The Department of Justice (DOJ) charged two Russian nationals affiliated with a billion-dollar money laundering operation on Thursday.
Sergey Ivanov was charged with one count of conspiracy to commit bank fraud to support a website where stolen credit card information is trafficked.
He’s also charged with one count of money laundering for another website that deals in carding.
The DOJ defines carding as the unlawful acquisition of credit card details for fraudulent purposes.
Ivanov allegedly operated as a cyber-money launderer catering to hackers, ransomware groups, and the cybercrime marketplace for two decades.
He’s accused of working with hackers who are responsible for data breaches in multiple U.S. companies.
“Cryptocurrency blockchain analysis revealed that between July 12, 2013, and Aug. 10, cryptocurrency addresses associated with Ivanov’s alleged money laundering services conducted transactions totaling approximately $1.15 billion in value,” the DOJ said. “Approximately 32 percent of all traced bitcoin sent to these addresses originated from other cryptocurrency addresses associated with criminal activity.”
More than $158 million in bitcoin from alleged fraudulent funds went into Ivanov’s address, while more than $8.8 million came from alleged ransomware payments.
Approximately $4.7 million allegedly came from the drug market found within the darknet, the DOJ said.
Timur Shakhmametov, known online as “JokerStash,” was charged with one count of conspiracy to commit bank fraud, one count of access device fraud, and one count of money laundering.
“Joker’s Stash offered for sale data from approximately 40 million payment cards annually, totaling hundreds of millions of payment cards overall, and was one of the largest known carding markets in history,” the DOJ said. “Estimates of its profits range from $280 million to more than $1 billion.”
Disrupting Cybercriminals
Deputy Attorney General Lisa Monaco said the charges reflect the DOJ’s commitment to disrupting the ecosystem of “malicious cyber actors.”“The two Russian nationals charged today allegedly pocketed millions of dollars from prolific money laundering and fueled a network of cybercriminals around the world, with Ivanov allegedly facilitating darknet drug traffickers and ransomware operators,” she said, adding that the DOJ also shut down a website platforming illegal cryptocurrency exchange, resulting in the recovery of “millions of dollars in cryptocurrency.”
The website, Cryptex, allowed users to log in anonymously and “advertised itself directly to cyber criminals.”
The DOJ reported more than 37,500 bitcoin transactions on the website amounting to 62,586 in bitcoin, or $1.4 billion in U.S. currency.
Of that amount, the DOJ said that 31 percent of the bitcoin—or $441 million—came from addresses associated with cybercrimes.
This included $297 million in fraud and $115 million in ransomware payments.
The 9 percent in bitcoin sent to Cryptex, or $162 million, came from addresses associated with cyber crimes, while 28 percent sent from Cryptex was sent to darknet markets sanctioned by the United States, the DOJ said.
“The seizure of these domains by the government will prevent the owners and third parties from using the sites for money laundering,” the DOJ said. “Individuals visiting those sites now will see a message indicating that the site has been seized by the federal government.”
In coordination with the DOJ, the U.S. Department of State issued a reward of up to $10 million each for information that could lead to the arrest of Ivanov, Shakhmametov, and other co-conspirators.
“These actions are part of a coordinated international effort to disrupt Russian cybercrime services and are being taken in conjunction with actions by other U.S. government agencies and international law enforcement partners,” the Department of State said.
