I remember seeing "Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it" on HN earlier this year (https://news.ycombinator.com/item?id=30589489). Was this person lying?
There is no indication of what the charge was, and usually with hotlinking to an asset the legal issue is copyright infringement (which can be criminal as well as civil); that’s very different from suggesting that use of an API endpoint intended to be used by a public web frontend is a CFAA violation.