statement calls cyber risk “a core business risk and leadership responsibility,” and a trustee holding a family’s liquid wealth is exactly the kind of leader it is addressing ([1]).

The Federal Bureau of Investigation (“FBI”) Internet Crime Complaint Center (IC3) recorded $20.877 billion in reported losses for 2025, including $3,046,598,558 from business email compromise and roughly 4,700 account-takeover complaints totaling $359.7 million ([2]).

Family offices and investment managers are exposed for a structural reason. Form ADV (including the adviser’s business, ownership, clients ) is published on the Securities and Exchange Commission’s (“SEC”) Investment Adviser Public Disclosure website. This is a public domain of who manages significant wealth ([14]).

What New York and Delaware Law Say

Neither New York nor Delaware imposes a specific statutory duty on trustee to safeguard trust accounts against cyberattack or account takeover. Both rely on general prudence standards that written before frontier AI existed.

New York. The Estates, Powers and Trusts Law (EPTL) § 11-2.3 requires a trustee to “exercise reasonable care, skill and caution” as “a prudent investor would,” judged by “facts and circumstances prevailing at the time of the decision or action” ([3]).

The section appears to apply to investments held on or after January 1, 1995. It does not mention anything about cybersecurity standards. It just says that: “A trustee shall exercise reasonable care, skill and caution to make and implement investment and management decisions as a prudent
investor would for the entire portfolio…” ([3])

Banking Law § 100 lists a trust company’s fiduciary powers without imposing any affirmative safeguarding duty ([4]).

In our arbitration practice, a trustee has taken the position that under the NY Banking Law § 100, a trustee does not have an express duty to safeguard trust assets against a foreseeable account takeover.

New York does, however, void any attempt to exonerate an inter vivos or testamentary trustee “from liability for failure to exercise reasonable care, diligence and prudence” ([5]). But the question becomes – what’s reasonable in the agentic AI era?

Delaware. Title 12, § 3302(a) requires a fiduciary to act “with the care, skill, prudence and diligence under the circumstances then prevailing that a prudent person acting in a like capacity and familiar with such matters would use” ([6]).

The section’s history note runs from the Delaware Code of 1915 through later amendments. None of the amendments added anything relating to cybersecurity, account security, or safeguarding ([6]). A prudent-person standard that was initially drafted in 1915 now has to be applied to AI cyber threats the NSA says is measured in months.

Delaware also lets the governing instrument “expand, restrict, eliminate, or otherwise vary” a fiduciary’s “standard of care, rights of indemnification and liability,” with a floor only at “wilful misconduct” ([7]).

A settlor who signs a trust-company form without reading that clause may have waived the right to recover a negligent cyber loss.

Regulation Is Not Private Risk Allocation

A regulated trustee’s cybersecurity rules protect the institution and its regulator, not the settlor’s trust agreement. New York’s 23 NYCRR Part 500 requires every “covered entity” licensed under the Banking Law to maintain a cybersecurity program and use multi-factor authentication ([11]).

Those duties apply to the NY Department of Financial Services (“NYDFS”), not to a beneficiary, and an individual or family.

As a matter of fact, grantor, beneficiary or family can’t even asset a claim against a trustee based on alleged violation of NYDFS cybersecurity standards. Part 500 does not provide a private right of action.

A separate question is what cybersecurity requirements apply to a foreign trustee. The answer will depend on the laws and regulatory framework of the trustee’s jurisdiction. This is is one of many considerations for those evaluating offshore asset protection trusts.

The bank owes less than clients expect. Under Uniform Commercial Code (UCC) § 4A-202(b), an unauthorized wire is effective as the customer’s order if the bank’s security procedure was “a commercially reasonable method of providing security against unauthorized payment orders” and was followed in good faith ([10]).

The trustee, not the bank, is often the first and last line of defense.

A Public Yardstick for Trustee Cybersecurity

Settlors do not need to be technologists to measure a trustee.

The National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (CSF) 2.0 organizes cybersecurity outcomes into six functions, “GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER,” and is “designed to be used by organizations of all sizes and sectors” ([12]).

The Cybersecurity and Infrastructure Security Agency (“CISA”) ranks multi-factor authentication types from strongest to weakest, with phishing-resistant MFA a distinct category from text-message codes ([13]).

Before signing, a settlor should ask the prospective trustee, in writing:

1. Who bears the loss if an account is taken over despite your controls?
2. How much cybersecurity insurance does the trustee have?
3. Which NIST CSF 2.0 functions does your program map to ([12])?
4. Is phishing-resistant MFA required for everyone who can move trust funds ([13])?
5. How is a distribution request verified out of band before a wire is released?

Putting It in the Trust Agreement

If the statute is silent, then the trust agreement should define how risk of risk of loss is allocated.

Depending on the jurisdiction, a trust agreement could impose an express duty on the trustee to safeguard accounts, credentials, and digital assets. It could also place the risk of loss arising from account takeovers to the trustee (which is a reasonable approach given today’s threat environment).

It is no longer unusual for a trust to name a cybersecurity adviser together the investment adviser and administrative trustee (especially true where cryptocurrency is part of the estate).

Delaware’s directed-trust statute allows the instrument to give a person authority to direct or veto a fiduciary’s “investment decisions, distribution decisions or other decision of the fiduciary” ([8]).

The instrument should also say where a dispute will be heard.

Under the Federal Arbitration Act, a written arbitration provision in a contract involving commerce is “valid, irrevocable, and enforceable” ([15]). Settlors commonly designate American Arbitration Association (AAA) or JAMS arbitration in a U.S. venue so that a negligence claim is not litigated first in the trustee’s home forum.

Offshore Trusts Raise the Stakes

An offshore trustee can be excellent at creditor protection, but still be unexamined on AI cyber risks.

A Cook Islands trust is governed by the International Trusts Act 1984 and its amendments through 2013, published by the Cook Islands Financial Supervisory Commission ([18]). Notably, U.S. persons who fund foreign trusts must report those transactions on Internal Revenue Service (IRS) Form 3520 ([17]).

We believe many foreign trustees are still working out what the Five Eyes statement means for their business; that’s provided they’re even ware of the NSA report.

The client’s job is to know (before funding the trust) what legal mechanism operate between settlor and trustee if something goes wrong, because no one wants to litigate a negligence claim in Rarotonga.

Existing Trusts Are Not Frozen

An irrevocable trust can often be updated.

New York’s decanting statute, EPTL § 10-6.6, allows an authorized trustee to appoint principal to a new trust for the same beneficiaries ([16]).

Depending on the circumstances, decanting could be used to update a legacy trust by adding specific cybersecurity provisions and allocating the risk of cyber-related losses.

If your asset protection trust is governed by the laws of Wyoming, Delaware, South Dakota, or another jurisdiction, we can help evaluate if decanting is appropriate. Our team, which includes retired IC3 cybercrime specialists, can help structure and transfer trust assets to a new trust designed to address modern cybersecurity risks (including agentic AI cyber threats).

Contact Us

To discuss a domestic or offshore asset protection trust, contact Max Dilendorf at +1 212 457 9797 or info@dilendorf.com.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Common wire fraud fact pattern: U.S. company receives an email from a vendor that appears to be ordinary, requesting that it update its bank details before the next payment.

The controller then wires $500,000. Two days later, the vendor calls to ask where the money is.

The company contacts its bank. Bank issues a request to recall the funds.

Within a few hours, it receives a reply that the receiving bank has credited the money and that the account holder has already transferred it out in amounts ranging from $60,000 to $80,000.

There is now nothing left to return.

Business email compromise (“BEC”) is a type of fraud. The FBI’s Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints and reported losses of $3.05 billion in 2025. This makes it the second-most costly type of cybercrime ([1]).

By the 48-hour mark, when the first account has been emptied, the chances have decreased (although they have not disappeared completely).

Once the bank says that it can’t reverse the transfer, victim company should consider the following protective steps described in this post.

Why the bank can’t simply take the money back

According to Article 4A of the Uniform Commercial Code, once a payment order has been accepted, cancellation is not valid unless the receiving bank agrees to it. There is, however, a narrow exception in the case of unauthorized or mistaken orders ([11]).

Even if deceived, the company agreed to the wire. When the account number and the name do not match, the beneficiary’s bank as a general rule “may rely on the number as the proper identification of the beneficiary” ([12]). And that’s the big problem for the victim company.

A recall is a request (not a default right), and it applies only as long as the money remains in the first account.

However, by the time the victim realizes the fraud, the money is often long gone from that account.

The FBI continues to tell victims to make this request right away, together with “any necessary indemnification documents” ([1]). A request must be made; it is not the final step.

The money is not gone; it has moved

Criminals send the money stolen from victims via “money mules.” These mules get the money from the victims and send the funds to conspirators, many of whom are based overseas ([7]).

According to FBI data, the funds involved in BEC are being sent to over 140 different receiving countries, via intermediary banks in the United Kingdom, Hong Kong, China, Mexico, and the United Arab Emirates.

More and more are going into custodial accounts held by payment processors, peer-to-peer platforms, and crypto exchanges ([2]).

Batches ranging from $60,000 to $80,000 are intended to bypass banks’ AML filters.

Each of those transfers ends up in a different account at another bank, where it can be identified and, depending on the circumstances, frozen.

Step one: complete IC3 complaint

The FBI’s Recovery Asset Team (RAT) operates the Financial Fraud Kill Chain (“FFKC”). The FFKC works with banks, asking them to freeze fraudulent transfers. Dilendorf Law Firm works with retired FBI IC3 agents to facilitate processing of complaints with the IC3 unit.

In 2025, the RAT froze $679 million out of the $1.16 billion that criminals had attempted to steal, achieving a success rate of 58 percent ([1]).

For a company at hour 48, the FBI states that it “will expand the FFKC process beyond the initial recipient bank if information is provided during the FFKC initiation on ‘second hop’ transactions to other domestic or international accounts” ([1]).

FinCEN’s Rapid Response Program handles cases involving wires sent to foreign accounts and has assisted in the recovery of over $1 billion since 2015.

FinCEN says that it is most likely to interdict funds reported to law enforcement within 72 hours; however, it does not claim that recovery is impossible after that time ([3]).

Victims do not contact FinCEN themselves. Instead, they file a complaint with IC3 or the nearest Secret Service field office, providing all account and bank details for both parties along with a summary of the fraud ([3]).

A bare complaint only goes as far as the first account. One that includes all that the bank knows about the onward transfers allows the FBI to pursue the second hop.

Step two: push the banks to use their own tools

FinCEN’s advisory on BEC informs financial institutions that they have a duty to file a suspicious activity report “regardless of whether the scheme or involved transactions were successful.”

Furthermore, the fact that a recovery request has been made does not release them from that obligation ([4]).

Section 314(b) of the USA PATRIOT Act enables banks to share information with one another, benefiting from a liability safe harbor, regarding transactions which may involve fraud proceeds, such as those connected with wire fraud and “money mule” schemes ([5]).

You should ask the company’s bank in writing to activate both of these channels with the receiving bank and with each subsequent bank as it is identified.

Step three: the forfeiture route

Even after the first account has been emptied, the Department of Justice can trace and seize the stolen money and return it.

In a case in Massachusetts, a workers’ union sent $6.4 million via an email that had been spoofed by only one letter.

The government’s complaint states that the money passed “through a series of intermediary bank accounts,” some of it being routed to a cryptocurrency exchange and to banks in Hong Kong, China, Singapore, and Nigeria.

The investigators were still able to trace the funds to seven domestic accounts, seized them, and brought a civil forfeiture action worth about $5.3 million ([8]).

In a case in Florida, $2,462,000 that had been stolen through an email impersonating a vendor was seized, forfeited, and sent “back to the victim” ([9]).

The process involves remission and restoration as set out in 28 C.F.R. Part 9. A person qualifies as a victim if they have suffered a specific pecuniary loss as a direct result of the crime, and the petition must contain “documentary evidence of a specific pecuniary (i.e., monetary) loss and the date the loss occurred” ([6]).

A petitioner could be disqualified if they have recourse to other reasonably available assets or compensation, so the insurance and counterparty issues discussed below should be dealt with carefully ([6]).

Step four: identify every other pocket

Depending on the facts, a victim may have claims or leverage beyond the thief’s accounts:

• The other party involved. FinCEN recommends that banks record which “compromised or impersonated parties” were involved, note whether auto-forwarding or inbox rules had been set, and indicate whether the authentication compromised was single-factor or multi-factor ([4]). When the vendor’s mailbox has been breached, the question of how to allocate the loss between the two companies is still an open one and will be decided by forensic evidence.
• The holders of the receiving accounts. The attachment statute in New York allows a court, on an appropriate showing, to attach the property of a defendant who is a nondomiciliary or foreign corporation, or one who “has assigned, disposed of, encumbered or secreted property” with the intent to defraud creditors ([14]). Civil proceedings directed at the identified holders of mule accounts can reach funds that have not been seized criminally.
• The company’s own bank. Under Article 4A, the risk of an unauthorized payment order is allocated in accordance with the bank’s security procedure ([13]). Where the customer has authorized the wire, the claim is less extensive, but it still needs to be examined.
• Insurers. Make sure that every policy which could possibly respond to the loss is notified promptly.
• Taxes. The IRS regards money taken “through fraud or misrepresentation” as stolen, and the loss can be deducted in the year the theft is discovered, but not so long as there is “a claim for reimbursement with a reasonable prospect of recovery” ([15]).

Preserve the evidence

The Secret Service states that “any delays will decrease the likelihood of financial recovery” and advises victims to “maintain records of all potential evidence” ([10]).

Victims should not wipe the devices in question. They must export the full email headers and obtain the mailbox audit logs before the retention periods expire.

Contact US

At Dilendorf Law Firm, we represent U.S. and non-U.S. companies whose wires have been diverted through business email compromise, from the first IC3 complaint through tracing, bank negotiations, and forfeiture petitions.

Where appropriate, we may pursue claims against counterparties, account holders, and financial institutions.

You can reach us at +1 212 457 9797 or by email at info@dilendorf.com.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

The most authoritative cyber warning of 2026 came on June 22, when the National Security Agency (“NSA”), joined by the cyber security agencies of the United Kingdom, Canada, Australia, and New Zealand, stated:

“Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months” ([1]). [emphasis added]

The agencies warned that AI is “shrinking the window between vulnerability discovery and exploitation” and state flatly that “Breaches will occur” ([1]).

For wealth managers and family offices holding digital assets, this warning highlights a complex network of risks rather than a single threat.

If you use an exchange, the user agreement typically assigns the risk of loss to you. If you choose self-custody, you are solely responsible for security.

If you use a trust or regulated custodian, their duty to protect your assets depends entirely on the terms of the governing document. Each arrangement should be reviewed carefully.

Exchanges: the loss is contractually yours

The FBI attributed the theft of approximately $1.5 billion from the exchange Bybit in February 2025 to North Korea ([2]).

In 2025 alone, the FBI received 181,565 complaints involving cryptocurrency with $11.366 billion in reported losses, up 22 percent from 2024 ([3]).

When customers report account takeovers, the Consumer Financial Protection Bureau found that companies “often” respond that transfers are irreversible and that “consumers are responsible for the security of their accounts” ([4]).

One platform cited terms stating the customer would not hold it liable for “equipment or software failures or malfunctions … security breaches and unauthorized access” ([4]).

In our experience, platform agreements routinely include clauses that shift losses to the customer if their device is compromised. Review these agreements proactively, before any incident occurs.

Self-custody: you are the security team

Hardware and browser wallets do not eliminate risk; instead, they transfer it to the holder.

A joint FBI, CISA, and Treasury advisory describes North Korean actors targeting “individual holders of large amounts of cryptocurrency” with trojanized applications whose fake “update” function installs malware that steals private keys ([5]).

The Federal Trade Commission is direct: if a wallet “is stolen or compromised,” you are “likely to find that no one can step in to help you recover your funds” ([6]).

AI-generated voice clones and deepfake video calls are already used to walk holders through the steps that drain a wallet ([7]). The NSA expects those tools to improve within months, not years ([1]).

Trusts and custodians: the duty is what the document says

Many families have placed digital assets in U.S. or offshore asset protection trusts with a professional trustee or a regulated custodian. This approach is often sound, but it does not provide automatic protection.

New York Banking Law § 100 gives trust companies fiduciary powers, including the power to “receive, take, manage, hold and dispose of according to the terms of such trust” the property entrusted to them ([8]).

The statute gives these powers; however, it does not contain any express duty to safeguard digital assets against foreseeable account takeovers or cyber attacks.

If that duty is not written into the trust agreement or custody agreement, you should expect the trustee will argue (in case of an account takeover or stolen funds from the trust) that the duty to safeguard does not exist.

The same considerations apply outside New York.

If the asset protection trust is established in South Dakota, Wyoming, or an offshore jurisdiction, do not assume that default rules impose the duties omitted by New York’s statute.

The trust agreement should clearly define the trustee’s responsibilities for safeguarding assets, including cryptocurrency and bank accounts, and specify the consequences of any breach in the age of agentic AI cyberattacks.

Regulators expect more of licensed custodians. DFS guidance issued September 30, 2025, to BitLicensees and limited purpose trust companies requires custodians to hold customer crypto only for custody and safekeeping and to segregate it on-chain and on their ledger.

It also requires trust companies to treat customers’ crypto as belonging solely to customers, and to disclose the customer’s property interest and any material sub-custodian risks ([9]).

These expectations are excellent, but they do not replace the need for enforceable contract terms and insurance.

What to check this month

1.    Exchange and platform agreements: locate the loss-allocation, device-compromise, and arbitration clauses ([4]).

2.    Trust and custody agreements, in every jurisdiction: confirm an express duty to safeguard digital assets, a defined security standard, and remedies for breach (given NSA’s June 22, 2026 warning concerning agentic AI cybercrime).

3.    Trustee and custodian insurance: confirm coverage, limits, and exclusions for cyber theft, and whether your assets are within the covered class.

4.    Key control: document who holds keys, who can authorize transfers, and what verification is required ([9]).

5.    Incident plan: know that the first report goes to the FBI’s IC3 with wallet addresses, transaction hashes, amounts, and timestamps ([10]).

Contact US

At Dilendorf Law Firm, we advise wealth managers, family offices, and individual holders on the custody of digital assets held on exchanges and in self-custody wallets.

We also help clients complete due diligence on onshore and offshore trustees and regulated custodians in New York and other U.S. jurisdictions.

If your crypto has already been compromised, we assign retired law enforcement agents to trace and investigate the theft and arbitrate claims against exchanges, trust companies, and custodians.

Contact us at +1 212 457 9797 or email us at info@dilendorf.com.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.