Global Witness urges UK authorities to investigate links between illicit crypto exchanges and Russian security services

Timothy Lloyd is a contributing writer for The Block. His work has also been featured in Thomson Reuters Regulatory Intelligence, the Organized Crime and Corruption Reporting Project, InSight Crime and the Wall Street Journal. He is based out of Austin, and he once played the Wu-Tang Clan's RZA to a draw in Chess.

---

Just days after an explosive BBC News Russian investigation exposed alleged extortion committed by Kremlin security services against the “shadow” administrator of notorious crypto exchanges BTC-e and World Exchange Services (WEX), a new report from anti-corruption watchdog Global Witness suggests this could become part of a regulatory probe in the UK.

Last Friday, the Russian BBC investigation revealed the purported identity of the technological architect of both scandal-plagued crypto exchanges, a 39-year-old Russian named Alexei Bilyuchenko.

Although the WhoIs web-domain analysis tool revealed Bilyuchenko to be the ultimate registrant of the BTC-e website based on a forensic scan of the email addresses used to establish the exchange, most threat intelligence experts assumed this was a false name.   

In late September, The Block obtained what appears to be an official Russian passport photo of Bilyuchenko from Konstantin Voronchinkhin, a 42-year-old Ukrainian national with ties to the underworld and who claims to be one of the real founders of the notorious and now-defunct, crypto exchange BTC-e.

Founded in 2011, BTC-e is perhaps most infamous for illegally receiving and laundering nearly a third of the bitcoins - collectively valued around $450 million in 2014 - that were stolen from the Japanese Mt. Gox crypto exchange. According, to blockchain forensics team Wizsec, some 300,000 bitcoins stolen from Mt. Gox users “ended up on BTC-e.”

Strong-Arm Tactics

BBC claims to have obtained court documents from a secretive Russian cyber-fraud case, including testimony from Bilyuchenko himself, alleging that Russia’s Federal Security Service, or FSB, extorted him for some $450 million worth of crypto that he had been custodying for customers of the Singapore-based WEX exchange. According to Bilyuchenko’s testimony, he is the victim of "fraudulent activities to seize the assets of the exchange."

FSB officers reportedly sequestered Bilyuchenko at the upscale Hotel Lotte in Moscow and demanded that he transfer all of the cryptocurrency stored on various flash drives to virtual wallets controlled by the agency, according to the BBC report. Per the administrator’s testimony, these crypto assets were ultimately destined for the so-called “FSB of Russia” fund. Later, two FSB officers demanded that Bilyuchenko hand over the entire WEX userbase, according to his testimony. The FSB’s press office did not immediately respond to The Block’s request for comment.  

Citing a secretly taped two-hour recording that purports to capture a conversation between a powerful Russian oligarch, named Konstantin Malofeev, who has been linked to the FSB in Russian media, and Bilyuchenko discussing the fate of WEX, the BBC reports that the businessman told the administrator that the penalty for not complying with FSB orders would be arrest and incarceration.

“You are kept afloat because I say that you are mine and I am responsible for you," says the voice that was forensically matched by the BBC, with the help of the St. Petersburg-based Forensic Laboratory of Audiovisual Documents, to Malofeev. "Is it really possible like this - to promise and not to deliver to the FSB?”, inquires the Malofeev-linked voice.

The BBC also obtained a memorandum of understanding, purportedly between Bilyuchenko and Malofeev to repurpose WEX assets for a crypto-exchange venture in Vladivostok, called Vladex, which the MoU calls a “special settlement infrastructure for maintaining the financial and economic sovereignty of the Russian Federation.”

But Malofeev’s official spokesperson denied these allegations and the authenticity of the recording and the MoU to The Block. “Neither Konstantin Malofeev, nor his structures had or have anything to do with WEX exchange, its management and assets,” they said.

“We believe that the BBC publication is incited and is based on falsified information in order to defame Konstantin Malofeev’s reputation,” added the spokesperson. 

From the Ashes of BTC-e

Launched in August 2017, WEX rose from the ashes of BTC-e just a month after the latter was shut down by U.S. law enforcement for allegedly laundering billions of dollars worth of illicit cryptocurrency on behalf of cybercriminals, drug traffickers, corrupt Russian officials and others. According to a 2017 crypto-laundering report authored by Europol, the U.S.-led takedown of BTC-e was code-named “Operation Avaricious.”

Bilyuchenko’s ex-business partner, Alexander Vinnik, who helped the administrator manage the financial operations of BTC-e, was arrested by Greek police on July 25, 2017 at the behest of the U.S. Department of Justice. The DOJ accused Vinnik, who was vacationing with his family on the resort peninsula of Chalkidiki at the time of his capture, of laundering between $4 billion and $9 billion of bitcoin through BTC-e and of being one of the exchange’s primary operators.

While Vinnik was handcuffed in front of his family on Koumitsa Beach, Bilyushenko was reportedly vacationing nearby on the island of Crete. Promptly tipped off about the arrest by Vinnik’s mother, Bilyushenko immediately destroyed all of his work-related computer devices, smashing the hardware against stones on a Cretian beach, according to the BBC report. The day after his partner’s arrest, Bilyushenko boarded a plane at a local airport that whisked him back to Novosibirsk, according to Voronchinkhin.

Voronchinkhin claims to have obtained Bilyushenko’s flight records after paying an unnamed Russian security service official a “shocking” amount of money.

Thus, it seems that Bilyushenko, known as the “Red admin” by old BTC-e users due to the color of his online screen name, is “Co-Conspirator X,” as referenced in the BTC-e indictment. However, the Internal Revenue Service Criminal Investigations unit, which led the BTC-e probe, declined to comment on the identity of Vinnik’s accomplice.

Vinnik has now been jailed in Greece for over two years and finds himself the target of a three-way extradition battle between the U.S., Russia and France. Part of the reason the U.S. may be pursuing the investigation of BTC-e and Vinnik so aggressively is that at least one exchange wallet was linked to Russian state-sponsored hacking group “Fancy Bear,” which stands accused by the DOJ of hacking the 2016 presidential election in the U.S.

With his partner jailed in Greece and 45 percent of exchange assets seized by U.S. law enforcement, Bilyushenko used the remaining, unseized BTC-e user account balances to relaunch the exchange in Singapore, but under the new business name of WEX. A Belarusian card player and former high-dollar client of BTC-e, named Dmitry Vasiliev, was listed as the official owner of WEX on Singaporean business registration documents.

Mired in controversies related to money laundering and fraud, WEX eventually sold to Dmitry Khavchenko, a pro-Russia militant who fought with the Donetsk People’s Republic, a group that was sanctioned by the U.S. Treasury in 2014, during the bloody Donbass civil war.

Khavchenko’s interest in WEX led journalists at Russian news outlet RBC to write about a potential link to Malofeev in the summer of 2018. Specifically, former RBC journalist Andrey Zakharov, who also wrote last week’s BBC expose of WEX, went undercover in a Moscow office building to buy WEX crypto from a money exchanger in the amount of $240,000.

Housed in that same Novinsky Passage office building, is the headquarters of Malofeev’s media conglomerate, Tsargrad Group. Zakharov reported that the exchanger who sold him the redeemable WEX voucher code, who he referred to as “Ivan,” suggested Malofeev was involved with the exchange.

Malofeev was also sanctioned by the Treasury in 2014 for financing pro-Russian separatists in Ukraine, including the DPR militants to which current WEX owner Khavchenko is affiliated. Also, the BBC report revealed a strong commercial link between Malofeev and the FSB via the Vladex exchange. A legal entity connected to Vladex is registered in the name of the oligarch’s 24-year-old son, Kirill Malofeev, and employs an ex-FSB officer, named Anton Nemkin.

On the Russian Managers Association website, Nemkin identifies himself as "the author of the Vladex investment system project."

The Kremlin has Many Towers

Sources close to officials within Russia’s Ministry of Internal Affairs, or MVD, a Russian law enforcement agency that may be adversarial towards FSB interests, told The Block that this organization is spearheading the probe into FSB wrongdoing, which began sometime near the end of 2018. The Block is withholding the name of the source out of concern for their safety.

The MVD’s press office did not immediately respond to The Block’s request for comment.

Thus, the FSB-Bilyuchenko case could further highlight the emerging trend of “infighting among Russian security services in the cyber sphere,” a theme that headlined a briefing given by Kimberly Zenz, an American cyber-threat intelligence expert who focuses on Russia, at the 2019 Black Hat hacker conference in Las Vegas last August.

The Block attended Zenz’s talk, which mainly focused on the fallout from the prosecutions of several high-ranking FSB officers and Russian cybersecurity experts for treason. Contrary to popular belief of a united front of Russian security services against outsiders, “the Kremlin has many towers,” said Zenz.

When viewed through the optic of Zenz’s infighting analysis, the clandestine recording of the apparent conversation between Bilyuchenko and Malofeev could then be interpreted as a type of “smoking gun” for the MVD to exert maximal pressure on the oligarch and his possible allies in the FSB. However, no official Russian source has been able to confirm that this is, in fact, the conflict that is occurring.

Emerging concurrently with the WEX criminal fraud probe, a recent proposal made by Russian law firm ZP Legal to Mt. Gox Legal, one of the largest groups of creditors seeking restitution for the exchange hack, seems curiously timed. Last August, ZP Legal approached MGL creditors, saying it was involved with a secretive Russian cyber-fraud case involving WEX customers and could help them recover up to 200,000 bitcoins tied to the Mt. Gox theft and BTC-e.

ZP Legal has previously represented Malofeev as a client, but the firm’s managing partner, Alexander Zheleznikov, told The Block: “I can confirm that neither I, nor any member of ZP Legal, nor ZP Legal as the firm, has ever represented Mr. Malofeev in relation to any cryptocurrency or crypto-exchange or such-like matter.”

“We were not approached or assigned a case concerning investigation commenced by the MVD’s cyber-division in relation to the said persons,” added Zheleznikov.

Global Witness Findings    

On the heels of the BBC’s FSB crypto expose, Global Witness has just published the results of a year-long investigation into BTC-e. Authored by Louis Goddard, a data investigations advisor with Global Witness, the report is titled “Do you Know Mr. Alexander Vinnik?”

The report is based on a leaked database of all BTC-e users who used the exchange from 2011 until October 2014. Primarily focused on Sergey Mayzus, an ex-Russian politician and one-time payment processor partner of BTC-e, and his related company Mayzus Financial Services, the report examines their relationship with Vinnik and the doomed exchange he allegedly operated. Mayzus has continually maintained that BTC-e “has never had any direct link to our company, neither structurally, nor personally.”

But the primary thrust of the Global Witness report is that, despite concurrent extradition requests from the U.S. and France, “in a real sense the case is a British one. Two of BTC-e’s central shell companies were registered in the UK. They handled money using accounts created by another UK-registered company regulated by the FCA, which accepted deposits using bank accounts with a London address,” according to the report.

Goddard’s primary takeaway from his BTC-e investigation was that “there is no doubt that through a secretive offshore network this is a case that goes far beyond one individual. It is yet another example of how the use of anonymous companies is central to allegations of criminality and wrongdoing.”

Now, “UK law enforcement is being called on to act over new evidence Global Witness has uncovered,” says a press release accompanying Goddard’s report.

© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.