By Michael Phillips | Riptide
Note: This column shares a name with the FBI operation it examines. That’s a coincidence, not an affiliation, and it’s a good excuse to hold the number-sharing to the same standard we’d apply to anyone else’s.
On September 23, the FBI posted a graphic on X announcing the results of “Operation Riptide,” a 60-day campaign targeting cybercriminals. Six people were extradited from three countries. Two hundred-plus arrests. Fifty million dollars in seized cryptocurrency and virtual assets. One hundred seventy domains and servers taken down. “Borders will not protect you,” the post read. “Distance will not save you. We will find you.”
All four numbers trace back to the FBI’s own material. The question worth asking isn’t where they came from — it’s what exactly they’re counting.
The numbers, sourced
“The question worth asking isn’t where they came from — it’s what exactly they’re counting.”
The FBI’s August 15 recap video, released as Director Kash Patel closed out the campaign, states that the operation produced more than 200 arrests, froze or seized more than $23 million in illegal cryptocurrency and other funds, and initiated the return of another $31 million in virtual assets the FBI says was stolen by North Korean state actors. It also cites six extraditions, 170 domains and servers seized, and 13 “joint sequenced operations” conducted with domestic and international partners. Patel repeated the same 200-arrest, $23 million, $31 million figures in Senate Judiciary Committee testimony on September 15 — a week before the graphic went up.
Those figures are consistent with the September 23 post, give or take one gap worth flagging: $23 million plus $31 million is more than $54 million, not the “$50 million” the graphic cites. Whether that’s rounding, a different accounting window, or a recalculation is a fair question to put to the Bureau — but it isn’t evidence the number was invented.
One of the six extraditions is identifiable in the public record: Peter Stokes, a dual U.S.-Estonian citizen and alleged member of the hacking group Scattered Spider, arrested by Finnish authorities in April and extradited to Chicago. The Justice Department’s release on his case describes it as “part of Operation Riptide.” That arrest predates Riptide’s stated June launch by two months.
The actual question
That timing gap is the more useful thread than the one this column originally pulled. The FBI describes Riptide as an umbrella campaign that coordinated 13 separate operations over 60 days. DOJ’s own language ties Stokes’s case to Riptide, but nothing in the public record confirms his April arrest is specifically among the 200-plus counted in Patel’s total. If it is, the Bureau’s public numbers are doing some aggregation work that isn’t visible from the press materials alone — folding pre-existing casework into a 60-day headline. That’s not unusual for a campaign built to roll up multiple operations under one banner. It does mean “200+ arrests in 60 days” and “200+ arrests across 13 operations, some predating the 60-day window” are different claims, and the FBI hasn’t said which one it’s making.
“It does mean ‘200+ arrests in 60 days’ and ‘200+ arrests across 13 operations, some predating the 60-day window’ are different claims.”
The same testimony that repeated the 200-arrest figure also states that the FBI has made 152 cyber arrests so far in 2026 overall — a separate, year-to-date total, cited two paragraphs apart from the Riptide figure in the same document. On its face, a 60-day campaign crediting itself with more arrests than the Bureau’s full-year cyber-arrest count sounds contradictory. It likely isn’t: Riptide’s 200-plus almost certainly includes arrests made by domestic and international partner agencies, not just the FBI’s own cyber program. But that’s exactly the distinction the Bureau’s materials don’t spell out, and it’s a cleaner discrepancy than the dollar-figure rounding — both numbers come from the same document, on the same day, from the same director.
“On its face, a 60-day campaign crediting itself with more arrests than the Bureau’s full-year cyber-arrest count sounds contradictory.”
The financial figures raise a related question. “Froze or seized” and “initiated the return of” are two different legal postures — one is enforcement action against assets, the other is the start of a process that may or may not result in money actually reaching victims. Collapsing both into “$50 million in seized cryptocurrency and virtual assets” tells readers less than the August and September breakdowns did.
None of this amounts to the FBI fabricating results. It amounts to a federal agency compressing a multi-operation, multi-month, multi-agency effort into a handful of round numbers, and the compression is where the real accountability questions live.
“The compression is where the real accountability questions live.”
The scale question still stands
The FBI says Americans reported more than $20 billion in cybercrime losses last year. Even at the higher $54 million figure, that’s roughly a quarter of one percent of that total — useful context, not a knock on the operation itself. The Outsider Enterprise takedown, one of Riptide’s component actions, illustrates why dollar totals alone are a thin measure of impact: the FBI linked that single China-based phishing platform to roughly 3.87 million stolen credit cards and an estimated $1.9 billion in losses over three years, while the seizure itself recovered only about $100,000 in cryptocurrency. The value of that action was dismantling infrastructure — roughly 9,000 phishing sites and over a million fraudulent URLs — not the dollar figure attached to it. It’s worth holding “no safe harbor” against the reality that extradition ultimately depends on international cooperation. The test of that claim isn’t the jurisdictions that hand suspects over — it’s the ones that don’t.
“The test of that claim isn’t the jurisdictions that hand suspects over — it’s the ones that don’t.”
Five Questions for the FBI
The questions that need to be asked of the FBI:
- Of the 200+ arrests credited to Operation Riptide, how many occurred during the stated 60-day window (June–August), and how many were made earlier in investigations later folded into the campaign’s totals? Was Peter Stokes’s April arrest counted among the 200-plus?
- Can the Bureau provide a breakdown of the 13 component operations that fed into Riptide’s final totals, including which agency made each arrest?
- What accounts for the gap between the $23 million/$31 million figures cited in August and September testimony and the “$50 million” figure in the September 23 graphic?
- Of the financial total, how much represents assets already forfeited or returned to victims, versus assets frozen or pending forfeiture proceedings?
- Director Patel’s September 15 testimony credits Riptide with 200+ arrests while separately citing 152 total FBI cyber arrests for 2026 to date. How many of Riptide’s 200-plus arrests were made by the FBI directly, versus domestic or international partner agencies?
Sources: FBI, “Operation Riptide: A Look Back” (fbi.gov video repository), Aug. 15, 2026; Kash Patel, statement to the Senate Judiciary Committee, Sept. 15, 2026; Fox News Digital, “FBI wraps up cybercrime operation targeting global networks preying on Americans,” Aug. 26, 2026; U.S. Department of Justice, Office of Public Affairs, “Alleged Member of Criminal Cyber Hacking Group ‘Scattered Spider’ Arrested in Finland and Extradited to the United States,” July 1, 2026; CyberScoop and SecurityWeek reporting on the Outsider Enterprise takedown, June 2026; FBI post on X, Sept. 23, 2026.
Keep This Reporting Free
If this work matters to you, please consider supporting it.
Your contribution helps fund independent reporting across our entire network.
Discover more from RIPTIDE
Subscribe to get the latest posts sent to your email.
