On March 25, 2024, the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned twelve entities and two individuals for helping to build or operate blockchain-based services to facilitate potential sanctions evasion on behalf of Russian nationals. Five of these entities were operated by OFAC-designated individuals.
In this blog, we’ll explore the activities of these entities, including an on-chain analysis of addresses we identified as associated with two of the businesses sanctioned: Netex24 and Bitpapa.
Who are the sanctioned entities and individuals and what did they do?
Most of the sanctioned entities and individuals are based in Russia and all of them are linked to Russia through the services they provided:
- Joint Stock Company B-Crypto worked with OFAC-designated Rosbank to support cross-border transactions in crypto.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Sistemy Raspredelennogo Reyestra (Masterchain) has agreements with several OFAC-designated Russian banks to issue digital currencies.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Laitkhaus issued and exchanged digital currencies to support several OFAC-designated banks.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Atomaiz tokenized diamonds and precious metals on behalf of Russian banks.
- Tokentrust Holdings Ltd. is Atomiaz’s majority shareholder.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Veb3 Tekhnologii provided blockchain-based services and platforms for the Russian financial sector, including sanctioned Russian banks.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Veb3 Integrator also provided blockchain-based services and platforms for the Russian financial sector, including sanctioned Russian banks.
- Igor Veniaminovich Kaigorodov is the majority shareholder for Veb3 Tekhnologii and Veb3 Integrator.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Tsentr Obrabotki Elektronnykh Platezhey (TOEP) is a digital currency exchange that operates under the names Netexchange and Netex24, and facilitated payments to OFAC-sanctioned banks including Sberbank and Alfa-Bank, as well as Hydra, the sanctioned darknet market.
- Timur Evgenyevich Bukanov is the owner and director of TOEP.
- Bitfingroup OÜ is an Estonia-based company likely controlled by Bukanov.
- Bitpapa IC FZC LLC is a peer-to-peer (P2P) exchange that facilitated millions in payments for OFAC-designated Russian cryptocurrency businesses, Garantex and Hydra.
- Crypto Explorer DMCC operates under the name AWEX as a digital currency exchange based in Russia and the UAE, offering crypto-to-fiat conversions for Russian rubles and UAE dirhams.
- Obshchestvo S Ogranichennoy Otvetstvennostyu Kripto Eksplorer (OOO Kripto Eksplorer) is owned by Crypto Explorer DMCC.
Analyzing the activity of Netex24 and Bitpapa
In its press release on their sanctions designations, OFAC notes that Netex24 and Bitpapa have a history of transacting with OFAC-sanctioned banks, cryptocurrency exchanges, and darknet markets by using cryptocurrency, therefore facilitating potential sanctions evasion for Russia’s financial infrastructure.
As we see in the screenshot below, Netex24 supports off-ramping to sanctioned Russian banks Tinkoff and Sberbank, as well as other similar organizations.
Although OFAC did not include any crypto addresses in its designations of Netex24 or Bitpapa, Chainalysis has identified clusters associated with both services. Over the last two years, on-chain data shows that both Netex24 and Bitpapa have facilitated significant sending of funds to sanctioned entities. Darknet markets also make up a significant volume of transaction history, in addition to exchanges without Know Your Customer (KYC) controls, many of which are Russian-language sites offering on and off ramping with sanctioned Russian banks. [1]
Value sent by Netex24 and Bitpapa to sanctioned entities and darknet markets has steadily increased since the start of Russia’s war in Ukraine, whereas value sent to exchanges without KYC guidelines and other illicit services has remained relatively flat.
We can see examples of some of this activity on the blockchain for both Netex24 and Bitpapa using Chainalysis Reactor. As highlighted in the OFAC designation, both entities transferred millions of dollars in cryptocurrency to Hydra and Garantex, and regularly interacted with Bitzlato.
In addition to facilitating transactions on behalf of larger sanctioned financial services and crypto entities, Netex24 and Bitpapa have also facilitated transactions for various pro-Russian militia and propaganda groups, including MOO Veche, an OFAC designated Russian militia group. All of these entities have been known to operate in the Donetsk, Luhansk, or Crimean regions of Ukraine.
OFAC’s continued efforts to combat Russia-based crypto crimes
As Brian E. Nelson, Under Secretary of the Treasury for Terrorism and Financial Intelligence, stated, “Russia is increasingly turning to alternative payment mechanisms to circumvent U.S. sanctions and continue to fund its war against Ukraine.” Based on this designation, sanctions evasion through utilization of cryptocurrency businesses to facilitate on- and off-ramp activities for sanctioned Russian banks appears to be a growing focus for OFAC. These efforts expand on an already extensive focus of the illicit Russian crypto ecosystem, which includes ransomware, darknet markets, militia groups, disinformation groups, and various other cybercrime actors.
We commend OFAC for its actions here and have labeled the relevant addresses as associated with Netex24 and Bitpapa in our product suite.
Endnotes:
[1] In the data presented in this blog, Hydra is included in the darknet market category rather than as a sanctioned entity.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.