U.S. and Dutch authorities disrupted Russian-linked crypto laundering services

U.S. and Dutch authorities hit the infrastructure

On September 26, 2024, U.S. and Dutch authorities moved against a cluster of cryptocurrency services that American officials alleged had laundered proceeds for ransomware crews, fraud markets and other cybercriminals. The Justice Department unsealed charges against Russian nationals Sergey Sergeevich Ivanov and Timur Kamilevich Shakhmametov, while the U.S. Secret Service seized domains associated with UAPS, PM2BTC and Cryptex. Dutch authorities took servers used by PM2BTC and Cryptex offline and seized cryptocurrency valued by the Justice Department at more than $7 million.

The operation mattered because it combined criminal process, financial restrictions and infrastructure seizure in one action. Treasury’s Office of Foreign Assets Control sanctioned Ivanov and Cryptex. The Financial Crimes Enforcement Network identified PM2BTC as a “primary money laundering concern” connected to Russian illicit finance and issued an order barring covered financial institutions from transmitting funds to or from PM2BTC or accounts and crypto addresses administered on its behalf.

That was broader than an indictment alone. The criminal case addressed alleged past conduct; the sanctions and FinCEN order were designed to isolate named services from compliant financial channels; the domain and server seizures interrupted access to their infrastructure.

The allegations and the transaction record

The indictment charged Ivanov with one count of conspiracy to commit and aid and abet bank fraud and one count of conspiracy to commit money laundering. Prosecutors alleged that he created or operated UAPS, PinPays and PM2BTC and provided payment or laundering services to criminal markets. Shakhmametov was charged with conspiracies involving bank fraud, access-device fraud and money laundering tied to the Joker’s Stash market. Those charges were allegations on September 26, 2024, not findings of guilt.

The Justice Department attributed several measurements to blockchain analysis. It said addresses linked to Ivanov’s alleged services processed about $1.15 billion in transactions over a period beginning July 12, 2013. It also said more than 37,500 transactions involving bitcoin addresses associated with Cryptex represented 62,586 bitcoin, valued at about $1.4 billion when the transactions occurred. Of bitcoin sent to Cryptex, the department said roughly 31%, or $441 million, came from addresses associated with criminal conduct. These figures describe traced addresses and analytical attribution; they are not an audited balance sheet or a count of unique customers.

FinCEN supplied a separate measurement window for PM2BTC. Using two address clusters attributed by commercially available blockchain-analysis software, the agency found that suspected illicit funds accounted for as much as 43.1% of convertible virtual currency received before July 2023. A size-adjusted comparison with 1,244 other virtual-asset service providers placed PM2BTC in the top 1% for direct receiving exposure and top 2% for indirect receiving exposure to categories FinCEN treated as suspected illicit activity.

Why the action mattered for crypto market structure

The September 26 action showed how enforcement around cryptocurrency could operate across layers. Public blockchains supplied transaction trails; court orders targeted domains; Dutch authorities targeted hosting infrastructure; OFAC imposed sanctions; and FinCEN applied obligations to covered financial institutions. The target was not a blockchain protocol itself, but service businesses officials said converted and moved value for criminal clients.

For exchanges, custodians and other intermediaries, the practical signal was that wallet screening could not stop at a sanctions list. FinCEN’s order described PM2BTC’s alleged use of weak know-your-customer controls and a technical arrangement that hindered attribution, making counterparty identification and transaction provenance central compliance questions.

What remained uncertain on September 26

The public records did not establish that every Cryptex or PM2BTC transaction was illicit, identify every wallet in the government’s calculations, or resolve the defendants’ liability. The Justice Department’s percentages relied partly on an unnamed analytics provider, while FinCEN’s figures depended on proprietary clustering and risk labels. Cryptocurrency values were calculated at transaction time, not at a single September 26 market price. The verified development was the coordinated legal and operational action; the ultimate case outcomes remained open.