Russia arrests US-sanctioned Cryptex founder and 95 other linked suspects

Russian law enforcement has arrested nearly 100 suspects linked to cryptocurrency exchange Cryptex, anonymous payment service UAPS and 33 other online services and platforms used to make illegal payments and sell stolen credentials.

After 148 raids, 96 individuals were arrested and charged with organizing and participating in a criminal organization, unlawful access to computer information, illegal payment processing and illegal banking activities.

“According to investigators, in 2013, defendants, who had knowledge in the field of banking, created a criminal community to commit crimes and personal enrichment,” said a press release from the Investigative Committee of the Russian Federation (ICR), the leading federal investigative authority in Russia.

“The accomplices carried out illegal activities in exchanging currencies and cryptocurrencies, delivering and accepting cash, and selling bank cards and personal accounts. The main customers of these services were cybercriminals and hackers who used them to legitimize their criminal income.”

Interior Ministry Irina Volk told Interfax that “the defendants issued bank cards and provided access to transactions through a personal online account.”

Russian investigators found that the criminal network’s services alone processed more than 112 billion rubles (just over $1.1 billion) in 2023, generating 3.7 billion rubles (about $38.7 million) in illegal revenue for the people involved.

According to ICR spokesperson Svetlana Petrenko, the assets seized during this operation included more than 1.5 billion rubles, Robinson helicopters, luxury vehicles (including cars from Bentley, Rolls Royce, Porsche and Tesla Cybertruck), boats and snowmobiles.

The US-sanctioned founder of Cryptex was also arrested

As sources in Russian law enforcement agencies told Interfax, one of the main suspects arrested in this week’s operation is Russian money launderer Sergey Ivanov (also known by his online name ‘Taleon’), who was sanctioned by the Office of Foreign Assets of the US Treasury Department. Control (OFAC) last week.

The Treasury Department believes that Ivanov’s UAPS, PinPays, and PM2BTC services have helped process hundreds of millions of dollars for ransomware actors, darknet marketplace vendors, initial access brokers, and other threat actors over the past two decades .

Ivanov and his associate Timur Shakhmametov (also known as JokerStash and Vega) were also charged by the Justice Department with money laundering, bank fraud and running multiple websites that sell stolen credit card information and personal information.

According to the US DOJ, Shakhmametov was an operator of Joker’s Stash, one of the largest online card marketplaces that posted profits of up to $1 billion between 2014 and 2021, when it closed.

The U.S. Department of State is also now offering a reward of up to $11 million through its Transnational Organized Crime Rewards Program for information that could help capture or convict Ivanov and Timur Shakhmametov.

Last week, Dutch authorities seized PM2BTC and Cryptex servers and more than $7 million worth of cryptocurrency, while German law enforcement seized 47 cryptocurrency exchange platforms used to launder money for cybercriminals, including ransomware gangs .