US Charges 2 Russian Nationals in Crypto Money Laundering Scheme, Offers $10 Million Bounty

U.S. authorities have charged Russian citizens Sergey Sergeevich Ivanov and Timur Shakhmametov for allegedly operating a cryptocurrency money laundering service tied to Russian cybercrime.

The U.S. Department of State has issued a $10 million bounty for information leading to the arrest or conviction of each.

International Crackdown on Russian Cybercrime

The United States Treasury, in coordination with international partners, announced it had taken action to disrupt the operations of PM2BTC and Cryptex, two digital currency exchanges linked to large-scale money laundering operations benefiting ransomware actors and other cybercriminals operating out of Russia.

Its Financial Crimes Enforcement Network (FinCEN) has designated PM2BTC, associated with Ivanov, as a “primary money laundering concern.” Additionally, its Office of Foreign Assets Control (OFAC) has also sanctioned Ivanov and Cryptex for facilitating over $51 million in ransomware-related transactions and $720 million in connections to Russian cybercrime.

Ivanov has reportedly been involved in Russian cybercrime for over two decades and has allegedly laundered hundreds of millions of dollars through various payment processing services, including UAPS.

Cryptex, also operating primarily in Russia, has purportedly been involved in laundering funds for cybercriminals, including ransomware actors, fraud shops, and exchanges with poor compliance programs.

Law enforcement agencies, including the U.S. Secret Service, Netherlands Police, and the Dutch Fiscal Intelligence and Investigation Service (FIOD), have seized web domains and infrastructure tied to PM2BTC and Cryptex. The U.S. Secret Service and the  Attorney’s Office for the Eastern District of Virginia also unsealed an indictment against Ivanov and Shakhmametov.

The measures are intended to safeguard national security and the financial system by preventing illicit financial institutions from accessing its market. They are part of Operation Endgame, a multinational initiative aimed at dismantling cybercriminal financial enablers.

Sanctions Implications

OFAC’s sanctions block all property and interests of the two suspects within the United States and prohibit any person or entity domiciled in the country from engaging with them. On the other hand, FinCEN’s order prohibits financial institutions from engaging in transactions involving PM2BTC, with foreign financial institutions involved with the entities also risking sanctions.

Bradley T. Smith, acting Undersecretary of the Treasury for Terrorism and Financial Intelligence, commented on the situation, saying: “The United States and our international partners remain resolute in our commitment to prevent cybercrime facilitators like PM2BTC and Cryptex from operating with impunity.”

This latest round of legal implications is part of a broader U.S. effort to combat Russia-based cybercrime. Over the past year, the Treasury has sanctioned several individuals and groups involved in such activities.

These include members of the native hacktivist group Cyber Army of Russia Reborn, leaders of the LockBit ransomware group, and affiliates of the darknet market Genesis Market, which was taken down by law enforcement earlier in 2023.