US Sanctions Two Crypto Exchanges for Facilitating Cybercrime and Money Laundering

The US government on Thursday sanctioned two cryptocurrency exchanges and opened charges against a Russian citizen for his alleged involvement in the operation of several money laundering services offered to cybercriminals.

It is alleged that the virtual currency exchanges, Cryptex and PM2BTC, facilitate the laundering of cryptocurrencies that may have been obtained through cybercrime.

The coordinated action was carried out in collaboration with the Dutch police and the Dutch Fiscal Intelligence and Investigation Service (FIOD) as part of an ongoing crackdown on law enforcement, dubbed Operation Endgame.

As a result of the exercise, the websites associated with both exchanges have been confiscated and replaced with a banner for seizure by law enforcement. Furthermore, it has led to the seizure of cryptocurrency worth €7 million ($7.8 million).

“The United States and our international partners remain resolute in our commitment to prevent cybercrime enablers like PM2BTC and Cryptex from operating with impunity,” said Bradley T. Smith, Acting Under Secretary of the Treasury Department for Terrorism and Financial Intelligence.

“The Treasury Department, in close cooperation with our allies and partners, will continue to use all tools and authorities to disrupt the networks that seek to leverage the virtual asset ecosystem to facilitate their illicit activities.”

PM2BTC (“btc2pm(.)me”), according to the Ministry of Finance, facilitated the laundering of convertible virtual currencies (CVC) linked to ransomware and other illegal actors operating in Russia. It has been operational since 2014.

It is also said to have provided direct CVC to ruble exchange services but failed to implement effective anti-money laundering (AML) and Know Your Customer (KYC) programs as required by US federal law.

“PM2BTC facilitates a significantly higher share of transactions with clear links to money laundering activities linked to Russian illicit financing, compared to 99 percent of other virtual asset service providers,” the report said. “PM2BTC uses an unusual obfuscation that prevents the attribution of transactions to illegal activities and actors.”

Cryptex (“Cryptex(.)net”) has similarly been accused of advertising virtual currency services directly to cybercriminals, receiving more than $51.2 million in illegal proceeds from ransomware attacks. It further claimed “complete anonymity” when registering for an account.

It is also estimated to have received no less than $720 million in transactions related to illegal services used by Russia-based ransomware actors and cybercriminals, including fraud shops, mixing services, exchanges without KYC programs and the now-sanctioned virtual currency exchange Garantex.

A 44-year-old Russian citizen, Sergey Sergeyevich Ivanov (also known as UAPS or TALEON), has been indicted for almost two decades for his role as a professional cyber money launderer and for providing his services, including Cryptex and PM2BTC, to other e-crime groups and drug traffickers.

Ivanov’s other charges include assisting in the processing of payments to the card website Rescator and laundering illegal funds originating from Joker’s Stash, another popular card forum that voluntarily ceased operations in February 2021.

Two such payment processing services are PinPays and UAPS (“uaps(.)so”), which stands for Universal Anonymous Payment System and has facilitated payments for several fraud shops such as Genesis Market, BriansClub/Brian Dumps and Faceless, per Chainalysis.

“UAPS and Cryptex have processed more than $7.5 billion in transactions since their inception in 2013 and 2018, respectively,” the blockchain analytics firm said.

Elliptic, another blockchain intelligence firm, said it is aware of “thousands of additional addresses” linked to Cryptex, PM2BTC, PinPays and Joker’s Stash, beyond the four cryptoasset addresses listed as linked by the Treasury Department to Cryptex.

A second Russian, Timur Shakhmametov, 38, has also been charged with operating Joker’s Stash and laundering its proceeds. The card marketplace, which offered data from almost 40 million payment cards for sale every year. The agency is believed to have earned the threat actors anywhere from $280 million to more than $1 billion in profits.

Coinciding with the actions, the US State Department announced rewards of up to $10 million each for information leading to the arrests and/or convictions of Timur Shakhmametov and Sergey Ivanov.

There is also another $1 million up for grabs for providing information leading to the identification of other key members connected to UAPS, PM2BTC, PinPays and Joker’s Stash.

“One of the most critical tactics in disrupting illicit actors is disrupting the infrastructure they abuse to facilitate money laundering and other transnational cybercrime,” Chainalysis said.

“Today’s actions represent the Office of Foreign Assets Control’s continued efforts to work with key international partners to make the Internet more secure by disabling fraudulent services and the infrastructure that host them.”