The most notorious Bitcoin money laundering case in history, new recordings reveal Russian agents seized BTC-e’s $450 million in cryptocurrency

BTC-e was described as “one of the world’s largest and most widely used digital currency exchanges” when it was seized by U.S. law enforcement in 2017. It was also one of the most notorious.

Billions of dollars in Bitcoin and other digital currencies have flowed through BTC-e since it was founded six years ago. But that was before one of its alleged founders, Aleksandr Vinnik, was arrested on a Greek beach in 2017 on a U.S. warrant. The following year, special counsel Robert Mueller made public evidence of how Russian military intelligence used Bitcoin transactions to cover up interference in the 2016 U.S. presidential election.

Aleksandr Vinnik

Earlier this month, new insight into the shadowy world of cryptocurrency was shed in a BBC Russian Service report that provided more evidence of how intertwined Russian spy agencies are with bitcoin exchanges like BTC-e.

“At the very least, cybercriminals frequently use BTC-e to launder money, so it’s natural that Russian intelligence would also source hard-to-trace funds,” said Kim Nilsson, a Tokyo-based programmer known for helping to solve a massive bitcoin theft tied to BTC-e.

“Russia’s particular interest in Vinnik’s extradition could indicate that some important high-level figure may have had access to BTC-e, if not Russian intelligence services themselves,” Nilsson told RFE/RL.

BTC-e, a large online marketplace for buying and selling bitcoin and other cryptocurrencies, attracted the attention of researchers, analysts and law enforcement officials even two years before it was seized by the United States.

Founded and run by Vinnik and partner Aleksandr Bilyuchenko since its inception in 2011, BTC-e’s business model relies heavily on the criminal underworld and people and entities interested in anonymous or hard-to-trace transactions.

Its website states that BTC-e is based in Bulgaria, but it is also located in Cyprus and the Seychelles.

One researcher who tracks blockchain transactions (essentially the underlying technology that makes cryptocurrencies work) estimated that as of 2016, as much as 70% of all cryptocurrency crime cases worldwide involved BTC-e.

That included the theft of about $400 million in cryptocurrency (at then-current prices) from Mt. Gox, a much larger, older cryptocurrency exchange based in Tokyo. The Mt. Gox theft, uncovered primarily by Nilsson and his colleagues in 2014, was the largest theft involving cryptocurrency to date and led to the collapse of Mt. Gox.

Investigators later discovered that BTC-e processed transactions with stolen funds from Mt. Gox between 2011 and 2014.

Three years after the collapse of Mt. Gox, Vinnik was arrested on a beach in Greece, where he was vacationing with his family, on July 24, 2017. When Vinnik was detained by U.S. agents, he was charged with 21 counts of money laundering and other related charges, and logged into his BTC-e account via his mobile phone.

Vinnik, 39, is known as the mastermind of an international money laundering scheme that processed more than $4 billion in cryptocurrency transactions, including bitcoin from Mt. Gox, according to the U.S. Department of Justice.

After his arrest and the cancellation of the U.S. extradition warrant, Russia filed a court order in Greece seeking to have Vinnik returned to Russia, where he is reportedly facing charges in a number of small-scale fraud cases. EAT, France later filed its own extradition warrant as well.

Two years after his arrest, on July 25, 2019, U.S. prosecutors filed another lawsuit against Vinnik and BTC-e to seize approximately $100 million from frozen BTC-e accounts for alleged violations of U.S. banking laws.

At the time of writing, Vinnik remains in a Greek prison, awaiting a final ruling from Greek authorities on where to send him.

“The perceived anonymity of cryptocurrency”

On July 13, 2018, nearly a year after Vinnik’s arrest, the first of two U.S. indictments was unsealed, charging 12 officers from Russia’s military intelligence with conspiracy to interfere in the U.S. political system in 2016, among other efforts. The first was brought by White House special counsel Robert Mueller. The second was issued in October by U.S. prosecutors in Pennsylvania.

The indictment contains, among other things, precise identifying information about the Russian intelligence agency GRU allegedly involved, including a group of hackers informally known as Fancy Bear.

“To facilitate the purchase of infrastructure used in the hacking activities, the defendants conspired to launder more than $95,000 in cash through online transactions designed to exploit the anonymity of cryptocurrencies such as Bitcoin,” prosecutors wrote.

The indictment also provides detailed information about Bitcoin transactions allegedly used by the agents.

Tom Robinson, a scientist at London-based research firm Elliptic Enterprises, examined specific transactions and concluded in a report released 11 days after the first indictment that there were close ties between GRU agents and BTC-e.

However, he did not draw a direct connection.

BTC-e’s successor

Within days of BTC-e’s closure, a new Russia-based cryptocurrency exchange was launched, spearheaded by one of Vinnik’s partners at BTC-e, Bilyuchenko, and also involved with Dmitry Vasilyev, another frequent crypto trader at BTC-e.

Like BTC-e, the exchange, called Wex, processed hundreds of millions of dollars in digital currency transactions.

According to BBC Russia, the exchange closed after around $400 million in cryptocurrency disappeared from the exchange in early 2018, just a few months after its launch. Russian Wex users who were unable to access their Wex complained to Russian law enforcement.

Before Wex shut down, Bilyuchenko and Vasilyev had been looking for investors and customers who could help stabilize the exchange and provide some kind of protection from Russian security agencies, a common business practice known as “roofing.”

Among those Bilyuchenko and Vasilyev approached was Konstantin Malofeyev, a wealthy Russian businessman known for his ties to the Kremlin and his advocacy for conservative and nationalist causes, the BBC reported. The United States imposed financial sanctions on Malofeyev in 2014 for his support for Russia-backed separatists fighting in eastern Ukraine.

Bilyuchenko later testified to police investigators that he had been contacted by officers from Russia's main domestic spy agency, the Federal Security Service (FSB), while the negotiations with Malofeyev were ongoing.

In April 2018, Bilyuchenko testified that a man named Anton demanded that he hand over assets from the cryptocurrency exchange Wex, who said the cryptocurrency would be “transferred to an account at the Russian FSB.” Bilyuchenko later stated that he was imprisoned until he agreed to transfer $450 million in cryptocurrency.

The BBC also released an audio recording of a telephone conversation allegedly between Bilyuchenko and Malofeyev in the summer of 2018. In the recording, a person believed to be Malofeyev accused Bilyuchenko of not transferring some of the funds.

“Everyone involved in this process was very suspicious that you had more [funds] than were invested in the exchange. The fact that you were tied up with BTC-e was obvious, but the funds on BTC-e far exceeded those on Wex.”

The man in the recording said, "Because I said you were mine, I was always responsible for you."

The whereabouts of neither Vasliyev nor Bilyuchenko could be immediately determined.

According to the BBC, Vasliyev sold his shares in Wex to a man known among the Russian-backed militias in eastern Ukraine in late 2018. Vasliyev was arrested in Italy in July 2019, though he was released that same month.

An email sent to the press service of Malofeyev's main investment firm, Marshall Capital, was not immediately responded to.

Isn't it just money laundering?

Over the years, researchers and analysts have concluded that both Russian spy agencies, the FSB and the GRU, are exploiting cryptocurrencies and the services provided by their exchanges to finance their operations.

Currently, at least publicly, there is little incriminating evidence that directly reveals the flow of funds, which has aroused great interest from US intelligence agencies.

Tim Cotten, a Washington, D.C.-based researcher, said there are signs that U.S. authorities have far more intelligence on cryptocurrency trading than the 2018 indictment suggested.

“There is no doubt that as the owner of the seized BTC-e, the U.S. government has far more data than could ever be gleaned from simple blockchain analysis: where, when, and who spent the funds,” he wrote in an April 2019 blog post.

Cotten did not respond to an email seeking further comment.

“We’ve all seen indications from the U.S. intelligence community that Russian intelligence operatives are well-versed in the use of cryptocurrencies in their operations, so it wouldn’t be surprising if they were involved as well,” Nilsson noted.

Court documents in Vinnik’s case suggest that one reason the legal fight for extradition has been so arduous may be because of his potential value as an intelligence asset — able to provide details about BTC-e’s inner workings and the agencies’ use of it.

Louis Goddard, a data investigator at London-based corruption watchdog Global Witness, recently published a report exposing a London financial firm’s ties to BTC-e. The author of the report said he had not seen evidence that BTC-e’s alleged operators had ties to Russia.

But "the lengths that have been reached on both sides in Aleksandr Vinnik's extradition battle — including separate criminal and civil lawsuits in the United States and reports that Vladimir Putin himself had lobbied the Greek government — raise questions about whether this case is about more than money laundering," Goddard told RFE/RL.