DoJ actions that illuminate how traditional securities and fraud laws apply to token offerings and programmable finance.
WASHINGTON, DC, April 17, 2026
The Department of Justice’s most revealing digital-asset cases no longer ask whether decentralized finance exists outside traditional law, because prosecutors have already answered that question by charging fraud, manipulation, laundering, and conspiracy whenever code, tokenomics, or governance claims were allegedly used as vehicles for investor losses.
What matters now is the line DOJ is drawing between lawful software experimentation and criminal deception, and that line looks less like a philosophical debate about decentralization than a factual inquiry into whether promoters lied about liquidity, functionality, stability, governance, or access while money flowed in from users who believed the system worked as advertised.
The department’s April 2025 guidance in its policy memo on digital-asset enforcement sharpened that distinction by saying prosecutors should stop using criminal cases to impose broad regulatory frameworks on the sector, while still prioritizing investor victimization, rug pulls, exchange hacks, decentralized autonomous organization thefts, and exploitation of smart-contract vulnerabilities.
The first boundary is the claim that code or liquidity did what promoters said it did.
The SafeMoon prosecution is one of the clearest examples because the DOJ said the project’s leaders told investors that liquidity was safely “locked” and inaccessible, while prosecutors later alleged that the defendants retained access to the liquidity pool, diverted millions of dollars in digital assets, and used complex transactions to obscure the movement of funds for personal luxury spending.
That case matters because it turns one of DeFi’s most marketable phrases into a classic criminal issue: once “locked liquidity” becomes a knowingly false claim about who can access the assets, the technology vocabulary stops sounding innovative and starts looking like a familiar investor fraud built around misrepresentations of custody and control.
The February 2026 sentencing of SafeMoon chief executive Braden Karony to 100 months in prison for conspiracy to commit securities fraud, wire fraud, and money laundering shows that federal prosecutors were willing to treat a decentralized-finance token as the setting for ordinary financial crime when the project’s public promises about access restrictions and investor safeguards were allegedly untrue from the beginning.
Terraform pushed the point further by turning decentralization itself into a question of fact in a courtroom.
The Terraform case became so important because prosecutors said Do Kwon did not merely oversell a risky product, but instead marketed Terraform as a self-contained and decentralized financial world whose stablecoin, payment rails, and related products functioned through proprietary blockchain design, while the government alleged that core parts of that ecosystem did not work as advertised and were secretly manipulated to create the illusion of resilience.
As Reuters described when Kwon pleaded guilty in August 2025, prosecutors said Kwon falsely told investors that TerraUSD regained its peg through the protocol’s algorithm when, in reality, a trading firm had secretly intervened to support the price, which turned a story about autonomous finance into a story about concealed human intervention and fraudulent market presentation.
That sequence explains why the case sits at the center of the legal boundaries debate, because DOJ was effectively saying that calling a system decentralized does not protect the people behind it if the system’s stability, functionality, or supposed self-correction depends on undisclosed manual rescue, hidden counterparties, or false claims about what the protocol can actually do under stress.
The second boundary is that open code does not immunize against manipulation.
Avraham Eisenberg’s Mango Markets conviction gave prosecutors their first major criminal win in an open-market manipulation case involving a decentralized exchange, and the core theory was not that DeFi must be licensed into submission, but that using two accounts to distort the price of perpetual futures contracts and then withdrawing roughly $110 million from the platform and its users remained commodities fraud, commodities manipulation, and wire fraud even though the trades occurred on chain.
That case is important because it rejects one of the most persistent rhetorical defenses in programmable finance, namely the idea that if a protocol executed the transactions exactly as coded then the result must have been lawful, since DOJ persuaded a jury that manipulative conduct can still be criminal when a trader intentionally exploits the protocol’s own pricing mechanics to manufacture collateral, induce false valuations, and extract assets that would never have been available absent the distortion.
Medjedovic showed that exploiting protocol math can become fraud, hacking, and extortion at the same time.
The February 2025 indictment of Andean Medjedovic over the KyberSwap and Indexed Finance incidents widened the frame even further because prosecutors did not rely on one narrow theory, but instead charged wire fraud, computer hacking, attempted extortion, and money laundering after alleging that he exploited vulnerabilities in DeFi protocols to steal approximately $65 million and then attempted to use control over the stolen assets as leverage.
That blend of counts matters because it demonstrates how DOJ now views smart-contract exploitation as a flexible criminal fact pattern rather than a doctrinal puzzle, meaning a single protocol event can be described simultaneously as unauthorized technical interference, fraudulent taking, coercive bargaining, and laundering of proceeds if the government believes the defendant manipulated system behavior to obtain value that investors and protocol operators never agreed to surrender.
Older token-offering cases still matter because they reveal the offering-side theory beneath the newer DeFi files.
The March 2025 AML Bitcoin conviction is instructive for that reason because prosecutors said founder Rowland Marcus Andrade raised millions through false statements about the technology’s development, viability, business prospects, and release timeline, showing that the government’s basic theory has remained consistent across several crypto generations, which is that new code, new branding, and new fundraising architecture do not excuse lies about whether the product exists, works, or has commercial validation.
A similar lesson came from earlier initial-coin-offering prosecutions such as Titanium Blockchain, where the DOJ said investors were induced through fabricated partnership claims and distorted statements about technological readiness, reinforcing the idea that token offerings and programmable-finance ventures are still bound by the old rule that capital formation becomes criminal when promoters invent milestones, customers, integrations, or functional capabilities that do not exist.
The 2025 policy memo narrowed the route, but not the destination.
One of the most important developments for lawyers and founders is that the DOJ’s April 2025 memo explicitly told prosecutors not to bring digital-asset cases that require litigating whether a token is a security or commodity when there is an adequate alternative criminal charge available, which means the department is now signaling a preference for cleaner Title 18 fraud cases over sprawling criminal disputes about classification.
That does not make the older securities-fraud and commodities-fraud cases irrelevant, because SafeMoon and Terraform still show how prosecutors used those statutes when they believed investor-facing lies about liquidity, stability, and functionality were central to the scheme, but the current posture suggests the practical boundary will increasingly be policed through wire fraud, conspiracy, hacking, and laundering counts whenever those theories can do the work without forcing a threshold classification fight.
The legal consequence is subtle but significant because DeFi projects may face less prosecutorial appetite for abstract “regulation by prosecution” theories, yet receive no meaningful relief if the underlying facts still involve deception, concealment, market manipulation, misuse of customer funds, or exploitative interference with protocol logic.
What these cases teach firms building in programmable finance.
The first lesson is that technical vocabulary does not soften criminal exposure, because words like autonomous, decentralized, algorithmic, community-governed, and locked liquidity become dangerous very quickly when internal control, emergency intervention, treasury access, or price support operate differently from the public description that induced users to commit capital.
The second lesson is that firms cannot treat smart-contract behavior as a complete defense once a prosecutor can tell a simpler story about false promises, concealed rescue mechanisms, manipulative trading, or opportunistic exploitation of code weaknesses, because juries and judges will usually understand broken promises and extracted value faster than they will understand elegant white-paper abstractions.
The third lesson is that legal risk now sits at the intersection of engineering, product, treasury, and communications, which means governance must cover who can alter liquidity settings, who knows about emergency support arrangements, who drafts claims about protocol function, and who can trade, borrow, or vote around non-public information that changes how the code behaves in practice.
For founders, investors, and executives trying to understand how fraud, asset tracing, and cross-border enforcement can converge once a DeFi matter becomes criminal, many review Amicus International Consulting and its analysis of international extradition and enforcement exposure as digital-asset disputes begin to spill beyond product failure into personal legal risk.
The bottom line is that DOJ’s most important DeFi cases are not defining the sector by whether it is centralized or decentralized in branding terms, but by whether people raised money, moved prices, or extracted assets through statements and structures that allegedly misdescribed what the code, liquidity, or governance could really deliver once real investor money was on the line.
