He served the sentence. The wallet kept working.

Marta checked the mailbox on a Tuesday in February 2024. She was sixty-two. She had spent thirty-one years keeping books for a lumber supply outside Corbin, Kentucky, and she still balanced her own checkbook on a legal pad because she did not trust the app her nephew had installed on her phone.

She was looking for a check that was not going to come.

Six years earlier she had bid on concert tickets through an online auction. The tickets did not exist. The seller did not exist. The money, $18,400 that she had been putting aside for a bathroom remodel, went to a chain of accounts and eventually into cryptocurrency, and eventually onto the books of a Bulgarian exchange called RG Coins.

In 2021 the man who owned RG Coins was convicted in the Eastern District of Kentucky. His name was Rossen G. Iossifov. He was sentenced to 111 months in federal prison. The court ordered him to pay $2,642,297.43 in restitution. The court also ordered him to forfeit crypto assets tied to the scheme.

Marta had read the docket entry the way she read a bank statement. Line by line. She understood that "forfeited" meant the government now owned the coins. She understood that a portion of what was recovered was supposed to make its way back to people like her.

She did not understand that the coins were not actually anywhere the government could touch.

That is the part of the story the Justice Department disclosed on July 9, 2026.

II. The unlocked cell.

Forfeiture is a piece of paper. That is the first thing to understand. When a federal court orders crypto forfeited, it does not automatically move the coins into a government wallet. Somebody has to actually take the keys. In the old world of cash and cars, the marshals showed up with a truck. In the crypto world, the keys are a string of characters, and if the defendant is the only one who has them, the paper says one thing and the wallet does another.

According to the indictment unsealed this week in the Eastern District of Kentucky, roughly $290,000 in crypto that had been ordered forfeited from Iossifov's 2021 case moved in January 2024. It moved out of a Kraken account. It moved through multiple exchanges. It moved through what prosecutors described as "illicit mixing services," which is the plain-English name for software that shuffles coins between many wallets to break the trail a forensic accountant can follow.

Iossifov was in federal prison in January 2024. He is still there.

The DOJ has not publicly explained how an incarcerated man allegedly directed a series of exchange transfers and mixer deposits from inside a federal facility. That is the ugly question at the center of this case. Not whether the coins moved. The coins moved. The question is who was sitting at the keyboard, and who let them.

III. What the machine was.

Read the original case slowly. Iossifov ran RG Coins, a Bulgaria-based exchange, from 2015 to 2018. The scheme he was convicted of participating in worked like this. Romanian-based fraudsters posted fake listings on American auction sites. Cars that did not exist. Boats that did not exist. Concert tickets. Farm equipment. When American buyers wired money, the funds were funneled to money launderers who converted the dollars into Bitcoin. Iossifov's exchange, prosecutors proved, then converted that Bitcoin into local currency and paid out the launderers in cash. Nearly $5 million moved through the machine over less than three years.

The 2021 case closed that machine. The sentence was 111 months. The restitution number, $2,642,297.43, was calculated against a class of victims that stretched across the United States.

The forfeiture was supposed to be the clean part. The part where at least some of what was stolen came back. In practice, forfeiture of on-chain assets works only if the government controls the keys. If the defendant controls the keys, the order is a promise the paper cannot keep.

Picture that for a moment. A judge signs an order. The order is filed. The docket updates. Somewhere in Kentucky, a woman like Marta reads that entry and starts checking the mail. And the coins the order refers to are still sitting in a wallet whose password lives in one person's head.

IV. What the new charges say.

The July 9 indictment charges Iossifov with three things. Destruction or removal of property to prevent seizure. Conspiracy to commit money laundering. Aiding and abetting. The maximum combined exposure is twenty-five years. He made his initial appearance in federal court in the Eastern District of Kentucky this week.

Assistant Attorney General A. Tysen Duva said the charges reflect the department's commitment to prosecuting defendants who "flout lawfully entered orders and portions of their criminal sentences." First Assistant U.S. Attorney Jason Parman called the alleged conduct "a direct affront to the authority of the federal courts."

Both quotes are worth reading twice. They are not describing a new fraud on the public. They are describing a fraud on the sentence itself. The government won. The government wrote down that it had won. And then, prosecutors allege, the man who lost went ahead and moved the money anyway.

He is entitled to a defense. He has not been convicted on the new counts. That is the legal posture and it should stay that way.

But the mechanism is worth stating plainly, because the mechanism will show up again under other names. The mechanism is this. In a system where control of an asset is a string of characters, custody is not what a court order says it is. Custody is who can sign the transaction. If the government does not take the keys the day the judge signs the order, the government does not have the asset. It has a claim against the asset. Those are not the same thing.

V. The mailbox.

Marta stopped checking the mail every day around the summer of 2024. She went back to checking it twice a week, like a normal person. The nephew who set up her phone told her he had read something online about the forfeiture case, that some of the money had gone missing, that the government was looking into it. She said thank you. She did not ask follow-up questions.

She had already done the math the way a bookkeeper does math. The restitution number in the 2021 order was less than the total amount stolen. The forfeiture was supposed to help close that gap. If the forfeited coins were now the subject of a new indictment, the gap was wider than the paper said.

That part may be the quietest thing in the file. There is a class of American victims from a 2018 scheme, told in 2021 that a court had recovered assets on their behalf. In 2024, according to prosecutors, those assets moved. In 2026, the government finally said so out loud.

The prison held the man. The prison did not hold the keys.

VI. What this case teaches.

If you take one thing from this file, take this. When a court orders crypto forfeited, ask where the keys are. Ask who holds them. Ask when the transfer to government custody happened, and on what date, and to what wallet. Because "forfeited" on paper and "seized" in fact are different words with different weights, and the gap between them is where cases like this one live.

The DOJ is now prosecuting a man for allegedly stealing money he had already been ordered to give back. That sentence should not be possible. In a system built on physical custody, it would not be. In a system built on private keys, it is a Tuesday in January.

Marta will not get her bathroom. That was decided in 2018. What was supposed to be decided in 2021 was whether the man who took her money would be made to give some of it back. Five years later, the question is still open.

The sentence ran. The wallet ran too.