Treasury Bars Transfers With Crypto Exchange Linked to Sanctioned Russian Financing

The Treasury Department last week issued an order barring certain funds transfers involving a Hong Kong-registered cryptocurrency exchange due to its ties to illicit Russian financing. The order, which is the first issued under new authority granted to the Financial Crimes Enforcement Network under the Combating Russian Money Laundering Act, prohibits “certain transmittals of funds” involving Bitzlato by a range of financial institutions.

FinCEN’s order labels the crypto exchange a “primary money laundering concern,” adding that Bitzlato “plays a critical role” in laundering virtual currency for Russian ransomware criminals, including the darknet market Hydra, sanctioned by Treasury last year (see 2204060081). Bitzlato also has other “significant connections” to Russia, FinCEN said in an order, including allowing transfers in rubles to or from bank accounts with Sberbank, the sanctioned and state-owned Russian financial services company.

“Bitzlato poses a global threat by allowing Russian cybercriminals and ransomware actors to launder the proceeds of their theft,” FinCEN acting Director Himamauli Das said. Das said the agency “will continue to leverage the full range of our authorities to prohibit these institutions from gaining access to the U.S. financial system and using it to support Russian illicit finance.”

The order, effective Feb. 1, bars covered financial sanctions from “engaging in a transmittal of funds from or to Bitzlato, or from or to any account or [convertible virtual currency] address administered by or on behalf of Bitzlato,” FinCEN said. Along with the order, DOJ last week charged Anatoly Legkodymov, a Russian national and Bitzlato senior executive, with operating a “money transmitting business that transported and transmitted illicit funds” and failed to meet anti-money laundering requirements.

Bitzlato couldn’t be reached for comment -- its website last week was replaced by a notice saying French authorities seized the service "as part of a coordinated international law enforcement action. Treasury said the company has previously denied that it worked with any ransomware criminals.

FinCEN also said Bitzlato has facilitated transactions involving Chatex, the virtual currency exchange sanctioned by Treasury in 2021 for processing ransomware-related transactions (see 2111080041). The agency said it used blockchain analysis to find that “76 Bitzlato deposit addresses received bitcoin (BTC) worth over $300,000 attributed to Chatex.”

During its investigation, FinCEN found that Bitzlato took “few meaningful steps to identify and disrupt illicit use and abuse of its services.” The exchange doesn’t “effectively implement policies and procedures designed to combat money laundering and illicit finance, and has advertised a lack of such policies, procedures, or internal controls,” FinCEN said, adding that it “facilitates a substantially greater proportion of money laundering activity” relating to illegal Russian finance “compared to other virtual currency exchanges.”

The agency also noted that Bitzlato continued to facilitate transactions in Russian darknet markets “even after public action” and sanctions targeting those markets. This “further illustrates its ongoing engagement with illicit actors and lack of adequate controls,” FinCEN said.

Most of the ransomware reports FinCEN received in the second half of 2021 were “conducted by Russia-related ransomware variants," Treasury Deputy Secretary Wally Adeyemo said. He called Russia a "haven for cybercriminals," adding that Bitzlato is "part of a larger ecosystem of cybercriminals" allowed to "operate with impunity" within the country. "At a time when Russia is waging a brutal and unjust war in Ukraine, and as it seeks to circumvent sanctions and governance controls to fill its coffers and sustain its violence," Adeyemo said, "we have no tolerance for criminal enterprises enriching Russia’s malicious interests."

FinCEN also named Binance, the world's largest crypto exchange by trading volume, as one of Bitzlato’s “top three receiving counterparties.” A Binance spokesperson told CoinDesk it’s “pleased to have provided substantial assistance to international law enforcement partners in support of this investigation.”