Between July 15 to October 14 2022, a team of investigators reviewed hundreds of Russian-speaking Telegram channels searching for donation requests to the Russian army. Across 3,348 Telegram channels, at least 363 cryptocurrency addresses were found. The investigation team has managed to retrospectively aggregate transactions starting as early as February 23rd 2022, the day before the Russian invasion, in order to create a more comprehensive picture.
The transactions conducted to and from these cryptocurrency wallet addresses donations have been marked, investigated and tracked. The goal of the investigation has been to understand from which Virtual Asset Service Providers (VASPs), the so-called crypto-broker, the funds are flowing from and which VASPs receive the greatest amount of transactions.
Despite this, raising donations with cryptocurrencies remains legal. Compliance teams of VASPs that have received more than €15,000 in funds should have conducted enhanced due diligence (EDD) processes to ensure that the origin of those funds is clear and not illicit before it is being cashed out to currencies, like Russian ruble, or exchanged into other digital assets. €15,000 is a known Anti Money Laundering (AML) limit amount within the European Union (EU) that requires platforms to perform enhanced due diligence.
This is a standard practice of the financial institutions, and is called ‘proof of funds’ (POF) and ‘proof of source of wealth’ (POW). The user has to provide extensive explanation on the sources of funds and display proofs, and it is up to the risk appetite of different crypto brokers to accept or deny such transactions. Generally, according to anti money laundering rules, the transactions should have been denied if identifying the source of the funds in full was not possible.
To date, it remains unclear whether different crypto brokers have completed such investigations and completed payouts of the transactions.
“Across the European Union, crypto brokers, exchanges and other financial institutions have to obey the same anti money laundering rules. Those transactions that exceed €15,000 should always be reviewed. If they don’t, I would see this as a clear failure of brokers’ AML obligation,” says Dr. Alexandra Andhov, associate professor in law and technology at University of Copenhagen.
MORE FOR YOU
Until today, the industry has failed to provide a unified front to the situation of Russian military donations raised using crypto brokers.
By the end of February, the Ministry of Digital Transformation of Ukraine sent official letters to Coinbase, Binance, Huobi, KuCoin, Bybit, Gate.io, Whitebit and Kuna urging the platforms to stop transactions by Russian users due to concerns that cryptocurrencies could be used to circumvent sanctions.
Of the eight platforms that were contacted, four made no attempt to take action to comply with the request. Kuna and Whitebit took actions. According to an internal source, Binance and Coinbase asked users to display their proof of funds.
Furthermore Coinbased decided to ban 25,000 of its users, a drop in the ocean compared to the number of users from Russia, in concession to the concept of “targeted sanctions” avoiding punishing vast amounts of the population.
As described in previous articles, the fifth package of EU sanctions on Russia has requested crypto brokers to limit the liquidity of Russian nationals, who do not reside in the EU or the European Free Trade Association (EFTA), to a maximum value of €10,000 per user. This sanction has been causing headaches for crypto compliances teams due to the high volatility in the value of cryptocurrencies.
For example, on Monday an individual’s digital asset holdings have a value of €11,000 and would be subject to sanctions. On Tuesday, the value of crypto could have dropped to €9,000, which would be below the €10,000 limit and no measures needed to be taken by cryptocurrency providers.
Dr Andhov, raises the questions to the legitimacy of this decision. As it unilaterally blocks a group of persons based on their nationality from using services that are available to others without any proof of connection to the Russian state or war. She claims, that this articular decision remains as highly questionable from the European or international law perspective.
In an interview, Ukrainian officials are thankful for steps which have been taken but still hope for more self regulation of the industry.
“It strikes me that some crypto companies, like Binance or OkX, continue to accept new customers from Russia as of today, potentially putting them into a subsidiary which is not under EU/EFTA jurisdiction to bypass the U.S. and European sanctions,” says Alex Bornyakov, the deputy minister of digital transformation of Ukraine. “During the Future Blockchain Summit, the cheif marketing officer of the cryptobroker OkX, which is Headquartered in Malta but operates under a Seychelles registered company (“Aux Cayes”), has confirmed that they will continue to onboard Russian customers and continue to do so. It is tiring that companies focus on profit instead of human lives of our women and children.”
How to read the visualizations:
There are four visualizations of the investigations which differ depending on the specific type of cryptocurrencies and the total amount of transactions. For simplification purposes, all wallets have been aggregated.
Each visualization is divided into three sections:
Cryptocurrency transactions have been flowing from the left to the right. Crypto brokers located on the left display the transaction sources from individual Telegram users to the requested donation wallet. The transactions located to the right of the red rectangle visualize to which providers the funds have been sent to once they were collected.
As of October 14 more than nearly $204,000 has been still kept in the donation wallets, before being paid out to a dedicated crypto broker the transfers could be both stopped or frozen.
“We collect data actively and appeal to our colleagues in countries where brokers are registered to freeze and seize such funds before they will be paid out. Money that the brokers are paying out will result in more deaths of kids and destroyed livelihoods, so it is way more than a financial balance sheet of a crypto company. As we have the tools to freeze it in real time, why do we fail to do so?” says Dr. Tetiana Dmytrenko, a high-ranking adviser in Ukraine’s ministry of finance.
As of today most of the “blockchain analytics companies,” which provide intelligence for compliance teams of cryptocurrency companies, are not flagging cryptocurrency wallets connected to donations requests intended for the Russian military in a unified way.
“As a sign of solidarity, we have set a meeting with other cryptocurrency analytics companies as our team is willing to continuously share cryptocurrency wallet addresses with all blockchain-analytic providers and law enforcement agencies who are willing to mark them as ‘high risk’ in their systems,” says Lex Fisun, cofounder of Global Ledger. “Only acting together beyond our commercial interests will help us.”
Even though policymakers have provided no clear guidance yet on how to treat Ukrainian or Russian military donation-based wallets, the AML borders still apply.
According to Erik Källmen, a former Swedish member at the ministry of foreign affairs, every measure boils down to a business decision of how much capacity each business is willing to invest in due diligence.
After the review conducted above it is evident that platforms have the technical tools to stop transactions to be cashed out. If they decide to do so.
The methodology of spotting cryptocurrency wallets in Telegram channels: Cryptocurrency wallets are a pretty unusual aggregation of characters, without spaces, and are between 32 and 34 characters long. The initial machine learning review of 3,348 channels yielded over 700 cryptocurrency addresses which were then manually reviewed by investigations team members from GL protocol to understand the context of posted donation wallets.
What have been the Telegram-channels fundraising intended for? The wallets have been clustered into two categories:
Main wallets refer to the owners of wallets who have been indicating direct support to members of the Russian military—Donetsk People’s Republic military and Luhansk People’s Republic military—to support the aggression on Ukraine.
Additional wallets refer to the wallets that displayed crowdfunding efforts from founders of Telegram channels to keep them active to create and post content. They have argued that an active telegram channel will attract more readership, which will yield the biggest donations to the “main wallets.”
What are the aggregate outcomes of the traced funds:
Between February 23 and October 14 2022, more than $1.78 million (based on the exchange rate from October 19) were collected. The overwhelming majority of those funds have been sent further to crypto brokers identified below.
Edited: Grace Marshall