Loading story…
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services Cryptex and PM2BTC, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a primary money laundering concern and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to $10 million for information on Ivanov.
The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted Hydra Market and the exchange Garantex. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than $100 million tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities unsealed an indictment charging Sergey Sergeevich Ivanov and Timur Shakhmametov in connection with operating major money laundering services used by cybercriminals. The case was announced alongside Treasury sanctions and other coordinated disruption measures.
The U.S. State Department announced a reward of up to $10 million for information on Sergey Ivanov in connection with the cybercrime-enabling financial services case. The offer accompanied Treasury sanctions and related law enforcement actions.
In coordination with Treasury's actions, the U.S. Secret Service, Netherlands Police, and Dutch FIOD carried out seizures targeting infrastructure associated with the illicit Russian virtual currency services. The operation formed part of a broader multinational disruption effort.
The U.S. Treasury announced coordinated actions against Russian cybercrime-enabling financial services, with FinCEN designating PM2BTC as a primary money laundering concern and OFAC sanctioning Cryptex and Sergey Sergeevich Ivanov. The measures were described as aimed at disrupting ransomware proceeds, sanctions evasion, and other illicit cyber-enabled finance.
The U.S. Treasury sanctioned Hydra Market and the Russia-based virtual currency exchange Garantex as part of a multinational action against Russian cybercrime infrastructure. German authorities also shut down Hydra's servers in Germany and seized about $25 million in bitcoin.
Estonian authorities terminated Garantex's license after identifying critical anti-money-laundering and counter-terrorist-financing deficiencies. Treasury later said the exchange continued operating despite losing the license.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcehome.treasury.gov
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury sanctioned **First VPN Service** (`1VPNS`), its alleged Ukrainian administrator **Dmytro Rashevskyi**, and Belarusian cryptor seller **Yevgeniy Vladimirovich Silayev** for allegedly supporting ransomware and other cybercriminal activity. Officials said `1VPNS` provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect. The sanctions, issued under **Executive Order 14390** and **E.O. 13694** as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of `1VPNS` infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including **Anubis**, **Qilin**, and **Sinobi Group** to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.
Jul 14, 2026
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Jun 29, 2026
U.S. authorities charged alleged **Sodinokibi/REvil** operators Yaroslav Vasinskyi of Ukraine and Yevgeniy Polyanin of Russia over ransomware attacks that included the compromise of Kaseya's remote management software, an intrusion that cascaded to managed service providers and their customers worldwide. The Kaseya incident was reported to have affected as many as **1,500 organizations**, with attackers allegedly encrypting systems, leaving ransom notes, and directing victims to Tor-based or public payment sites to obtain decryption keys; victims that did not pay were allegedly threatened with the publication or sale of stolen data. The Justice Department said Vasinskyi was arrested in Poland, later extradited to the United States, and arraigned in Texas on charges including conspiracy to commit computer fraud, damage to protected computers, and money laundering conspiracy. In parallel, U.S. authorities seized **$6.1 million** in alleged ransom proceeds tied to Polyanin, part of a broader multinational enforcement effort involving the FBI, Europol, Eurojust, and law enforcement partners across Europe and other allied countries to disrupt the REvil ransomware operation linked to the Kaseya attack.
Jun 29, 2026