On March 25, 2024, the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned twelve entities and two individuals for their involvement in developing or operating blockchain-based services aimed at potentially evading sanctions on behalf of Russian nationals. Among these entities, five were operated by individuals designated by OFAC.

The sanctioned entities and individuals, predominantly based in Russia, have been linked to the country through the services they provided:

Joint Stock Company B-Crypto collaborated with OFAC-designated Rosbank to facilitate cross-border crypto transactions.

• Obshchestvo S Ogranichennoy Otvetstvennostyu Sistemy Raspredelennogo Reyestra (Masterchain) established agreements with several OFAC-designated Russian banks for digital currency issuance.
• Obshchestvo S Ogranichennoy Otvetstvennostyu Laitkhaus issued and exchanged digital currencies to support OFAC-designated banks.
• Obshchestvo S Ogranichennoy Otvetstvennostyu Atomaiz tokenized diamonds and precious metals for Russian banks.
• Tokentrust Holdings Ltd. holds the majority share in Atomiaz.
• Obshchestvo S Ogranichennoy Otvetstvennostyu Veb3 Tekhnologii provided blockchain services to the Russian financial sector, including sanctioned banks.
• Obshchestvo S Ogranichennoy Otvetstvennostyu Veb3 Integrator also provided blockchain services to the Russian financial sector, including sanctioned banks.
• Igor Veniaminovich Kaigorodov holds the majority share in Veb3 Tekhnologii and Veb3 Integrator.
• Obshchestvo S Ogranichennoy Otvetstvennostyu Tsentr Obrabotki Elektronnykh Platezhey (TOEP) operated digital currency exchanges such as Netexchange and Netex24, facilitating payments to OFAC-sanctioned banks and Hydra, a sanctioned darknet market.
• Timur Evgenyevich Bukanov owns and directs TOEP.
• Bitfingroup OÜ, an Estonia-based company, is likely controlled by Bukanov.
• Bitpapa IC FZC LLC is a peer-to-peer exchange that facilitated substantial payments for OFAC-designated Russian cryptocurrency businesses, Garantex, and Hydra.
• Crypto Explorer DMCC operates as AWEX, a digital currency exchange in Russia and the UAE, offering crypto-to-fiat conversions for Russian rubles and UAE dirhams.
• Obshchestvo S Ogranichennoy Otvetstvennostyu Kripto Eksplorer (OOO Kripto Eksplorer) is owned by Crypto Explorer DMCC.

According to OFAC’s press release on the sanctions, Netex24 and Bitpapa have a history of transacting with sanctioned Russian banks, cryptocurrency exchanges, and darknet markets using cryptocurrency, potentially facilitating sanctions evasion for Russia’s financial infrastructure.

Although OFAC did not include any crypto addresses in its designations of Netex24 or Bitpapa, Chainalysis has identified clusters associated with both services. Over the past two years, on-chain data reveals that both Netex24 and Bitpapa have facilitated significant fund transfers to sanctioned entities and darknet markets. Additionally, exchanges without Know Your Customer (KYC) controls, many of which are Russian-language sites offering on and off-ramping with sanctioned Russian banks, constitute a significant portion of their transaction history.

The value sent by Netex24 and Bitpapa to sanctioned entities and darknet markets has shown a steady increase since the onset of Russia’s conflict in Ukraine, while transactions to exchanges without KYC guidelines and other illicit services have remained relatively stable.

Activities observed on the blockchain for both Netex24 and Bitpapa using Chainalysis Reactor include transferring millions of dollars in cryptocurrency to Hydra and Garantex, as well as frequent interactions with Bitzlato, as highlighted in the OFAC designation.

In addition to facilitating transactions for larger sanctioned financial services and crypto entities, Netex24 and Bitpapa have also facilitated transactions for various pro-Russian militia and propaganda groups, including MOO Veche, an OFAC-designated Russian militia group, known to operate in the Donetsk, Luhansk, or Crimean regions of Ukraine.

Brian E. Nelson, Under Secretary of the Treasury for Terrorism and Financial Intelligence, emphasized Russia’s increasing reliance on alternative payment mechanisms to circumvent U.S. sanctions and continue funding its war against Ukraine. OFAC’s focus on sanctions evasion through cryptocurrency businesses facilitating on- and off-ramp activities for sanctioned Russian banks indicates a growing concern. These efforts complement existing efforts to address the extensive illicit Russian crypto ecosystem, which includes ransomware, darknet markets, militia groups, disinformation groups, and various other cybercrime actors.

OFAC’s actions have been commended, and the relevant addresses associated with Netex24 and Bitpapa have been flagged in Chainalysis’s product suite.