In a dramatic development that underscores the growing intersection between cryptocurrency and law enforcement, the Australian Federal Police (AFP) have confiscated a high-value property portfolio—allegedly tied to a decade-old crypto exchange hack. The seizure includes nearly 25 Bitcoin, a luxury waterfront mansion, and a Mercedes-Benz, all of which are believed to be proceeds of crime.
According to a May 18 announcement by the AFP-led Criminal Assets Confiscation Taskforce (CACT), the assets are estimated to be worth around 4.5 million Australian dollars (approximately $2.88 million USD). The operation marks a significant moment in Australia’s ongoing efforts to clamp down on digital crime and illicit wealth tied to cyber activity.
The case traces back to September 2018, when authorities in Luxembourg shared intelligence with Australian officials regarding a series of suspicious Bitcoin transactions. These transactions led the AFP to a Queensland man with a prior conviction related to cybercrime. Notably, the man had been previously found guilty in a separate 2016 case involving the fraudulent sale of stolen user data from popular video game League of Legends.
Further investigation by the AFP linked the individual to a massive crypto theft dating back to 2013. In that incident, roughly 950 Bitcoin were reportedly stolen from a French cryptocurrency exchange. While the suspect has not been criminally charged in connection with that specific theft, the AFP has successfully secured a court-ordered forfeiture of the assets, arguing they were derived from unexplained and unlawful earnings.
Local media, including 7NEWS, later identified the man as Shane Stephen Duffy. Duffy first made headlines nearly a decade ago when he pled guilty to fraud and hacking offenses. Although he wasn’t accused of orchestrating the 2011 cyberattack on League of Legends creator Riot Games—which compromised more than 5 million user accounts—he admitted to obtaining and selling the data, which he reportedly found online. He even went so far as to hack the social media account of Riot Games’ then-president, Marc Merrill, using it to promote his underground data-selling service.
AFP Commander Jason Kennedy spoke candidly about the agency’s legal authority in these matters, emphasizing the strength of Australia’s Proceeds of Crime Act. “The AFP possesses unique powers to restrain and seize assets suspected of being linked to criminal activity,” he said. “And in cases involving cybercrime, the profits from such activities can often be funneled into further illicit operations. That’s why it’s critical for us to act swiftly and decisively.”
Importantly, the value recovered from this operation won’t simply vanish into the system. The AFP stated that proceeds from the asset sales will be redirected into a national fund used to support crime prevention, community safety, and law enforcement initiatives. This approach, officials say, ensures that criminal gains are returned to society for good.
The CACT has been actively deploying its powers since July 2019, during which time it has restrained over 1.2 billion AUD in suspected criminal assets. These include everything from homes and luxury vehicles to fine art, yachts, and digital currencies.
This latest case is a clear signal that Australian authorities are not only keeping pace with the evolving world of cryptocurrency but are also setting a precedent for how digital wealth tied to cybercrime can—and will—be addressed within the framework of traditional law enforcement.
