Loading story…
A Russian-linked money laundering network acquired a controlling stake in Keremet Bank in Kyrgyzstan, using it to launder proceeds from UK-based drug, firearms, and immigration crimes, and to facilitate sanctions evasion for Russia’s military-industrial complex. The UK’s National Crime Agency (NCA), through Operation Destabilise, uncovered that the network—operated by the SMART and TGR groups—converted illicit cash into cryptocurrency, which was then funneled through Keremet Bank. This bank was later identified as providing cross-border payment services for Promsvyazbank (PSB), a Russian state-owned lender supporting the war in Ukraine. The laundering operation connected street-level criminal activity in the UK to Russian state interests, with the NCA and international partners seizing millions in cash and cryptocurrency as part of the investigation.
Investigators also linked the laundering network to a spy ring of Bulgarian nationals, run by Jan Marsalek, who were convicted for surveilling targets on behalf of Russian intelligence. The NCA’s findings revealed that Keremet Bank enabled PSB to bypass Western sanctions, allowing the Russian defense sector to acquire restricted components for the war effort. The operation demonstrates a direct financial pipeline from UK criminal proceeds to Russian state-sponsored activities, highlighting the global reach and complexity of modern money laundering schemes supporting sanctioned entities.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said proceeds from UK drug trafficking were funneled through the bank and connected the institution to Russian spy services and the military, expanding the known scope of the bank's alleged use beyond cybercrime proceeds. This represents the public disclosure of the bank's role in laundering multiple criminal revenue streams.
The referenced reporting indicates that Russia-linked cybercriminal and drug-trafficking networks purchased or took control of a bank allegedly tied to Russian military and intelligence interests in order to move and launder illicit funds. The acquisition appears to be the central real-world development described across both sources.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed **A7 network**, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated **Huobi Global S.A.**, the entity behind crypto exchange **HTX**, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows. Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across **TRON**, **Ethereum**, **BNB Smart Chain**, and **Solana**, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for **A7 LLC** and **Garantex** and to the UK National Crime Agency-led **Operation Destabilize**, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
Jul 24, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026