Australian Feds Confiscate Bitcoin, Benz, and Mansion Tied to 2013 Hack

An Australian man from Queensland has forfeited nearly 25 Bitcoin, a waterfront mansion, and a Mercedes-Benz after authorities alleged the assets were derived from criminal activity.

In a statement released on 18 May, the Australian Federal Police (AFP) revealed that the total value of the seized assets—approximately 4.5 million Australian dollars ($2.88 million)—was secured by the Criminal Assets Confiscation Taskforce (CACT).

The investigation began in 2018 after Australia’s financial intelligence agency, AUSTRAC, received a tip-off from Luxembourg officials regarding suspicious Bitcoin transactions allegedly linked to the man.

He had previously been convicted for hacking a US gaming company.

Further inquiries by the AFP also connected him to the 2013 theft of 950 Bitcoin from a French cryptocurrency exchange.

While no criminal charges were filed in relation to the Bitcoin theft, the AFP secured a court order in April 2025 to permanently confiscate the digital assets, property, and vehicle—arguing they were not supported by any identifiable legitimate income. h

The assets had been frozen in July 2023, following a determination that they were vastly disproportionate to the man’s known financial standing.

The seized assets will now be liquidated, with proceeds directed to the Commonwealth Confiscated Assets Account.

These funds will be reinvested into crime prevention initiatives and law enforcement programmes aimed at strengthening community safety.

Australian Feds Use Extraordinary Powers to Seize Suspected Hack Proceeds

The man behind the forfeited assets is Shane Stephen Duffy, who previously pleaded guilty in 2016 to charges of fraud and computer hacking related to the unauthorised sale of personal data from League of Legends players.

The data originated from a 2011 cyberattack on Riot Games, which compromised the information of more than five million users.

While Duffy was not involved in the original breach, prosecutors stated he obtained a copy of the stolen data online and monetised it.

He was also accused of hacking into the X (formerly known as Twitter) account of Riot Games president Marc Merrill to promote his illicit service, which offered unauthorised access to player accounts.

In a statement, AFP Commander Jason Kennedy highlighted that the agency has “unique powers” under the Proceeds of Crime Act to restrain and forfeit assets suspected to be derived from criminal activity, including cybercrime.

He said:

“The profits derived from criminal activities are also often used to fund further criminal acts, which is why the AFP works closely with our partners in the CACT to target the proceeds of crime and ensure they are reinvested in the community.”

The proceeds from the sale of Duffy’s Bitcoin, waterfront property, and luxury vehicle will be directed to a dedicated fund supporting law enforcement and crime prevention initiatives.