U.S. Seizes Crypto Domains Tied to $800M Laundering Scheme, Two Russians Charged

Two Russian men face U.S. charges after a massive $800 million crypto laundering network was brought down, sending shockwaves across the digital underworld.

Sergey Ivanov and Timur Shakhmametov, both Russian nationals, have been charged with conducting money laundering operations that catered to cyber criminals through cryptocurrency, United States authorities stated on Thursday. The U.S. Department of State has already announced a $10 million reward each for information leading to Ivanov and Shakhmametov’s arrests.

U.S. authorities also took down websites linked to illegal crypto exchanges, described as a “coordinated international effort” including authorities in Germany, Latvia, Netherlands, the UK, Europol, and several U.S. agencies. The websites are associated with Russian-based payment and exchange platforms PinPays, PM2BTC, UAPS, and Cryptex.net. 

Cryptex.net alone processed “37,500 transactions” worth $1.4 billion. The exchange used to advertise in Russian despite being registered in St. Vincent and the Grenadines. On the other hand, PM2BTC is said to handle the revenues of ransomware attacks and other illegal operations.

According to FinCEN, half of its activities involve illicit operations. According to Chainalysis, PM2BTC uses the same wallet infrastructure as the Universal Anonymous Payment System (UAPS), an underground payment processing system.

In a statement on US support for Ukraine, US President Joe Biden said, “To counter Russian sanctions evasion and money laundering, the Department of Justice, the Department of the Treasury, and the US Secret Service have taken action today to disrupt a global cryptocurrency network, in coordination with international partners.”

What Did Ivanov and Shakhmametov Do?

Ivanov completed transactions worth around $1.15 billion in the last 11 years. He was charged with one count of conspiracy to commit bank fraud for providing payment processing services to the carding website Rescator and conspiracy to commit money laundering for the carding website Joker’s Stash. “Carding” is the unauthorized use of stolen debit and credit card data for illicit uses.

Shakhmametov, also known online as “JokerStash” and “Vega,” was charged with the same offenses as Ivanov. He’s also charged with one count of conspiracy to engage in access device fraud for his role in running the carding website Joker’s Stash, which sold data from 40 million payment cards each year.

“The two Russian nationals charged today allegedly pocketed millions of dollars from prolific money laundering and fueled a network of cybercriminals around the world, with Ivanov allegedly facilitating darknet drug traffickers and ransomware operators,” according to U.S. Deputy Attorney General Lisa Monaco.

OFAC’s Battle Against Russian Crypto Networks

The US Treasury’s Office of Foreign Assets Control (OFAC) regulations essentially prohibit US citizens from engaging with designated businesses within the country. Financial institutions and others must follow these sanctions to avoid dire consequences. Engaging with the sanctioned parties through transactions can have serious implications.

Earlier this year, OFAC imposed sanctions on 13 organizations and two individuals suspected of developing cryptocurrency services that might assist Russian nationals in evading international sanctions. These actions were aimed at limiting Russia’s capacity to use international financial networks in light of its hostility toward Ukraine.

OFAC also identified B-Crypto, Bitpapa, Crypto Explorer, Netex 24, and Tokentrust Holdings as newly designated entities operating blockchain services in Russia. It claims that Bitpapa and Netex24 used digital currency to transact with regulated banks, cryptocurrency exchanges, and darknet markets.

Separately, Chainalysis published a blog detailing the sanctioned businesses’ activities. According to the investigation, Netex24 and Bitpapa reportedly facilitated transactions for various pro-Russian militias and propaganda groups. These include the OFAC-designated militia group MOO Veche. According to Chainalysis, the entities operate from Crimea, Donetsk, and Luhansk in Ukraine.