ELLIPTIC REPORT 2 023

ELLIPTIC REPORT 2 023

Crypto in Conflict

How the role of cryptoassets has evolved in the

Russia-Ukrainian War

Executive Summary 05 Foreword 06 About This Report 08 01. Ukraine 12 Overview 13 The Most Popular Cryptoassets 13 Blockchain Activity Over Time 14 The Origin of Donations 15 Aid for Ukraine 16 The Ill-fated Airdrop 17 How Donations Were Spent 18 Other Government Crypto Campaigns 20 The United24 (U24) Global Initiative 21 The Security Services of Ukraine 21 The Ministry of Health of Ukraine 22 Individual Regiments 22 Non Governmental Organizations 24 Military Donations 24 Blockchain-based Charity Projects 26 Humanitarian Aid 29 Cyber and Intelligence Groups 31 Journalism and News Channels 32 Non-fungible Tokens (NFTs) 33 Affiliated NFT Projects 35 Other Pro-Ukraine NFT Projects 36 How Crypto Compared 39 Illicit Activity Arising From Ukraine 40 Crypto Donation Scams 40 DeFi Hacks and Ukraine 41 Summary and Best Practices 43 Structure of Donation Campaigns 43 Overcoming Donation Scams 45

  1. Russia Overview The Most Popular Cryptoassets Blockchain Activity Overview The Origin of Donations Crypto Fundraising Before the Invasion Military Fundraising Campaigns In-house Funding Dedicated Fundraising & Procurement Groups “Civilian” and Saboteur Fundraisers Funding Military Research and Development The (Dis)information War Collecting Military Intelligence News and Propaganda Censorship and Disinformation “Humanitarian“ Projects Engagement With NFTs The Nexus Between War and Cybercrime Russian Cybercrime in the Lead-up to the Invasion The Near-demise of the Stolen Credit Card and Data Market The Conti Leaks Russian Hacktivist Groups Financing War Through Russian Cybercriminal Activity Top Illicit Origins of Incoming BTC to Pro-Russian Wallets Scams and Ponzi Schemes Measures to Prevent Russian Fundraising Seizures The Rise of Illicit “Coin Swap” Exchanges Crypto Fundraising By Russian and Belarusian Dissidents Dissidents in Russia Dissidents in Belarus

46 48 49 50 51 52 54 55 55 60 61 62 62 63 65 67 68 69 Russian Cybercrime in the Lead-up to the Invasion 69 The Near-demise of the Stolen Credit Card and Data Market 70 71 72 Financing War Through Russian Cybercriminal Activity 74 Top Illicit Origins of Incoming BTC to Pro-Russian Wallets 74 74 76 76 77 Crypto Fundraising By Russian and Belarusian Dissidents 79 79 81

  1. Regulatory Developments & Compliance Implications

  2. Regulatory Developments & Compliance Implications 84

Sanctions and Cryptocurrencies 85 United States

United States European Union United Kingdom Singapore Conclusion

93 94 95

95 Building a World-leading Crypto Dataset

Building a World-leading Crypto Dataset A Positive Impact For the Wider Industry

97

98 Methodology

Index

99

Executive Summary

Since Russia’s full-scale invasion of Ukraine on February 24th 2022, both sides have used blockchain technology to aid their respective efforts. Many campaigns have sought to harness core developments in the crypto ecosystem to aid their fundraising – from decentralized finance (DeFi) to crypto pre-paid cards. Using its internal proprietary data, Elliptic has conducted an in-depth analysis into the use of cryptoassets on both sides of the war, ranging from humanitarian causes to sanctioned groups suspected of war crimes.

In key findings of the report, we have found that:

Cryptocurrency in Conflict

Foreword

by Simone Maini, CEO

At Elliptic, we believe that cryptoassets are forming the

foundation of a financial system that is fairer, freer and

safer for all to use. Since 2013, we have dedicated ourselves

to this vision by working to combat money laundering

and sanctions evasion in cryptoassets. By doing so, we

have helped to build confidence in crypto and enabled the

industry to grow. The Cryptocurrency in Conflict report is

an extension of this effort.

The war in Ukraine has demonstrated that powerful technologies such as cryptocurrency can be used in both positive and negative ways. Fundraising campaigns by the Ukrainian government have shown how cryptoassets can transcend borders and the complex maze of international banking – allowing individuals to directly fund a country under attack.

Ordinary Russians are using digital assets to escape their own country’s oppressive capital controls designed to hold their assets hostage, as the country creaks under the weight of sanctions. On the other hand, crypto fundraising is also being used by Russia-backed forces.

Additionally, there is some risk of the Russian government using cryptoassets to circumvent sanctions through state-sponsored cybercrime and even crypto mining. Furthermore, officials and oligarchs are attempting to use crypto in an effort to conceal their wealth from the Office of Foreign Assets Control (OFAC) and other highly effective global sanctions regimes.

In response to these events, we at Elliptic have redoubled our efforts to empower the financial services industry, regulators and law enforcement agencies to prevent Russia from financing its war or evading sanctions using cryptoassets.

Through constant investment in cutting-edge tracing technology, data collection and attribution, and world-class expertise, we have been able to directly link more than 22 million crypto addresses to Russia-based criminal activity. Included within these addresses are wallets used to solicit donations for the Russian military and associated mercenaries currently active in Ukraine.

Cryptocurrency in Conflict

The analyis showcases the use of crypto as a force for good – especially the change that can be made when well-intentioned technology users and developers come together for the benefit of others.

The report also exposes the entities engaged in the more sinister – though fortunately less prevalent – use of cryptoassets to procure military equipment to support the invasion and exposes attempts to evade sanctions through the use of cryptoassets.

This report should encourage financial institutions, regulators and law enforcement that through

innovation and the inherent attributes of most cryptoassets, this industry can effectively mitigate

financial crime and sanctions risks to secure cryptoassets as a force for good – accessible to and

beneficial for all.

As an industry, we have the power and responsibility to shape how digital assets are used, and to prevent them from becoming a haven for money launderers and sanctions evaders. This report should encourage financial institutions, regulators and law enforcement that through innovation and the inherent attributes of most cryptoassets, this industry can effectively mitigate financial crime and sanctions risks to secure cryptoassets as a force for good – accessible to and beneficial for all.

Finally, my thanks to our team for their unwavering dedication to our mission, for leaving financial criminals nowhere to hide and for ensuring cryptoassets can flourish in the light.

Cryptocurrency in Conflict

About This Report

This report is an in-depth analysis of entities engaging in crypto activities, with a nexus to Russia’s full-scale invasion of Ukraine on February 24th 2022. It is divided into three main sections:

  1. Ukraine: reviews the range of fundraising entities using blockchain technologies to solicit donations – with a particular focus on the Ukrainian government’s own “Aid For Ukraine” initiative. Also discussed are the contributions of non-fungible tokens (NFTs) and the rise of Ukraine-related donation scams since the full-scale invasion.

  2. Russia: analyzes the use of cryptoassets to solicit donations for military equipment by entities including but not limited to cybercriminals, social media fundraising groups, mercenary groups, sanctioned entities and disinformation campaigns.

  3. Implications and Key Controls: assesses the findings from the previous two sections in terms of the risk mitigation strategies and sanctions compliance implications faced by virtual asset services. This provides recommendations for virtual asset services seeking to prevent exposure to sanctioned and related criminal entities.

For this report, Elliptic has analyzed over $230 million worth of blockchain activity. The chart below shows that pro-Ukrainian fundraising campaigns – many backed or initiated by the Ukrainian government itself – account for most of these funds. Receiving over $212 million in cryptoassets, pro-Ukrainian fundraisers have substantially outpaced pro-Russian crypto donations, which stand at $4.8 million. A further $0.7 million has been raised by anti-government entities in Belarus, which is a key ally of Russia.

Cryptoassets Received By Pro-Ukrainian, Pro-Russian & Belarusian Anti-government Wallets

This does not mean that the operations of pro-Russian entities should be treated with complacency, however. Elliptic’s analysis of these groups has brought to light the vast

complacency, however. Elliptic’s analysis of these groups has brought to light the vast cybercriminal infrastructure that underpins the blockchain activities of many of these groups. Over a tenth of cryptoassets received by pro-Russian wallets originate from illicit activity – ranging from dark web markets to sanctioned exchanges. Meanwhile, under 2% of Ukraine’s donations originate from illicit sources – mainly from the US-sanctioned mixer Tornado Cash.

complacency, however. Elliptic’s analysis of these groups has brought to light the vast cybercriminal infrastructure that underpins the blockchain activities of many of these groups. Over a tenth of cryptoassets received by pro-Russian wallets originate from illicit activity – ranging from dark web markets to sanctioned exchanges. Meanwhile, under 2% of Ukraine’s donations originate from illicit sources – mainly from the US-sanctioned mixer Tornado Cash.

The Proportion of Pro-Ukraine and Pro-Russia Cryptoasset Donations By Origin

Furthermore, although they are not at high risk of catching up, pro-Russian donations have gradually increased their momentum compared to pro-Ukrainian donations since May 2022. In June 2022, pro-Russian campaigns raised more BTC and ETH than Ukrainian campaigns for the first time and almost repeated this trend in October.

Accounts for a sample of BTC and ETH received by wallets associated with fundraising campaigns.

This report will expose the association of pro-Russian groups with cybercriminal entities. It will also unearth profiles of specific networks facilitating them, their “off-chain” activities and intentions. Many of these findings – which include the glorification or incitement of potential war crimes, crimes against humanity, use of nuclear weapons and violent antisemitic or homophobic rhetoric – are causes for grave concern across all relevant industries.

It is crucial to acknowledge these realities to gauge an accurate picture of the threats posed by such groups, particularly in terms of preventing their cryptoasset fundraising efforts. To provide full context of these organizations, this report includes several case studies and quotes from them where relevant. Readers may find some of this content distressing.

Throughout this report, all identifying information of pro-Russian entities are omitted to prevent inadvertent advertising, apart from the names of groups presented in case studies. All crypto wallet addresses – both of pro-Ukrainian and pro-Russian groups – are also anonymized. The former is to prevent any from becoming targets for pro-Russian hackers, as some of them have in the past (this report will discuss such cases).

Customers of Elliptic will also be able to screen for all entities – among others – identified in this report. In the case of pro-Russian entities engaging with criminal activities or fundraising, they will be able to incorporate such groups into their risk rules and manage their blockchain exposure risk accordingly.

Cryptocurrency in Conflict

Look out for the following specific items of content throughout this report:

Red Flags & Warning Signals

Warnings describe significant issues and trends in criminal behavior that are worth highlighting and can indicate suspicious activity. Red flags are indicators of risk that might not clearly pinpoint illicit activity as a standalone.

Diagrams and Flowcharts

Illustrations, diagrams, graphs and charts are included throughout to help you visualize the nature and scale of blockchain activities of discussed entities and, where possible, give a relative view.

Case Studies

Wherever possible, real-life examples of how pro-Ukrainian and pro-Russian entities are utilizing cryptoassets are included to contextualize the discussed trends.

Key Controls & Best Practices

A guide of lessons learned and key recommendations for maintaining sanctions compliance and robust anti-money laundering and counter-terrorist financing processes in light of risks arising from the war in Ukraine.

Elliptic Blockchain Analytics

A spotlight into the screening and blockchain investigation tools we use at Elliptic to identify and trace pro-Russian cybercriminal and illicit fundraising activities.

Blockchain data provided in this report is accurate up to and including November 2022, unless otherwise stated. Further details can be found in the methodology section.

Cryptocurrency in Conflict

Ukraine

Overview

The resolve of the crypto community to directly donate and utilize its resources to assist Ukraine’s resistance against the war has been swift and unmatched compared to any previous conflicts. Beyond the aid provided to humanitarian causes and the Ukrainian government’s own crypto campaigns, the drive to contribute has driven innovation and development within the digital asset ecosystem. Besides official government wallets, blockchain projects are the second biggest source of pro-Ukrainian crypto donations.

Types of Pro-Ukrainian Fundraisers By USD Value of Cryptoasset Donations

A notable trend observed across pro-Ukrainian fundraisers is their comparatively lower reliance on Bitcoin – the original and most traded cryptoasset by market capitalization. Despite its continued dominance in the crypto ecosystem, Bitcoin does not allow for web3- based innovations. These innovations - such as DeFi, NFTs and DAOs - are more mainstream on blockchains such as Ethereum, of which its native asset Ether is the second largest by market cap. Such blockchains have allowed fundraisers to harness unique web3 opportunities to initiate successful DeFi-powered donation campaigns.

Cryptoassets Received By the Wallets of Pro-Ukrainian Fundraisers

Blockchain Activity Over Time

Over 80% of donations occurred in either the last four days of February or in March 2022 – soon after the full-scale invasion began – before gradually decreasing. In November 2022, a sample containing the most popular pro-Ukrainian donation wallets received just under $0.6 million in BTC and ETH.

2022 Monthly BTC and ETH Flows into Pro-Ukrainian Wallets

Accounts for BTC and ETH receipts in a sample of non-exchange wallets.

The Origin of Donations

Elliptic’s analysis of almost $96 million of traceable Bitcoin, Ether and some major stablecoin donations shows that most of these assets originated from cryptoasset exchanges. A sizable proportion originated from NFT Marketplaces and, to a lesser extent, token contracts and decentralized exchanges – exemplifying the substantial role of web3 in facilitating fundraising.

The use of mixers has been attributed to sympathetic donors from Russia or pro-Russian jurisdictions concealing their donation activities. Russian-born Ethereum Founder Vitalik Buterin said that he had used Tornado Cash to donate to Ukraine – in opposition to the mixer being sanctioned by the United States in August 2022 due to money laundering concerns. 1 In addition to Buterin – who has publicly donated at least $5 million to pro-Ukraine causes – several other known users have also contributed. These include Polkadot Co-founder Gavin Wood ($5.8 million) and Tron Founder Justin Sun (at least $200,000). 2

This section looks at the causes summarized here and their blockchain activities – beginning with the most significant, namely the Ukrainian government’s own “Aid For Ukraine” initiative.

Origins of BTC and ETH Donations to a Sample of Pro-Ukrainian Causes

Exchanges - 42.1% NFT Marketplaces - 24.4% Decentralized Exchanges - 11.9% Known Users - 5.5% Token Contracts - 2.7% Mixers - 1.8% Peer-to-Peer Exchanges - 1.7% Others - 9.9%

Based on a sample of $95.8 million of BTC, ETH and USDT, USDC and DAI donations on the Ethereum blockchain.

Cryptocurrency in Conflict

Aid For Ukraine

The crypto community was met with surprise when on February 26th – two days after the Russian invasion began – the Ukrainian official Twitter page posted Bitcoin and Ethereum addresses for donations. Since then, the Aid For Ukraine initiative has accepted donations on at least 12 different blockchains. Besides the designation of Bitcoin as legal tender by El Salvador in September 2021, this is arguably one of the biggest adoptions and endorsements of cryptoassets by a national government.

The ”Aid For Ukraine” Initiative webpage.

Aid For Ukraine was initiated by the Ministry of Digital Transformation and its minister: Vice Prime Minister Mykhailo Fedorov. The ministry collaborated with decentralized staking provider Everstake and crypto exchanges FTX and Ukraine-based Kuna. As of December 2022, over $83 million in cryptoassets have been donated, excluding Monero and fiat donations – the latter of which was an option advertised for those who wanted to “HODL”.

Of these donations, $29 million was given in ETH, $22.7 million in BTC, $15.1 million in USDT and $8.2 million in DOT. Other assets added a further $8.2 million, including nearly $200,000 worth of NFTs.

The Ministry of Digital Transformation clarified in November 2022 – after FTX’s collapse – that the exchange was used only in the initial stages of the collection effort and had since been passed on to the National Bank of Ukraine. 3

Cryptocurrency in Conflict

The Aid For Ukraine initiative raised over $10 million in two days. The campaign dominated the online crypto community, with many virtual asset services, notable users and investors either 4 participating or launching their own initiatives to assist the fund.

Daily Donations of Major Cryptoassets to “Aid For Ukraine” in February and March

The Ill-fated Airdrop

Airdrops are prone to technical issues and scams. One common scam involves an illicit actor creating a new token and pretending that it is the official token of the airdrop. They then begin distributing their token to all expecting recipients of the campaign, who misleadingly believe the token to be official. This drives up the token’s value and potentially nets the scammer a significant profit. Some criminals have also spoofed transactions on block explorers, making transaction records suggest that the official account of the airdrop is responsible for dispersing the fake tokens.

In the case of the Ukraine airdrop, a scammer issued seven billion “Peaceful World” tokens and began distributing them by spoofing transactions from the Aid For Ukraine official wallet. Observers were quick to notice, with Ukraine cancelling its airdrop shortly after and promising NFT-based fundraising instead.

Etherscan records of the scam token show it being sent to the Aid for Ukraine account and then being distributed across unwitting donors.

The cancellation of the airdrop led to dismay among many donors, some of whom donated mainly to participate in the airdrop. Some even (often jokingly) accused the government of pulling the “biggest rug pull in history” – where a project announces an initiative and then cancels after receiving investments for it. The post-cancellation fallout led to debates on how the airdrop announcement inspired both significant philanthropy but also self-interested profit-seeking within elements of the crypto community.

The announcement (left) and cancellation (right) of the airdrop.

How Donations Were Spent

Ukraine began spending its crypto as early as March 5th 2022, to purchase $15 million worth of military equipment.5 Many military suppliers began accepting crypto payments to make it easier to facilitate purchases, though 60% required crypto to be converted to fiat currency first. While the Aid For Ukraine Initiative makes up most of the crypto donations received by the MDT, a sizeable contribution comes from smaller funds. 6 The MDT has since published two spending reports – in April and July 2022 respectively – detailing how the donations were spent.7

Cryptocurrency in Conflict

“Crypto really helped during the first few days because we were able to cover some immediate needs.”

Alex Bornyakov – Deputy Minister for Digital Transformation8

Major expenditures included the purchasing of over 200 drones, 10,000 digital rifle scopes and 60 tons of fuel. Over $9 million was spent on the worldwide media campaign shoring up global support, while the Ministry of Defence also purchased undisclosed amounts of lethal military equipment for just under $7 million. 9

How the Ukrainian Government Spent its Crypto

$30,000,000

$26.3m $26.3m

$25,000,000

$20,000,000

$16.6m $16.6m

$15,000,000

$11.5m $11.5m $11.2m $11.2m

$10,000,000 9.2m 9.2m $7.7m $7.7m $6.9m $6.9m

$5,000,000 $2.4m $2.4m $2.4m $2.4m $1.8m $1.8m $1.6m $1.6m $1.2m $1.2m $0.6m $0.6m$0.2m $0.2m $0.1m $0.1m $0.1m $0.1m $28.0k $28.0k $0

UAVs Cars Fuel Transport Laptops Field rations Optical sights Military Clothing Lethal equipment Medical supplies Military medical kits Ratio kits & stationsAdministrative costs Rifle scope & Imagers Hardware & Software Global media compaign Communication devices

April July

Cryptocurrency in Conflict

Other Government Crypto Campaigns

Several Ukrainian government agencies have initiated their own crypto campaigns. Although most have not received as many donations as the Aid For Ukraine initiative, they have nevertheless received considerable attention from the crypto community.

Cryptoassets Received By Other Ukrainian Government Wallets

The United24 (U24) Global Initiative

Launched by President Volodymyr Zelenskyy on May 5th 2022, the charitable initiative raises funds in both fiat and crypto for three main tasks: (1) Defence and Demining, (2) Medical Aid and (3) Rebuilding Ukraine. Funds are transferred to the National Bank. Crypto donations are processed by WhitePay – a crypto payment service provider.

The U24.gov.ua homepage.

As of December 2022, U24 has received over $232.8 million in donations, with funds disbursed to acquire drones, helicopters, X-ray machines and to rebuild damaged infrastructure. The extent of the crypto contribution to these funds are unknown, though an anonymous $500,000 crypto donation – the largest single crypto donation to-date – was made on September 10th 2022. 10 Fundraising reports and expenditure are audited by Deloitte and published routinely.

The Security Services of Ukraine

On March 2nd 2022, the war.ukraine.ua website was updated to include crypto donation addresses for the Ukrainian security services, beside the already-present fiat donation channels.

Addresses were advertised in Ethereum, Bitcoin, BNB Chain and Tron. Together, these addresses have received just under $200,000 in donations. These funds are intended for the National Police, the National Guard, the State Border Guard Service and the State Emergency Service of Ukraine.

Donation wallets for the Ukrainian Security Services.

Cryptocurrency in Conflict

The Ministry of Health of Ukraine

The Ministry of Health published crypto donation wallets in Bitcoin, Ethereum and Litecoin on February 28th 2022 – four days after the invasion began. Donations are used to help sustain the provision of medical aid by the ministry to casualties of war.

The crypto wallets have received over $66,000 in cryptoasset donations. Unexpectedly, a small proportion of funds originating from a pro-Russian blogger have ended up in the Ukrainian Ministry of Health. The blogger in question hosts a popular Telegram channel and routinely collects crypto donations on behalf of Russian soldiers. The transfer of some of these funds to the Ukrainian Health Ministry indicates a successful attempt to seize donated pro-Russian funds and divert them into Ukrainian hands at some point in the transaction trail.

Elliptic Investigator shows a small proportion of Bitcoin originating from a pro-Russian separatist fundraiser making its way to the Ukraine Ministry of Health.

Individual Regiments

Several regiments of the Ukrainian Armed Forces (ZSU) – as well as voluntary battalions – have launched their own fundraisers. Many of these regiments post their progress and donation wallets on Telegram and other social media platforms.

The Ukrainian “Freedom of Russia” Legion – made up of Russian defectors and ex-prisoners – has raised $52,700 in crypto donations.

Cryptocurrency in Conflict

Though crypto donations for individual army regiments appear to be small, some high-profile ones have managed to garner notable levels of financial support through crypto fundraising initiatives. The campaign of the Azov Regiment is discussed in the below case study.

The Azov Regiment

Azov was founded as a military-political group in 2014, in response to the Ukrainian government’s call for voluntary battalions to assist the war against Russian separatists in Crimea and the Donbass. The militia gained notoriety for its involvement in taking back control of Mariupol from separatists in 2014. It was formally incorporated into the Ukrainian National Guard that same year.

The regiment has been associated with neo-Nazi and white supremacist ideologies, causing the US Congress to suspend material donations and fuelling Vladimir Putin’s claims of “Nazi influence” in justifying his invasion of Ukraine. The regiment denies these claims, stating that they are not political and referring to Adolf Hitler (and Joseph Stalin) as “tyrants”. 11

Azov has been supported by three major charity campaigns – The Ukrainian Signal charity, the “Fine City” (Faine Misto) Music Festival and “Support Azov”, a charity supported by veterans and soldiers’ families. Faine Misto has received over $36,200 in crypto donations. Support Azov has received over $23,000 in crypto to assist Azov fighters. A voluntary battalion affiliated with Azov – namely the “Boatsman Boys” – has also received just under $6,000 in crypto donations.

The Azov Regiment and Faine Misto fundraisers.

Cryptocurrency in Conflict

Non-governmental Organizations

Military Donations

Since 2014, several military charities seeking to help soldiers, veterans and their families have gained prominence due to the ongoing conflict - predominantly in Crimea and the Donbass. Many of these military charities - given their collection of funds to purchase arms - cannot fundraise on standard crowdfunding platforms due to their terms of service. Cryptoassets are therefore an ideal medium to collect donations.

Cryptoassets Received By Entities Fundraising For the Ukrainian Military

Only includes entities explicitly and exclusively raising funds for military procurement.

By far the most well-known military charity in Ukraine is Come Back Alive – constituting over three-quarters of the nearly $35 million in cryptoassets donated to military-centric causes.

Come Back Alive

Come Back Alive was formed in 2014 to help Ukrainian soldiers fighting against Russian separatists. It received a licence to purchase and transfer military equipment to the armed forces. Besides its procurement of military equipment, the charity facilitates numerous other military-based activities, including setting up observation posts, training soldiers, rehabilitation and research.

Since 2014, the charity’s website states that it has received over $130 million in donations. It is unknown if this figure includes crypto donations, which soared since the 2022 invasion to over $26 million. This makes Come Back Alive the second most successful pro-Ukrainian crypto fundraising entity, besides the Aid For Ukraine initiative. One of the biggest donations came from blockchain-based campaign “UkraineDAO”, which donated over $4 million in ETH.

Come Back Alive “March for Defenders” in August 2021.

Cryptocurrency in Conflict

Blockchain-based Charity Projects

Bolstered by the establishment of Aid For Ukraine, many blockchain-based services began launching fundraising initiatives of their own. These took two main forms, namely:

1. Functional changes: services implementing updates to the user interfaces, for example, to

make it easier for users to donate to Aid For Ukraine.

2. Establishment of separate fundraising campaigns: services initiating their own

fundraisers, separate from Aid For Ukraine or other official initiatives.

Uniswap (left) facilitating donations to the Aid For Ukraine initiative and the now-collapsed Celsius Network (right) establishing its own fund.

Many of these funds have utilized DeFi, NFTs and DAOs to facilitate donations. Others have used their formidable outreach or position in the crypto industry to encourage donations. For example, Binance’s “Humanity First” charity has already raised $15.5 million in mostly BNB Coin and Binance USD (BUSD). Binance itself has also pledged $10 million towards the fund. 12

Cryptocurrency in Conflict

Around $72 million worth of cryptoassets have been raised by blockchain-related projects, including by NFT collections endorsed by the government of Ukraine. A lot of these have been dispersed to Aid For Ukraine, Come Back Alive and other humanitarian funds. Notable is how little of these contributions have originated in Bitcoin, which makes up just $1 million (1.4%) of donations. This exemplifies the web3-based nature of most of these initiatives.

Cryptoassets Received By the Wallets of Pro-Ukraine Blockchain Projects

Unchain Ukraine

Unchain Ukraine is a charity founded in February 2022. Among the crypto services involved are Weld Money – a crypto payment provider – and the NEAR Foundation.

Elliptic internal analysis shows that the fund has raised over $9.5 million in cryptoassets since its establishment, of which $5.1 million (54%) originates from the NEAR blockchain. A partnership between NEAR, Weld and Unex Bank launched the “Unchain Help Card” – a virtual crypto debit card – aiming to better facilitate the dispersal of donations.

The Unchain Fund website (left) and the Unchain Help Card (right).

The Fund – which has received a $2.5 million donation from Ethereum founder Vitalik Buterin – also facilitates a Telegram bot named “Unchain Helper”, which connects Ukrainians in need with volunteers based on their queries. The Fund’s website states that donations have been used to procure over 1,400 pieces of body armor and 58,000 ration packs, along with other equipment. 13

“It’s time to stand up for what we believe in, to fight for democracy, and help make the necessary

changes for a better, more open world [...]. This is also a watershed moment for web3, showcasing

the power of crypto for good.”

Marieke Flament, NEAR Foundation CEO14

Cryptocurrency in Conflict

While many initiatives contributed significantly to Ukraine’s resistance efforts, some have been criticized for their opacity and apparent inefficiencies. This was particularly the case for those setting up separate donation wallets rather than simply facilitating donations directly to the official Aid For Ukraine initiative without good reason. Using intermediary wallets increases donations lost in transaction fees, while also increasing the possibility of exit scams. Controversies were raised against at least two major blockchain funds – established by “UkraineDAO” and the now-defunct Celsius Network – over whether the raised crypto was distributed as originally advertised. 15

Humanitarian Aid

Both local and international mainstream humanitarian charities have started accepting crypto donations in addition to standard bank donations. Some charities – such as SOS Children’s Villages – operate across numerous jurisdictions, while others were established specifically to aid the situation in Ukraine. Most pledge to aid displaced civilians, provide essential supplies or medical care to the injured.

Some blockchain-based services and payment processors have helped aid crypto donations to traditionally fiat-based charities. Examples include The Giving Block and “Endaoment”, which provide blockchain integration for charitable organizations. The Giving Block itself has a Ukrainian Emergency Response Fund, which disperses donations across 29 participating charities operating in Ukraine.

A selection of participating charities in The Giving Block’s Ukraine Emergency Response Fund.

Cryptocurrency in Conflict

#BlackPeopleinUkraine

Ranging from the protection of stray animals to helping specific demographics in Ukraine, humanitarian charities have also tended to more niche causes. One online campaign was set up specifically for African students in Ukraine, who were unable to leave the country due to travel restrictions.

The campaign was supported by Nigerian comedian Emmanuel Ogonna Iwueke (a.k.a. Dr Craze or Papa Ade) and singer Oluwatosin Oluwole Ajibade (a.k.a. Mr Eazi). The latter donated 5,000,000 naira ($12,000) in Bitcoin to the fund, which has since received just under $60,000 in crypto donations. A further $21,000 in ETH was donated by pro- Ukraine blockchain project RELI3F UKR.

On-chain data shows that these funds were cashed out through major cryptoasset exchanges between March and May 2022.

Crypto wallets from the #BlackPeopleinUkraine campaign (left) and Dr Craze announcing the donation from Mr Eazi (right).

Cryptocurrency in Conflict

Cyber and Intelligence Groups

A number of organizations have been devoted to the collection of intelligence or cyber activity against the Russian government. These include OSINT investigator communities and hacktivist groups.

Many of these entities are integrated. For example, the Ukrainian Cyber Alliance – a hacking and cyber-defence group raising crypto donations under the banner of “Toss Bitcoin to your hacker” – works together with the OSINT news site Inform Napalm and associate hacking group RUH8. The alliance works to take down pro-Russian sites and hack internal communications, often posting leaks of information relating to military operatives involved in the invasion.

The Myrotvorets Center

The Myrotvorets Center is a Kiev-based NGO with strong links to the Ukrainian government and law enforcement agencies. The Myrotvorets website publishes personal information about individuals considered to be “enemies of Ukraine”, including Russian “war criminals”, mercenaries, propagandists and journalists.

Myrotvorets Center has accepted cryptoasset donations since 2016, and the group found particular success when fundraising for its “IDentigraf” project. IDentigraf is a facial recognition app, which allows users to identify “militants, Russian mercenaries and war criminals” listed in the Myrotvorets database – based on a photograph.

Myrotvorets claims to have received donations from more than 40 countries and appears to have enabled cryptoasset contributions after PayPal closed its account and seized the organization’s funds. To date, it has raised almost $269,000 in cryptoasset donations.

The Myrotvorets website (left) lists “pro-Russian terrorists, separatists, mercenaries, war criminals, and murderers”, and the IDentigraf website (right) illustrating its facial recognition technology.

Cryptocurrency in Conflict

Journalism and News Channels

A range of journalist initiatives – seeking to provide coverage of the front line – have also sought crypto donations to finance their activities. Examples include The Kyiv Independent, which has received around $433,000 in crypto donations – a significant proportion of which is from blockchain projects.

Several media channels have also appeared on social media platforms such as Telegram, often established by individuals living close to the frontline. These channels provide frequent and routine updates of frontline activity as they happen, often also advertising crypto donation addresses to finance either their own activities or for onward dispersal to local soldiers.

The Kyiv Independent, one of the most successful media outlets in terms of cryptoasset donations received.

A pro-Ukrainian Telegram news channel in occupied Severodonetsk collecting and disseminating news about the movements of occupying Russian forces.

Cryptocurrency in Conflict

Non-fungible Tokens (NFTs)

Ukraine’s official crypto donation accounts were publicized during the height of the NFT craze, with the ETH donation address receiving NFT donations on the same day as it was announced.

In late April 2022, a specific ETH address for such donations was created by the Ministry of Digital Transformation. An online NFT gallery – showcasing donated NFTs and allowing buyers to bid for them on the NFT marketplace OpenSea – was launched at the same time.

*https://donate.thedigital.gov.ua/nft.*

Overall, the government has received 1,000 NFTs on the Ethereum blockchain. However, almost two-thirds of these donations have been of scam or spam NFTs that have since been delisted by Opensea. Many of these spam NFTs falsely claimed to be the official collections of large corporations in an aim to drive up their prices.

Besides a high-profile donation of a CryptoPunk NFT – with an average sale price at the time of $133,500 – on March 1st 2022, the remaining donations had an average value of $540. The Cryptopunk remains by far the most valuable NFT donated to Ukraine – with a “mfer” NFT worth just under $10,000 coming second.

NFT donations gradually faded towards the middle of May, which marked the beginning of a price crash in the NFT market and of cryptoassets in general. The CryptoPunk was sold for 90 ETH ($115,000) on June 19th 2022. Overall, Ukraine has directly obtained $190,000 worth of Ethereum-based NFTs through donations.

Cryptocurrency in Conflict

Daily USD Value and Number of (Delisted) Ethereum-based NFTs Donated to the Aid For Ukraine Initiative

on FTM. Ukraine addresses held just over 250 NFTs on Polygon, 160 on Solana, two on Cardano and two NFT donations have also taken place on other blockchains. As of October 2022, the Aid For

Affiliated NFT Projects

Several NFT projects have been created to support Ukraine’s crypto fundraising. These are advertised by the Ministry of Digital Transformation and typically send a percentage of sales proceeds to the government. Most of these projects have automatic donations to Ukraine’s official donation address encoded into their smart contracts – a crucial check to ensure their authenticity. One project supported by the government includes Help UA, a pro-Ukrainian NFT marketplace that raises donations through NFT sales made on its platform.

ETH raised By NFT Projects Supported By the Ukrainian Government

An NFT campaign that allows donors to purchase regions of Russia as NFTs, with proceeds donated to Ukraine.

Ukraine’s Virtual NFT Museum of War

The “Meta History: Museum of War” project is a series of NFT collections that are coded to automatically send 100% of their initial sale proceeds – and 5% of onward sale proceeds – to the Aid For Ukraine initiative.

The concept of the main collections is to document important developments occurring on each day of the war – usually in the form of a tweet from a trusted source – with an artistic backdrop for context. The project involves both Ukrainian and international artists, and it describes itself as having:

“a new take on the role of art in society – it must be relevant, courageous, persistent. And eternal”.

Meta History: Museum of War

Examples from Meta History’s “Warline” collection.

Other Pro-Ukraine NFT Projects

The concurrent NFT craze at the time of the invasion contributed to scores of unofficial projects being developed with a “Help Ukraine” theme, either as collections or a single NFT. Many of these projects promised to donate most – if not all – proceeds to Ukraine, with mandatory donations encoded into some of their smart contracts. Others used a Ukraine theme to drive hype (and by extension) prices for their projects.

Cryptocurrency in Conflict

A selection of pro-Ukraine NFTs available on OpenSea.

Unless they enlisted the official support of the Ukrainian government or went viral in other ways, most pro-Ukraine NFT collections have garnered little attention. However, some notable NFT projects include those established by the Ukrainian Cyberpolice, as well as a record- breaking $6.5 million Ukrainian Flag NFT campaign initiated by UkraineDAO.

The “Putin’s Dictatorship” (first five) and “Ukrainian Heroes” (last four) NFT collections launched by the Ukrainian Cyberpolice. The dictatorship collection was named “Russian Ship: Fck You” in reference to the famous final communication by Ukrainian* Black Sea forces on Snake Island following Russian orders to surrender.

Cryptocurrency in Conflict

UkraineDAO and the Digital Ukraine Flag Worth $6.5 million

Shortly before the war, a DAO was formed to collect donations for Ukraine, including a member of the Russian protest group Pussy Riot as a Co-founder. Though referred to as a DAO, the group – named “UkraineDAO” – was largely centralized.

On February 26th, UkraineDAO launched an NFT of the Ukrainian Flag on Zora NFT Marketplace. The DAO then began a party bidding process, promising to airdrop a new token ($LOVE) to participants – representing fractionalized ownership of the NFT. The bid gathered over 2,258 ETH ($6.75 million), with the flag becoming the tenth most expensive NFT ever sold at the time.

UkraineDAO’s Ukrainian Flag NFT – the 10th most expensive NFT at the time of purchase.

UkraineDAO announced that of the raised funds, just under $4 million was donated to Come Back Alive, $990,000 went to the Aid For Ukraine Initiative, $490,000 went to “OutRight Action International” and $11,000 to “Psychology for Human Rights”. The remainder of the funds – though pledged to charities – became subject to internal disagreement and led to eventual split of the DAO

.16

Cryptocurrency in Conflict

How Crypto Compared

In addition to Aid For Ukraine, the government has also facilitated major fiat-centric donation campaigns. The United24 initiative – which also supports crypto donations – and a “special account for the needs of defence” opened by the National Bank of Ukraine are two of the most prominent examples.

By the end of November 2022, the National Bank special account had received 22.4 billion UAH ($606.7 million) in donations. 17 United24 has received $232.8 million, of which an undisclosed proportion was raised in crypto. When combined, pro-Ukrainian crypto donations – excluding United24 and Monero – constituted just over a fifth of the roughly $1.05 billion garnered by these three major donation campaigns. Though this is the minority, the contribution of crypto is still notable, as the Ukraine-Russia war marks the first conflict where crypto has played such a considerable role.

Pro-Ukraine Crypto Donations Compared to Other Major Donation Campaigns

Crypto Donations - $212.1m United24 - $232.8m National Bank of Ukraine - $606.7m

“Crypto Donations” exclude Monero and United24 crypto donations.

Third party NGOs and humanitarian charities varied widely in terms of the proportion of crypto-to-fiat donations. Of some (non-blockchain-based) charities that provide a live count of donations received, crypto contributed anywhere between 0.3% and 37% of total funds. Charities receiving a higher proportion of crypto funds typically advertised their activities throughout crypto social media communities and displayed their crypto donation options prominently on their websites.

Cryptocurrency in Conflict

Illicit Activity Arising From Ukraine Donations

The majority of crypto activity relating to Ukraine has been for predominantly charitable reasons. However, perpetrators of crypto hacks and scams-both particularly prevalent across the DeFi space-have exploited such causes to their advantage.

Crypto Donation Scams

The cryptoasset ecosystem is no stranger to scams. Phishing attacks, scam cryptoassets (as seen during the canceled Ukrainian government airdrop) and impersonation scams continue to be commonplace. Fraudsters initiating these illicit activities feed on “fear of missing out” (FOMO) and hide behind the irrevocability and relative anonymity of cryptoasset transactions.

Numerous criminals have, unsurprisingly, sought to take advantage of Ukraine’s crypto donation drive. In their most basic form, these scams involve establishing fake Ukraine social media accounts and posting similar messages to the official government account – replacing the Aid for Ukraine crypto address with the scammer’s own.

The official Ukraine Twitter announcement with the genuine Aid For Ukraine donation addresses (left) and an impersonator Facebook scam post with different wallet addresses (right).

Many so-called fundraisers have also appeared across social media – notably Facebook, Twitter and crypto-specific crowdfunding site Tallycoin. In some cases, they exhibit warning signals of scams. These may be the lack of an obvious charity infrastructure in place, a lack of transparent reporting of how funds are dispersed or a lack of endorsements from legitimate entities (such as well-known blockchain developers or the Ukrainian Ministry of Digital Transformation). Some supposed fundraising groups also operated only on social media, without a website, and their profiles were typically established on the same day as the full- scale invasion with little prior following.

Cryptocurrency in Conflict

Two near-identical scam donation campaigns for Ukraine and Russia sporting the same donation address (left) and an airdrop scam based on Ukraine’s airdrop announcement (right).

Elliptic has collected many addresses publicized by scam or likely-scam social media channels and websites. Most of this sample do not have any incoming transactions, suggesting that the online cryptoasset community has been largely resilient to these scam attempts.

The remaining addresses show an incoming cryptoasset value just under $100,000. Most of these funds have then either been sent through centralized exchanges, peer-to-peer exchanges or to other wallets known to be associated with fraudulent activity. Several fundraisers that sport a number of red flag indicators have received a further $240,000. These red flags will be discussed in the forthcoming summary of this section.

Cryptoassets Received By Confirmed Ukraine Donation Scam Wallets

Bitcoin (BTC) - $53.6k Ether (ETH) - $21.6k Tron (TRX) - $16.0k Tether (USDT) - $4.2k BNB Coin (BNB) - $3.3k Others - <$0.1k

DeFi Hacks and Ukraine

There have been cases where perpetrators of illicit activity have donated small amounts of funds to Ukraine, often for either undisclosed or technical reasons. One example of the latter was the hacker of stablecoin protocol Beanstalk Farms in April 2022 – who donated $250,000 of hack proceeds to “Aid for Ukraine”. The perpetrator also used the Ukrainian cause opportunistically to initiate the hack, as described in the case study on the next page.

Cryptocurrency in Conflict

UkraineDAO and the Digital Ukraine Flag Worth $6.5 million

Between April 16th and 17th, an exploiter initiated a series of malicious transactions targeting the Ethereum-based decentralized stablecoin protocol Beanstalk Farms. The exploiter purchased 212,858.50 BEAN – the protocol’s native stablecoin – with an initial 73 ETH investment.

The criminal then proposed two “Bean Improvement Proposals” (BIPs) to Beanstalk’s smart contract code. Proposals for code changes are common in DeFi, with their approval subject to democratic consensus by the protocol’s users. The BIPs – disguised as Ukraine donation proposals – were malicious proposals to transfer the protocol’s funds to the explorer’s own wallet, which were already creating controversy among confused users before the theft.

Upon taking out a flashloan of almost $1 billion in assets, the exploiter accumulated a roughly 67% “stalk position” – the protocol’s term for voting power. Per the protocol’s rules for the acceptance of BIPs, the exploiter was then able to single-handedly approve the malicious proposals to transfer funds into their wallets.

The protocol lost $182 million overall, though the hacker only made $76 million due to the rapid depreciation of the value of BEAN. Funds were converted into ETH and sent through Tornado Cash. As per one of the BIPs, $250,000 in USDC was sent to Aid For Ukraine. In response, Kuna Founder Michael Chobanian offered to return the funds to Beanstalk and did so within a week of the hack.

“Hey! We received 250,000 USDC from your stolen funds. Unlike Russian soldiers in Ukraine, we do not take other

people’s possessions. Please verify your account on kuna.io and we will return the funds. Slava Ukraine!”

Michael Chobanian, Founder of Kuna Exchange, to Beanstalk Farms-April 18th 2022.

Kuna’s Chobanian offering to return the stolen funds (left) and Elliptic Investigator showing the exploiter’s donation to Ukraine and their subsequent return (right).

Cryptocurrency in Conflict

Summary and Best Practices

The official Aid For Ukraine crypto donation campaign – along with the Ukrainian government’s willingness to engage with NFTs and other blockchain-related technologies – is an unprecedented step for cryptoassets in terms of mainstream adoption. The rapid surge in donations mere hours after official donation addresses were launched – culminating in at least 20% of overall non-state-mandated Ukrainian aid – has further shown that the Ukrainian government’s call to embrace crypto was the right one.

Besides the Aid For Ukraine initiative, the success of many blockchain-based campaigns and crypto-accepting military and humanitarian charities has further showcased the positive contribution of cryptoassets during the war. Facilitating humanitarian aid and contributing to national defence are now cemented as tried-and-tested use cases of blockchain technologies. As Deputy Digital Transformation Minister Alex Bornyakov has noted, the benefit of crypto can be crucial, especially when fast and immediate support was needed in the first days of the invasion.

These experiences have, however, also brought out the risks of mainstream crypto-based crowdfunding. Be it donation or airdrop scams, inefficient campaign structures or internal schisms within third-party campaigns, the initial months of the war have acted as a learning curve for the cryptoasset community, and technology developers in particular. These observed issues have contributed to a better understanding of best practices when it comes to large- scale fundraising through crypto. Recommendations to this effect include:

Structure of Donation Campaigns

Cryptocurrency in Conflict

The MetaHistory NFT smart contract includes a built-in “withdraw” function to the official “Aid for Ukraine” Ethereum address.

Cryptocurrency in Conflict

Overcoming Donation Scams

• Tokens for airdrop campaigns will most likely – unless explicitly stated otherwise – be created through a “contract creation” transaction by the official wallet initiating the campaign. Any token claiming to be the official airdrop token that is not created by an official wallet address is most likely a scam. This can be verified through open-source blockchain explorers.

• Always check URLs of websites to ensure they are spelt correctly and are the genuine website of the crowdfunding campaign. Domain squatters and phishing scammers will typically use similar-looking domain names to the sites they are aiming to impersonate.

• Always verify that the addresses being donated to are correct. This can be done by ensuring that the websites and social media channels from which they are retrieved are official (i.e. verified and blue-ticked). Numerous block explorers will also label the official wallet addresses – providing a second form of verification.

• Be cautious of donation campaigns with no apparent infrastructure or roadmap for how incoming donations will be utilized.

Additional red flags of such scam campaigns may include:

• Newly established websites or social media accounts with minimal followers.

• Images, profile pictures and other branding are lifted from other channels.

• No wider endorsements or media coverage.

• Social media followers are predominantly fake accounts, with no activity history or profile pictures.

Russia

Cryptocurrency in Conflict

Look out for the following specific items of content throughout this report:

Red Flags & Warning Signals

Warnings describe significant issues and trends in criminal behavior that are worth highlighting and can indicate suspicious activity. Red flags are indicators of risk that might not clearly pinpoint illicit activity as a standalone.

Diagrams and Flowcharts

Illustrations, diagrams, graphs and charts are included throughout to help you visualize the nature and scale of blockchain activities of discussed entities and, where possible, give a relative view.

Case Studies

Wherever possible, real-life examples of how pro-Ukrainian and pro-Russian entities are utilizing cryptoassets are included to contextualize the discussed trends.

Key Controls & Best Practices

A guide of lessons learned and key recommendations for maintaining sanctions compliance and robust anti-money laundering and counter-terrorist financing processes in light of risks arising from the war in Ukraine.

Elliptic Blockchain Analytics

A spotlight into the screening and blockchain investigation tools we use at Elliptic to identify and trace pro-Russian cybercriminal and illicit fundraising activities.

Blockchain data provided in this report is accurate up to and including November 2022, unless otherwise stated. Further details can be found in the methodology section.

Cryptocurrency in Conflict

Overview

In contrast to the highly publicized crypto campaign by the Ukrainian government and various charities, crypto donations on the Russian side have been more limited in both volume and publicity. Russia itself has historically taken a legally restrictive stance against cryptoassets, with the country’s central bank advocating a comprehensive ban on the use of crypto shortly before the war.

18 Though Russian officials have touted accepting Bitcoin as payment for oil and gas exports, the crypto-averse stance of the country has likely contributed to the comparatively limited use of crypto to finance the invasion. The majority of the identified $4.8 million of cryptoassets raised have been donated to military fundraisers.

Types of Pro-Russian Fundraisers By USD Value of Cryptoasset Donations

Cryptocurrency in Conflict

The Most Popular Cryptoassets

Unlike pro-Ukraine fundraisers, most pro-Russian crypto donations have been in Bitcoin, with comparatively little attempted utilization of DeFi protocols to facilitate campaigns. ETH and other assets heavily used in the DeFi space have therefore contributed relatively little. The few times pro-Russian entities have attempted to emulate Ukraine’s success by engaging with DeFi projects – such as NFT collections – have almost always ended with failure. Case studies of such attempts will be provided throughout this section.

Cryptoassets Received By the Wallets of Pro-Russian Fundraisers

Bitcoin (BTC) - $3.6m Ether (ETH) - $733.1K Tron (TRX) - $361.0k Litecoin (LTC) - $85.0k USD Coin (USDC) - $21.0k Tron (TRX) - $16.5k BNB Coin (BNB) - $11.6k Others - $35.9k

Cryptocurrency in Conflict

Blockchain Activity Over Time

Prior to the invasion, pro-Russian fundraisers routinely managed to garner less than $1,000 in cryptoasset donations per month. These have soared since the full-scale invasion, with pro-Russian fundraisers managing to maintain a largely steady stream since. The months of June and July saw large wallet movements – which may not necessarily be attributed to donations – in wallets specifically controlled by one military fundraiser (MOO “Veche”) that will be discussed in the forthcoming case studies.

Monthly BTC and ETH flows into Pro-Russian Wallets

$1,000,000 $935.1k $935.1k

$865.4k $865.4k

$750,000

$500,000

$250,000 $179.8k $179.8k $153.9k $153.9k $133.8k $133.8k $64K $64K $83.5k $83.5k $92.6k $92.6k $66.1k $66.1k $60.9k $60.9k $30.8k $30.8k $43.2k $43.2k $130 $130 $127 $127 $910 $910 $1.4k $1.4k $609 $609 $181 $181 $81 $81 $210 $210 $52 $52 $30 $30 $558 $558 $0

Jan 21 Feb 21 Mar 21 May 21 Jun 21 Jul 21 Aug 21 Sep 21 Oct 21 Nov 21 Dec 21 Jan 22 Feb 22 Mar 22 Apr 22May 22 Jun 22 Jul 22Aug 22 Sep 22 Oct 22 Nov 22

Military fundraisers Self-described “Humanitarian Causes” Hacktivism Disinformation & Censorship Individuals under Ukrainian Government Inverstigation

Cryptocurrency in Conflict

The Origin of Donations

Despite being limited in volume, separatist fundraisers often have a nexus to cybercrime, sanctioned entities or entities that openly advocate or glorify potential violations of international law. Dark markets constitute the fourth largest known source of donations to pro- Russian fundraising campaigns. A significant portion of donations, however, came from mixers, with smaller amounts originating from similar obfuscation protocols such as privacy wallets and coin swap services. These indicate possible efforts to conceal illicit funds before donating.

Origins of Donations to a Sample of Pro-Russian Wallets

Exchanges - 37.9% Mixers - 33.5% Decentralized Exchanges - 6.3% Dark Markets - 5.9% Privacy Wallets - 3.6% OFAC Sanctioned Entities - 3.0% Coin Swap Services - 2.8% Peer-to-Peer Exchanges - 1.4% Credit Card Data Vendors - 1.0% Others - 4.6%

Based on a sample of $2.5 million of BTC, ETH and USDT, USDC and DAI on the Ethereum blockchain.

Cryptocurrency in Conflict

Crypto Fundraising Before the Invasion

Though several fundraising initiatives began after the February 2022 invasion, several organizations and individuals have been financing separatist actions in eastern Ukraine since 2014, following the annexation of Crimea. Specifically, many of these groups were involved in separatist campaigns in Donetsk and – to a lesser extent – Luhansk.

A fundraiser for Igor Girkin, former “Minister of Defence” of the so-called “Donetsk People’s Republic”, featuring a Bitcoin address receiving over $5,000 in donations. Girkin and two others were found guilty in a Dutch court for shooting down Malaysia Airlines flight MH17 in 2014.

Donbass shipments of body armor and radios to pro-Russian forces in 2014.

Cryptocurrency in Conflict

Most organizations predating the February 2022 invasion have continued or amplified their contributions throughout the war. One such fundraiser is discussed in the case study below.

The Novorssiya Aid Coordinating Center

The Novorissya Aid Co-ordinating Center (KCPN) was founded on May 10th 2014, purportedly after a Donbass separatist fundraising appeal of its now-founder Alexei Markov went viral. Its coordinators and volunteers are heavily involved with the Russian Volunteer Communist Detachment, which fought in the Donbass. Alexander Lyubimov – the KCPN’s apparent leader at the time of writing – has advocated the tactical use of nuclear weapons in Ukraine.

“I believe that in the approaching war between Russia and Ukraine, the use of tactical nuclear weapons by

Russia is acceptable and even desirable.”

The KCPN providing sniper training to Russian soldiers (left) and procured quadcopters due to be transferred to the frontline (right).

Cryptocurrency in Conflict

Military Fundraising Campaigns

The most widely observed use of cryptoassets by Russian separatist groups is to procure and provide military equipment – lethal and non-lethal – to Russian soldiers and mercenaries. Many undertake similar activities to the previously-mentioned KCPN, which continues to be active in fundraising for the invasion.

Groups typically advertise donation addresses and lists of what they intend to purchase. They then often provide spending reports on dedicated Telegram channels, complete with photographic evidence of the purchase and delivery of military equipment.

These groups mainly organize through Telegram or the Russian-speaking social media platform VKontakte (VK). They can take different forms, including:

1. In-house funding for regiments or combatants: fundraisers organized directly by

individual fighters, regiments or mercenary groups that intend to use donations to purchase equipment for themselves.

2. Dedicated fundraising and procurement organizations: entities set up – often by former

pro-Russian fighters – to procure and distribute equipment among active personnel.

3. “Civilian” fundraisers: some civilians across eastern Ukraine who back Russia’s

annexation have set up fundraisers to purchase equipment for pro-Russian fighters.

“Remember, the more help to the front, the more dead Nazis and the closer the defeat of NATO.”

Pro-Russia military fundraiser (anonymized)

Cryptocurrency only makes up a portion of these entities’ fundraising efforts, with bank accounts at Russian banks or online payment methods advertised as more mainstream donation options. Entities providing detailed transaction reports show that crypto mostly constitutes a small proportion of their overall donations. Elliptic has identified around 50 military fundraising campaigns advertising crypto donation wallets – collecting a combined $3.2 million worth of cryptoassets.

Cryptocurrency in Conflict

Cryptoassets Received By Confirmed Ukraine Donation Scam Wallets

Many of these fundraising organizations have direct or indirect links to PMC Wagner – also known as the Wagner Group – which is a private military organization known for its close association with the Kremlin. Wagner has been attributed to human rights abuses in Ukraine and has been sanctioned by the United States, United Kingdom and the European Union.

In-house Funding

Several regiments, private mercenary groups or individual fighters have used social media as their own propaganda channels. These are often used to provide updates on their “advances”, post videos of captured Ukrainian soldiers or directly appeal for funding.

One group collecting direct donations for their activities is Task Force Rusich – arguably one of the most notorious mercenary organizations active in Ukraine.

Task Force Rusich

Task Force Rusich (a.k.a. DSHRG Rusich) – a paramilitary fighting group – has its origins dating back to 2009. A far-right fighting group known for neo-Nazi symbolism on the battlefield, Rusich has been involved in military campaigns in Syria as well as Ukraine. It is affiliated with the Wagner Group and is thought to have been particularly involved in the failed Kharkiv offensive since the February 2022 full-scale invasion.

Rusich has been sanctioned by the United States, United Kingdom, European Union and Canada. Its leaders – Alexey Yurevich Milchakov and Yan Igorevich Petrovskiy – were also sanctioned. Besides raising over $105,000 in crypto donations, Rusich has also advertised a particularly brutal use for cryptocurrency in its Telegram channels:

“If you can identify the bodies of those killed, don’t just give them away. Take the coordinates

of the exact burial place […] and offer relatives the details for $2,000-$5,000. Money can be

transferred to your Bitcoin wallet.”

DSHRG Rusich – September 2022

Task Force Rusich remains active despite sanctions, posting images of their activities on social media.

Cryptocurrency in Conflict

Dedicated Fundraising & Procurement Groups

Fundraising and military procurement groups – such as the previously-discussed KCPN – often operate through a network of volunteers based across Russia and the occupied regions of Ukraine. They typically host fiat donation accounts in Russia, where they may also host physical donation collection points in Moscow, St Petersburg and other border cities. Operatives then procure military equipment with the funds and disperse them across the frontline in Ukraine.

An online military gear vendor store used by a number of dedicated procurement groups (left) and a procured collection of walkie-talkies, headsets and microphones ready to be dispersed (right).

Due to the overall complexity of fundraising, procuring, transporting and dispersing equipment across a large and militarized geographical area, these groups often operate under a coalition structure. Numerous groups have joined forces to increase the efficiency of their operations, while others themselves function as a loose network of volunteers.

Cryptocurrency in Conflict

MOO Veche The Interregional Public Organization (MOO) “Veche” is a military fundraising group active in the Donbass. Its chairman is Vladimir Orlov – a military technician and engineer – who has advocated bombing Ukrainian civil servants and families of Ukrainian intelligence officials. “On Monday, at 11:00am, when the maximum number of Kyiv officials come to work, I would launch a massive missile attack on all administrative […] buildings in Kyiv. And in the evening, I would repeat such a strike on places where the families of employees of the [Security Services] densely reside.” Vladimir Orlov – Head of MOO “Veche” Elliptic has identified – with medium/high certainty – approximately $1.8 million in Bitcoin flowing into MOO Veche-linked wallets, though not all may be linked to public donations. This makes them the wealthiest pro-Russian fundraising group in terms of cryptoasset holdings. Funds are spent on military combat gear, including drones, thermal imagers, surveillance equipment and tactical medicine.

A collection of supplies donated by MOO “Veche”.

Cryptocurrency in Conflict

Z-Coalition OPSB

The OPSB is a fundraising organization active in the Donbass, comprised of a coalition of Telegram channels headed by volunteers. Most are, or were at some point, involved in direct conflict. The OPSB prefers its acronym to be shrouded in mystery and refuses to publicize its full name. It does, however, have a motto: “On Foot to Victory”. It is closely affiliated with the Wagner Group and the Novorossiya Aid Co-ordinating Center (KCPN).

The OPSB claims to receive $322,000 in donations per month. Overall, it has raised $69,000 through crypto, indicating that cryptoassets constitute 3% of the OPSB’s alleged monthly income. The group publishes images and reports of how donations were spent and distributed across separatist forces in Donetsk and Luhansk. The OPSB’s head – Igor Mangushev – has been accused of violating international law, having once been filmed making a speech holding a skull that he claimed belonged to a dead Ukrainian fighter. 19

“If I had started volunteering in 2022, I would’ve been completely burnt out by now. I would’ve

just spent all the donations on booze and left.”

Igor Mangushev, Head of the OPSB Fund20

Russian soldiers with equipment supplied by the OPSB, including a Mavic 3 drone (left).

Cryptocurrency in Conflict

“Civilian” and Saboteur Fundraisers

A number of pro-Russian civilians and saboteurs in the occupied regions of Ukraine have also initiated fundraisers for Russian forces and mercenaries. These initiatives have typically been aimed at like-minded supporters within the same or nearby neighborhoods and have often relied on physical donations.

Some of these fundraisers have been initiated by prominent bloggers, news personalities and individuals who have boasted close links with the Kremlin. Given their comparatively wider reach, they have been relatively successful in collecting donations in comparison to local fundraisers or dedicated groups.

Romanov Light

Romanov Light – a pro-Russian military blogger with over 74,000 subscribers on Telegram – has often run collection fundraisers for different squads of the Russian border force. Romanov’s Telegram channel also features a bot that allows subscribers to report coordinates of Ukrainian troops for airstrikes.

He has led one of the more successful fundraisers – collecting over $342,000 in cryptoassets. Over $12,000 of this Bitcoin has originated from a dark web market called Apollon and has been cashed out predominantly through centralized exchanges.

Romanov (2nd left) with members of the Russian border guard in Belgorod, handing over donated thermal imagers and binoculars.

Cryptocurrency in Conflict

Funding Military Research and Development

While most fundraisers have aimed to procure military equipment, some have focused on more niche endeavors, such as the development of improved combat gear. Drones – which have proven crucial on both sides of the war – have been a top area of focus.

The “People’s Drone”

In September 2022, a Telegram channel affiliated with the OPSB and Wagner Group published a campaign to build a new drone named PERSEUS-1 – the “People’s Drone” – funded entirely through donations. The project was initiated after the work of the pro- Russian “PERSEUS” air reconnaissance group in the Kharkiv region proved ineffective with their existing quadcopters.

“We do not have time to knock on the doors of ministries and other institutions to receive funding,

and to be honest, we do not believe in a positive outcome. The bureaucracy has not gone away.”

Telegram Announcement of the PERSEUS-1 Project

The initial prototype of PERSUS-1 was estimated to cost approximately $221,000, a target for donations that have since been reached. Crypto donations in Bitcoin and Ether-based assets amounted to just over $8,400 – just under 4% of this target.

PERSEUS-1 Prototype with its “unnamed little brother” (left), with crypto donation addresses on Telegram (right).

Cryptocurrency in Conflict

The (Dis)information War

Another substantial area of fundraising has been the collection, dissemination and wider propaganda efforts surrounding military intelligence. Crypto has played a part in these functions, either as a medium for donations or incentives for cooperation. Overall, entities involved in the disinformation war have received approximately $130,000 in cryptoassets.

Cryptoassets Received By Confirmed Ukraine Donation Scam Wallets

Collecting Military Intelligence

Similar to the Telegram bot run by Romanov Light, Russian forces have aimed to use social media – with crypto rewards – to solicit intelligence on Ukrainian positions. One Telegram bot claiming to be an official outlet of the Donetsk People’s Republic People’s Militia has also sought to solicit such intelligence, offering Bitcoin in return. The bot has been shared by the DPR’s Deputy Information Minister Daniil Bezsonov.

The “People’s Militia” Telegram bot that offers crypto for reporting information.

News and Propaganda

An army of bloggers, journalists and other personalities have initiated fundraisers to continue the development of their work, often involving news from the frontline or podcasts featuring analyses of developments. Some non-Russian sympathizers – which has included support from American far-right personalities – have also engaged in distributing such content.

In many cases, such channels provide crypto addresses for subscribers to finance their work. Compared to military fundraisers, such personal campaigns often fare poorly. Among some of the more niche propaganda channels is one consisting of pro-Russian anime memes. The owner of the channel, however, has only received $52 in crypto donations.

Left: an anime character points a gun with the caption: “Crouch, brother, behind the liberal.” Right: a comparison between the situation in August and September 2022, taking aim at Russia’s partial mobilization. The top scenario shows civilians urging the Ministry of Defence to fight, while the bottom one shows the Ministry of Defence urging civilians to fight.

Propaganda channels are highly popular among Russian speakers, and many boast several hundreds of thousands – if not millions – of subscribers. Key reasons for popularity include the presence of ex-army officers close to the Kremlin or early intelligence from the frontline.

Cryptocurrency in Conflict

Rybar

One of the most well-known military news channels is “Rybar”, which boasts over

1.1 million subscribers. The channel posts updates of latest military engagements and positions, in addition to providing high-quality military maps. The group posts crypto donation addresses with almost every update, which have received over $43,200. An update provided by Rybar on November 10th 2022; following Russia’s announced withdrawal from the city of Kherson.

Rybar has since launched two NFT collections, called “Man at War” and “War Machines”. Both were created by an account also behind a third – apparently non-war-related – collection launched in January 2022. No sale has been recorded on either war collection, with Rybar apparently dropping all advertising for its NFT campaign in August 2022.

The ”Man at War” (left) and “War Machine” (right) NFT collections, available in both English and Russian.

Cryptocurrency in Conflict

Censorship and Disinformation

Particularly since the allegations of interference in the 2016 US presidential election, Russian authorities have been attributed on many occasions to fostering censorship and disinformation – both domestically and internationally.

Be it political interference or maintaining the pro-government narrative on the “special military operation”, many of the key operatives accept crypto donations to fulfil their goals. The US has also identified that a number of these entities – such as the disinformation site “Southfront” – receive direct taskings from the Russian FSB. 21 Southfront has since been sanctioned by the United States.

The website of sanctioned disinformation site Southfront with crypto addresses (left) and the now- suspended YouTube channel of pro-Russian blogger Kirill Fedorov, with the Russian Ministry of Foreign Affairs’ objection to his March 2022 arrest in Latvia on treason charges (right). Crypto wallets set up to fundraise for Fedorov have not yet received any donations.

A Pro-Russian Telegram “news aggregator”, self-described as being funded by the Russian Government.

Cryptocurrency in Conflict

The Information and Coordination Center

The Information and Coordination Center is a pro-Russian disinformation and media censorship channel. Its lists its priorities as (1) blocking distribution channels of “hostile propaganda” in social networks and instant messengers, (2) blocking propaganda sites that spread “false information” and (3) investigating violations of citizens’ “rights and freedoms”.

The group also refers to itself as the “Anti-Nazi Information Front”. It drafts complaint messages for its supporters to report to the Russian authorities about individuals raising opposition to the war, which in many cases can result in hefty fines or prison sentences in Russia. It also has a “hack team” which has claimed responsibility for an attack on the Ukrainian channel UATV. It provides numerous tools, including one named “NO NAZI” – that allows sympathizers to launch cyberattacks on pro-Ukrainian sites. It has raised approximately $7,000 in cryptoassets.

“The tactics are as follows: we send complaints to the page and groups, and also make a report to the

Ministry of Internal Affairs on the basis that they are discrediting the Russian Federation Armed Forces!”

ICC

The ICC’s “NO NAZI” distributed denial of service (DDOS) attack launcher (left) and their proposed complaint text when reporting pro-Ukrainian Telegram channels (right).

Cryptocurrency in Conflict

“Humanitarian” Projects

Several groups have been established in occupied areas to provide apparent “non-military” aid to local residents. Such groups are typically focused on rebuilding infrastructure destroyed during fighting or supplying essential services such as healthcare and education.

Since most of these “humanitarian” groups actively support the invasion, the true extent to which they are exclusively fundraising for non-military causes is disputable. Some are opaque about what they are raising funds for; one group has stated that they will decide how to spend donations “only after the real needs are clarified”.

Imposing the Russian Curriculum in Ukrainian Schools

The Russian Humanitarian Mission is a multi-purpose “humanitarian” group delivering aid to residents primarily in the Donbass, though it also has influence across Serbia, Azerbaijan and other former Soviet countries. According to its Telegram channel, aid includes food, medicines, diapers, water filters and magazines. The group is apparently aided by young volunteers from the Russian Foreign Ministry and has support from some Russian celebrities, who occasionally join them on delivery missions.

Some posts from the group indicate that they are involved with the controversial imposition of the Russian curriculum on local schools through the distribution of Russian textbooks in the occupied regions of Ukraine and breakaway regions of Georgia. There are also indications that the group supplies Russian soldiers on the front line, for which they have openly expressed support.

The group – which is also advertised across numerous military fundraising and mercenary groups – has raised over $191,000 in cryptoassets.

A “humanitarian” delivery in a town in Luhansk (left) and images from the donation of a pro-Russian war book to a school in Donetsk (right).

Cryptocurrency in Conflict

Engagement With NFTs

As the case study of Rybar shows, pro-Russian entities are no strangers to NFTs. In October 2021, Elliptic identified NFTs worth an apparent $532,000 in an Ethereum wallet belonging to sanctioned Russian exchange Chatex. Telegram channels supporting the Wagner Group have also encouraged the purchase of NFTs as an investment strategy. Interest in NFTs in separatist circles has seen an identifiable growth ever since the Ukraine government’s crypto campaign.

A pro-Wagnar Telegram channel advertising NFTs (left) and the now-deleted OpenSea profile of a Chatex wallet holding NFTs (right).

Project Terricon

In April 2022, a pro-separatist website named “The Terricon Project” appeared and began soliciting crypto donations to procure military equipment for separatist fighters. The project has been visibly backed by Alexander Zhuchkovsky, a supporter of the sanctioned far-right Russian Imperial Movement (RIM). Zhuchkovsky was himself sanctioned by the US in June 2022. 22

The group has raised $3,400 in cryptoassets and has also launched an NFT collection, consisting of coats of arms of Ukrainian cities claimed by Russia. The collection was speedily deleted by NFT marketplace OpenSea before any NFT could be sold. The Terricon site itself states that the failed NFT project was inspired by the successful UkraineDAO NFT fundraiser.

The delisted Terricon NFTs.

Cryptocurrency in Conflict

The Nexus Between War and Cybercrime

Some of the most notorious cybercriminal activity occurring today is perpetrated by Russian- speaking operatives. These include ransomware groups, malware, dark web markets, stolen credit card and data vendors, Ponzi schemes, illicit no-KYC crypto cash-out services and election disinformation.

Underpinning these are a vast array of underground cybercrime forums, where services are advertised, and black-hat hackers recruited. The formidable Russian-speaking cybercrime network has had a part to play in the lead-up to and during the Russian invasion of Ukraine.

Russian Cybercrime in the Lead-up to the Invasion

The lead-up to Russia’s February 24th invasion involved a period of intense diplomacy, particularly between Russia, the United States and other members of NATO. Cybercrime of Russian-origin – and the accusation that Russia’s security services were doing little to counter it – were prominently espoused grievances from NATO’s perspective. The issue of Russian- speaking ransomware gangs was discussed in a phone call between US President Joe Biden and Russian President Vladimir Putin in July 2021. 23

As a potential gesture of diplomatic appeasement, a spate of seizures and arrests of Russian ransomware operatives and data vendors were initiated by the Russian Federal Security Service (FSB) in January 2022. On January 14th, the FSB arrested 14 individuals and raided addresses believed to be linked to the REvil ransomware group, announcing that the group had been dismantled. 24 Until the raid, it had been one of the most prominent and active of Russian ransomware groups, being involved in attacks against and data thefts from Apple, meat processing company JBS S.A and celebrities such as Madonna and Lady Gaga.

A message displayed on a computer after being infected by REvil ransomware.

Cryptocurrency in Conflict

The Near-demise of the Stolen Credit Card and Data Market

Perhaps the biggest casualty of the FSB’s cybercrime crackdown, however, were stolen credit card and data vendors (“carders”). On January 12th 2022, the leading carding vendor site UniCC – along with its sister site Luxsocks – abruptly announced that it was closing, having raked in more than $362 million in crypto payments. 25 Despite providing ten days for its users to withdraw their funds before going offline, the market disappeared in mere days. Its administrator was later arrested, with Luxsocks’ URL displaying an FSB seizure notice.

Less than a month later, the FSB arrested six individuals and seized a further four carding sites that had made more than $263 million in crypto – including the next market leader Ferum Shop and Trump’s Dumps, UAS Store and Sky Fraud forum. 26 In response, two other major carding sites – All World Cards and C2bit – “exit scammed” by abruptly shutting down and transferring out users’ Bitcoins, most likely in fear of being the FSB’s next targets. C2Bit’s Bitcoin addresses – which had facilitated over $150 million of illicit carding payments since 2014 – had just $34 left in them after the exit scam. The FSB allegedly shut down a further 90 lesser-known vendor stores in March 2022. 27

“This looks to be, at least for the moment, the death of the carding scene.”

Baely (@notbdak) – Twitter post – February 10th 2022

The carding market suffered significantly following these seizures. Closed stores accounted for over 85% of illicit data trades in December 2021, with monthly Bitcoin trades decreasing by more than half ever since.

UniCC (closed January 2022, left) and the four sites seized in February 2022 with their subsequent FSB seizure notice (right).

Cryptocurrency in Conflict

All World Cards announces their (permanent) “holiday” prior to their exit scam (left) and Elliptic Investigator showing C2Bit’s post-scam Bitcoin flight (right).

Since the invasion, it has been reported that the criminal cases against many arrested Russian cybercriminals have been paused or dropped, which Russia has attributed to the suspension of cooperation with the US. 28

The Conti Leaks

One ransomware group that firmly backed the Russian government following the invasion of Ukraine was Conti – a group known for its attacks on critical infrastructure, particularly health services in Ireland and New Zealand. On February 25th – a day after the invasion began – Conti announced its support for the Russian government and threatened retaliation against any cyberattacks targeting the country.

Days later, a pro-Ukrainian anonymous account on Twitter unleashed over 60,000 leaked messages between Conti operatives, detailing the group’s structure, relations with Russian security services and behind-the-scenes operations. The leaks were initiated in opposition to the group’s support for Russia, with the leaker’s Twitter bio simply reading “f*ck ru gov”.

Conti’s announcement of support for Russia on February 25th 2022 (left) and the Conti leaks account discussing their rationale (right).

Cryptocurrency in Conflict

Elliptic has analyzed the leaked messages and used its Holistic Screening capabilities to trace Conti ransom payments across numerous blockchains and cryptoassets. It has identified that Conti’s post-ransom money laundering operations involve a significant amount of cross- chain transfers and exchanges, including through sanctioned crypto exchange Garantex and cross-chain bridge “renBridge”. Elliptic has previously identified that over $540 million of illicit cryptoassets have been processed by renBridge. 29

“I cannot shoot anything, but I can fight with a keyboard and mouse.”

“Danylo” (pseudonym), Conti Leaks hacker, March 30th 2022.30

Russian Hacktivist Groups

Before and during the war, Russian hacktivist groups have emerged – targeting online services and essential functions of Ukraine and countries supporting Ukraine. Some work as closed groups, publicizing their exploits and requesting crypto donations. Others work more publicly, inviting pro-Russian supporters to pick victims of attacks.

Xaknet members posting Ukrainian crypto wallets and implying that the team should hack them.

From the latter, one group named “Xaknet” was invited to target wallet addresses belonging to some pro-Ukrainian donation campaigns. The group itself does not take crypto donations itself but instead diverts funds to a fundraiser under the name of “Russian Spring”, which purchases UAVs for the army. Russian Spring has raised over $50,000 in cryptoassets through donations.

“We can’t hack your ex’s page on social media.”

Xaknet make its priorities clear on its Telegram channel.

Cryptocurrency in Conflict

Killnet

One of the most prolific hacktivist groups – known for numerous takedowns of pro- Ukrainian websites and services – is Killnet, founded in November 2021. Attacks for which it has claimed responsibility include the US White House website, alongside the digital infrastructure of numerous Ukrainian and other European countries. In April 2022, the Five Eyes intelligence alliance – made up of agencies from Australia, Canada, New Zealand, the UK and US – issued a warning of Killnet’s activities. 31

Killnet is run by a hacker named “Killmilk”, who also recently granted admin privileges to known dark web hacker and illicit forum host “Blackside”. The group posts news of its exploits on its Telegram channel along with homophobic content and calls to arms. Furthermore, it has raised over $155,000 in cryptoasset donations.

KillMilk’s desktop setup (left) and a Telegram post encouraging hackers to join a distributed denial-of-service (DDOS) attack against the websites of Polish state institutions (right).

Killnet also has an alliance with Solaris – a Russian-speaking dark web drugs market. Elliptic’s analysis suggests that a third of Killnet’s Bitcoin donations (almost $47,000) originates from Solaris, which itself was hacked by a rival dark market in January 2023.

Transactions originating from Solaris ending up in Killnet’s Bitcoin donation address.

Cryptocurrency in Conflict

Financing War Through Russian Cybercriminal Activity

Despite war-related turbulence, Russian-speaking cybercrime has nevertheless featured prominently in the financing of mercenary or military procurement groups. Over $250,000 of crypto donated to such groups has originated from cybercriminal activities, predominantly from dark web markets and credit card data vendors. Prominent sanctioned dark web markets such as Hydra are particularly significant sources of donations.

Elliptic Investigator shows a prolific vendor of stolen credit card data – active on carding store “Benumb” – donating to a pro-Russian fundraiser group and military equipment vendor named “Serbian Divergent”.

Top Illicit Origins of Incoming BTC to Pro-Russian Wallets

Scams and Ponzi Schemes

Crypto scams and rug pulls are a well-known phenomenon. It was, after all, an attempted scam token that likely resulted in the Ukrainian government canceling its planned airdrop in March 2022. Russian separatists have initiated scam “pro-Ukraine” donation campaigns to mislead donors into giving crypto to Russian entities instead, in a manner that caused many Ukrainian donation websites to issue warnings about scam fundraisers.

“The Russian government and other potential criminals are trying to disrupt fundraising efforts

by creating fake campaigns. Please trust ONLY the resources listed […] and double-check the URLs!”

war.ukraine.ua32

The same BTC and XMR addresses being shared by a pro-Russian Telegram channel (left) and a fake Azov Regiment channel (right).

Pro-Russian separatists have used scam crypto tokens for more sinister purposes, dating back to the initial invasion of Crimea. Numerous separatists in Donetsk – including the current “head” of the so-called “Donetsk Peoples’ Republic” Denis Pushilin – have been associated with Ponzi schemes, such as MMM Global. 33

Senior DPR official Aleksey Muratov – who is sanctioned by the United States for reasons including but not limited to his involvement in fraud – has also been associated with Ponzi schemes E-Dinar, PRIZM and later Ouroboros. 34 Muratov was also involved with OneCoin,35 the notorious scheme headed by “Cryptoqueen” Ruja Ignatova.36

Muratov shills PRIZM with a “DPR” flag on his desk (center) and a knock-off scammer attempts to promote another scam cryptocurrency (top-left).

Cryptocurrency in Conflict

Measures to Prevent Russian Fundraising

Ukraine has repeatedly called for cryptoasset exchanges to block Russian accounts since the start of the invasion. Though this was initially met with mixed reception, Coinbase has since 37 Binance – the blocked over 25,000 accounts allegedly linked to Russian-origin illicit activity. world’s largest exchange – has also taken steps to block accounts indirectly associated with 38 Ukraine has also offered rewards for information on crypto wallets belonging to Kremlin allies. Russian or Belarusian politicians.

Ukrainian crypto community is ready to provide a generous reward for any information about cryptowallets of Russian and Belarusian politicians and their surroundings. War crimes must be pursued and punished! To share info please contact in Telegram: t.me/ArtemAf.

11:30 AM·Feb 26,2022·Twitter for iPhone

Following European Union sanctions blocking all crypto transactions between European entities and Russian crypto wallets in October 2022, major exchanges such as Kraken, Blockchain.com, Crypto.com, Bitfinex and LocalBitcoins have ceased operations for Russian clients.39

The government of Ukraine has proven effective in seizing the wallets of Russian fundraising groups, with at least one confirmed seizure occurring since the full-scale invasion. This case is discussed in the following case study overleaf.

Seizures

Russian military donors complain after crypto exchange Binance blocks a donation to the sanctioned and Wagner-affiliated Task Force Rusich.

Ukraine Seizes $19,500 in Crypto From Pro-Russian Fundraiser

On August 23rd 2022, the Security Services of Ukraine announced that it had blocked a crypto wallet belonging to a pro-Russian individual collecting crypto donations to obtain military supplies. The wallet was blocked with the help of a crypto exchange and the approximately $19,500 worth of cryptoassets collected was due to be transferred to Ukraine at the time.

“Now, a similar fate awaits other Russian ‘volunteers’ who sponsor the war in Ukraine.”

The Ukraine Security Services40

Anonymized Telegram communications by the pro-separatist individual indicates that he either is – or has close links to – the operator of a small arms vendor shop that supplies Russian soldiers. His Telegram channel appears to be a blend of chatter relating to his products, as well as advertising their use by invading forces on the frontline.

The arms vendor website associated with the individual with seized crypto (left) and images of arms being used by Russian soldiers from his Telegram channel (right).

The Rise of Illicit “Coin Swap” Exchanges

Measures taken by mainstream crypto exchanges and security services to prevent Russian fundraising have brought to prominence a more elusive form of virtual asset services. These – which Elliptic terms “Coin Swap” services – are predominantly anonymous and centralized platforms that convert between and across both cryptocurrencies and fiat currencies (predominantly the Russian ruble). They typically do not require an account or know-your- customer (KYC) identification to use.

Cryptocurrency in Conflict

Though some may be legitimate-facing and employ some anti-money laundering controls, many coin swap services are advertised exclusively to a cybercriminal audience. Elliptic’s “State of Cross-chain Crime” report has identified over $1.2 billion of illicit crypto – predominantly Bitcoin originating from dark web markets, sanctioned entities, ransomware and Ponzi schemes – flowing through these services.

“What I do with your dirty crypto is my own concern.”

An anonymous Russian coin swap service operator41

Examples of illicit coin swap services that have sizeable incoming crypto flows from illicit sources – including dark web markets and sanctioned entities.

Many coin swap services – which themselves are often sympathetic to the invasion – also provide cash couriering services throughout Russia and the occupied regions of Ukraine in some cases. In July 2022, the Ukraine Prosecutor’s Office announced seizures of over $1.3 million from various brokers known to be illegally exchanging cash and cryptoassets. 42

A coin swap service advertises itself on a Russian cybercrime forum, explicitly stating that it can exchange dirty crypto transactions directly from dark web marketplaces.

Cryptocurrency in Conflict

Crypto Fundraising By Russian and Belarusian Dissidents

Pro-Russian separatist fundraisers are not the only elements to have made use of crypto during the war. Many campaigns, individuals and groups opposed to the invasion have also sought to fundraise using crypto. These causes have been observed throughout both Russia and Belarus – Russia’s key ally in the region – from which the February 24th attack was launched.

Dissidents in Russia

Opposition groups and anti-war causes are heavily restricted by the Russian government. Fines and prosecutions have been brought against those participating in rare protests or deviating from the Kremlin’s official discourse.

Crypto is therefore one of the most viable ways to fundraise for protests and other activities in an anonymous manner, outside centralized government oversight. Major opposition figures – such as Alexei Navalny – have long accepted crypto donations for their political campaigns. Navalny’s crypto donations have surged since the start of the invasion, averaging $131,700 a month in Bitcoin between March and November 2022.

Elliptic has observed the use of crypto donations to fundraise online marketing, organization of protests and covering legal fees of arrested dissidents. On occasion, these movements are linked to minority ethnic and religious groups in the west of the country that have historically strained relationships with the Russian state. This has been exacerbated by the partial mobilization in September 2022, during which it was reported that ethnic minority groups were 43 disproportionately drafted by regional authorities.

Protests in Dagestan

Dagestan is an ethnically diverse republic of Russia situated in the country’s southwest. Ethnic Caucasian and Turkic people – predominantly Muslim – make up almost the entire population.

Following the announcement of the partial mobilization in September, a major protest was planned in the main square of the capital city: Makhachkala. The action was initiated by several Telegram groups, many of which have long been in favor of independence.

One of the largest of such Telegram channels boasts over 60,000 subscribers – almost 2% of Dagestan’s 2021 population. Its activities include facilitating protests, particularly among students, and has raised around $20,500 in cryptoassets. Propaganda used by the group range from statistics of economic deprivation in Dagestan to posting images of dead Dagestani soldiers in Ukraine – combined with Islamist conservative influences.

Images from the Makhachkala protests distributed by a dissident anti-war Dagestani Telegram channel, hosting crypto donation addresses.

“We have an armed unit consisting of obvious enemies of Allah, murderers of Muslims and the Chechen people,

as well as fascists and Nazis […]. That’s all you need to know about ‘Russia’s fight against fascism in Ukraine’.”

The above Dagestani Telegram channel (anonymized), referring to the Wagner Group.

Cryptocurrency in Conflict

Dissidents in Belarus

Elliptic has observed growing use of crypto by the political opposition in Belarus. The rising use of crypto by Belarusian opposition groups rose sharply in 2021 due to the controversial presidential election, following which long-time president Alexander Lukashenko declared victory amid disputed results.

Dissident entities fundraising in crypto range from charities providing financial support to families affected by political imprisonment to hacktivist groups that target government infrastructure. One example of the former is the Belarusian Solidarity Foundation (BYSOL), which has received over $315,000 in crypto donations. However, perhaps one of the most notorious examples of the latter is “Superativ”, an umbrella group of three organizations that have engaged in both cyber and physical attacks throughout Belarus. All four entities are banned by the Belarusian government.

Cryptoassets Received By Wallets of Belarusian Anti-government Entities

The Suprativ Movement

The Belarusian “Suprativ” Movement is formed of three organizations, namely the Flying Storks, Cyber Partisans and the People’s Self-defence Squads. Together, these groups have initiated both cyber and physical attacks against the Belarusian and Russian governments, seeking to disrupt the former’s collaboration during the war in Ukraine. Cyberattacks have included leaks of sensitive government data, website takedowns and disruption of critical infrastructure. The PSS also provides numerous self-defence and civil disobedience courses to activists.

A drone attack on the Minsk Riot Police base by the Flying Storks (left) and a tweet announcing the encryption of Belarusian railway systems by the Cyber Partisans (right).

Together, the Suprativ Movement has received over $430,000 in cryptoasset donations. In August 2022, the Belarusian Cyber Partisans released an NFT collection of hacked passport images of top Belarusian officials – including President Lukashenko’s. The collection was taken down by OpenSea, after which a new identical collection (V2) was launched. Neither collection has since registered any trades.

The Cyber Partisans “Belarusian Passports” NFT collection – including that of President Lukashenko (partially redacted).

Cryptocurrency in Conflict

Summary

With a significant proportion of pro-Russian cryptoasset fundraising activity being attributed to illicit activity, virtual asset services require effective risk management and mitigation strategies to prevent inadvertent exposure to their transactions. In particular, processing cryptoassets related to entities discussed throughout this section may carry sanctions evasion risks due to their relations with the Wagner Group, Task Force Rusich, Southfront, Hydra Marketplace or other sanctioned oligarchs or entities.

The comparatively lower use of cryptoassets by pro-Russian entities should therefore not dissuade crypto services into deprioritizing the risk, or inaccurately portraying a false sense of security. Even with minimal exposure to these entities can facilitate potential war crimes that many of these entities continue to glorify and fundraise for.

Elliptic has published two briefing notes designed to explore specific aspects of pro-Russian criminal activity, relating to the Conti Leaks and coin swap services respectively. The next section provides a summary of sanctions and regulatory activity in light of the full-scale invasion, combined with best practices for crypto services to ensure robust compliance.

Additional Briefing Notes By Elliptic specific to Russian-origin Cybercrime

Conti Leaks Investigation

The $19m in DAI found in an account linked to Conti Member 'Target'

Conti Leaks Investigation

Coin Swap Services

Cashing out dirty crypto in the cybercriminal underworld

In this Briefing Note, Elliptic’s Research & Investigations team analyzed data leaked from the Russian ransomware group Conti in February 2022. It includes a breakdown of the investigation summarized above, involving “Target”’s $19 million in DAI, conducted using Elliptic’s Holistic Screening capabilities. A full version is available to law enforcement upon request.

One of the weak points of a typical cybercriminal operation is the need to cash out illicitly-acquired cryptoassets in order to enjoy the criminal profits. In this briefing note, learn more about the rising adoption of coin swap services and how to trace funds laundered this way.

elliptic.co/resources/conti-leaks-investigation

Coin Swap Services

Regulatory Developments

& Compliance Implications

Sanctions and Cryptocurrencies

The Russian invasion of Ukraine prompted a robust response from the US, EU and other jurisdictions around the world, which imposed severe sanctions designed to isolate Russia from the international financial system. Sanctions have also aimed at preventing Russia and entities there from using cryptoassets to evade sanctions or in tackling those supporting hostile activities targeting Ukraine.

Many pro-Russian military fundraisers have actively touted ways to avoid sanctions, with some offering reasonably detailed guides to facilitate donations anonymously. Such strategies may still involve the use of compliant virtual asset services and therefore continue to be a cause for concern.

Crypto sanctions evasion tutorials posted on a pro-Russian Telegram channel.

Consequently, the crypto industry faces numerous sanctions compliance obligations globally directed at Russia and Russian-related activity. This section outlines some of the sanctions measures taken to date in key jurisdictions that cryptoasset exchanges and financial institutions should be aware of.

United States

Since February 2022, the US has undertaken numerous actions targeting Russia that have implications for crypto space. These include:

• February 2022: the US imposed restrictions on dealings with the Donetsk and Luhansk

regions of Ukraine, where pro-Russian separatist groups have been identified soliciting donations in Bitcoin.

Cryptocurrency in Conflict

• March 2022: the US Treasury’s Financial Crimes Enforcement Network (FinCEN) issued an alert on red flags of Russian sanctions evasion. This includes red flags related to crypto activity, including the potential for virtual assets service providers (VASPs) located in high-risk jurisdictions to facilitate sanctions evasion.

• April 2022: the US Treasury’s Office of Foreign Assets Control (OFAC) imposed targeted sanctions on the Russian dark web marketplace Hydra, and on Garantex, an Estonianregistered crypto exchange service involved in laundering funds on behalf of Russian cybercriminals. OFAC listed over 100 cryptoasset address belonging to these entities on the Specially Designated Nationals and Blocked Persons List (SDN List), prohibiting US persons from dealing with those or other addresses controlled by Hydra and Garantex. The same month, OFAC sanctioned the Russian Bitcoin mining company BitRiver.

• September 2022: OFAC sanctioned Task Force Rusich for its paramilitary activities in Ukraine, and included on the SDN List crypto addresses belonging to the group.

Prior to the Russian invasion of Ukraine, the US had taken a number of sanctions targeting entities and individuals in Russia with implications for crypto. These include:

• September 2020: OFAC sanctioned Danil Potekhin and Dmitri Karasavidi – two Russian cyber actors who hacked crypto exchanges. The same month, OFAC sanctioned Andrii Derkach – a Russian agent in the Ukrainian Parliament – and an employee of a Russian “troll farm” called Artim Lifshits for their efforts to interfere in US elections, and listed numerous crypto addresses belonging to them.

• April 2021: OFAC sanctioned a Pakistani national called Mujtaba Ali Raja, as well as three entities - the Association for Free Research and International Cooperation, Secondeye Solutions, and Southfront - for their support of Russia’s election interference activities, and listed crypto addresses belonging to them on the SDN List.

• September 2021: OFAC sanctioned SUEX O.T.C, S.R.O, a crypto exchange registered in the Czech Republic that facilitated money laundering on behalf of ransomware gangs in Russia. The same month, OFAC issued updated guidance warning of the sanctions risks that US persons can face when facilitating ransomware payments that involve sanctioned jurisdictions and/or sanctioned entities.

European Union

Since the Russian invasion of Ukraine, the European Commission has clarified that all of its pre- existing financial sanctions measures apply to activity conducted in cryptoassets. It has also issued sanctions against numerous Russian individual and entities, including some on the OFAC SDN List-such as Task Force Rusich-that have utilized cryptocurrencies, and has prohibited dealings involving the Russian-occupied regions of Donetsk and Luhansk, as well as the regions of Kherson and Zaporizhzhia.

In October 2022, the EU agreed its eighth round of sanctions against Russia, which included a prohibition on the offering of crypto account, custody, or wallet services of any value to Russian nationals and residents. Consequently, numerous crypto exchanges announced their intention to halt services to Russia.

The United Kingdom

In March 2022, HM Treasury, the Financial Conduct Authority (FCA) and the Bank of England issued a statement on the implications of sanctions for crypto businesses in light of the Russian invasion of Ukraine. The guidance makes clear that existing sanctions requirements in the UK apply to transactions conducted in cryptocurrencies, and includes red flag indicators of potential sanctions evasion involving cryptoassets to assist the private sector in detecting potentially prohibited activity.

Singapore

In March 2022, the Singapore Ministry of Foreign Affairs imposed sanctions on Russia and stated that financial institutions must not engage in crypto transactions that could undermine the sanctions. The same month, the Monetary Authority of Singapore (MAS) published a notice reminding regulated businesses of their obligations to avoid any dealings in crypto that could result in sanctions evasion.

Cryptocurrency in Conflict

The Compliance Implications

To comply with the above measures and ensure that they do not deal with sanctioned actors, crypto exchanges and financial institutions can employ blockchain analytics solutions such as those developed by Elliptic. Blockchain analytics can be used in identifying and managing potential sanctions risks involving Russia and Russian-related entities in four primary ways:

• Wallet screening: to identify if crypto wallets may be controlled by sanctioned actors in

order to prevent customers withdrawing funds to those wallets.

• Transaction screening: to identify where the ultimate source or destination of a

customer’s transactions involves exposure to sanctioned parties.

• Investigations: to conduct in-depth analysis of funds flows while investigating potential

sanctions evasion cases and suspected breaches.

• VASP Due Diligence: identify potential sanctions risk exposure via high risk crypto

service providers

On the next page, we describe how blockchain analytics can facilitate these areas of sanctions compliance.

“DAO Donbass” – A former Donetsk-based company advocating the use of blockchain technologies to evade sanctions.

Cryptocurrency in Conflict

Wallet Screening

By screening crypto wallets before allowing customers to withdraw funds, crypto exchanges can identify if a wallet is controlled by a Russian entity on the OFAC SDN List, or on sanctions lists maintained by the EU or other jurisdictions.

Wallet screening solutions such as Elliptic Lens enable exchanges to prevent customer withdrawals to prohibited wallets, ensuring they remain compliant with sanctions requirements.

The image below from Elliptic Lens shows an attempted withdrawal from a cryptoasset exchange to one of the OFAC-listed Ethereum addresses belonging to Danil Potekhin. Elliptic Lens flagged the wallet as high risk, and assigned it a high risk score, owing to its connection to a sanctioned individual.

In this case, the exchange has a clear indication that its customer is attempting to send funds to an OFAC-sanctioned entity and can prohibit the withdrawal.

Cryptocurrency in Conflict

Transaction Screening

Crypto exchanges also need to be alert to ongoing risks of exposure to sanctioned Russian actors through their customers’ transactions. Transaction screening software like Elliptic Navigator can assist crypto businesses and financial institutions in identifying potential exposure to sanctioned actors so they can take appropriate action.

The image below from Elliptic Navigator shows a deposit of 1,756 Ether tokens ($2 million) made to a crypto exchange. However, the transaction has been flagged as high risk because all of the funds sent to the exchange can ultimately be traced back to Danil Potekhin, the Russian cybercriminal sanctioned by OFAC in September 2020.

Knowing that the ultimate source of funds is Potekhin, the exchange can take action to comply with relevant sanctions requirements. In this case, the exchange can block the funds in a quarantine wallet and report the information to OFAC.

Elliptic’s wallet and transaction screening solutions also include Holistic Screening, which involves identifying risks that funds may have exposure to sanctioned actors through services such as cross-chain bridges and decentralized exchanges (DEXs).

Cryptocurrency in Conflict

Investigations

If your compliance team identifies red flags that may suggest you have exposure to sanctioned entities, it is necessary to dig deeper. You need to have in place an investigation strategy that allows you to look in depth at customer activity and scrutinize it. A well-designed investigative strategy includes:

Elliptic Investigator shows transactions between sanctioned exchange Garantex, sanctioned paramilitary group Task Force Rusich and related payments to and from other Russian military fundraisers, malware and – crucially – a regulated virtual asset service. Elliptic Investigator is able to visually show the breakdown of incoming or outgoing exposure within each node, as a useful indicator of risk. It is also able to cluster large numbers of intermediary wallets (in this case 33 of them) to facilitate accessible investigations.

Cryptocurrency in Conflict

VASP Due Diligence

Finally, it is critical for crypto exchanges and financial institutions to understand the potential sanctions risks they may face from VASP counterparties. For example, a financial institution’s customers may attempt to buy cryptoassets at exchanges located in Russia, or that are located outside Russia, but serve the Russian market by offering Bitcoin-to-ruble swaps. After the Russian invasion of Ukraine, Elliptic identified more than 400 VASPs with a Russian nexus, many of which enable users to create accounts anonymously.

Elliptic Discovery shows company information for the sanctioned exchange Garantex. Information about these Russia-linked VASPs is contained in Elliptic Discovery, our dataset containing profiles of thousands of VASPs. Using Elliptic Discovery, crypto exchanges and financial institutions can obtain information about a VASP including:

Cryptocurrency in Conflict

Conclusion

The invasion of Ukraine has, arguably, brought out both the best and the worst of crypto. On one side, an unprecedented drive to help Ukraine just hours into the invasion has cemented crypto as a tried-and-tested means of emergency fundraising. The successful drive to utilize the unique capabilities of cryptoassets has also shone light on the positive use cases of not only DeFi, NFTs and DAOs, but also the communities engaging with them.

On the other hand, however, we see pro-Russian entities accepting cryptoasset donations to actively engage in potential war crimes, many of which they document and glorify on their social media channels. Some of these entities have been linked to sanctioned entities and cybercrime – including dark web markets, stolen data vendors, disinformation outlets, ransomware groups and hackers. On the Ukrainian side, the canceled airdrop raised questions about the true intention of certain donors who publicly voiced criticism against the cancellation – indicating that their donations were potentially more in anticipation of personal gain rather than charitable intent. The rise of donation scammers, seeking to profit off well-meaning donors and a country being invaded, has also provided a new perspective on the nature of illicit activity in the crypto ecosystem.

What this means for stakeholders with any nexus to cryptoassets is that sustainable contributions to worthy causes can be facilitated through implementing best practices, many of which have been derived from using pro-Ukrainian blockchain projects as a learning curve. However, at the same time, adequate risk mitigation measures are required to prevent any exposure to pro-Russian military fundraisers – particularly in the realm of preventing sanctions evasion, money laundering and the financing of terrorism.

This report has aimed to contextualize and provide guidance on both the positive contribution opportunities and the financial crime risks generated by Russia’s invasion of Ukraine. Perhaps the most crucial outcome to note, however, is that the positive contributions of cryptoassets have far outweighed the negatives – by a substantial margin of over 44:1. Not only does this cement crypto as a force for good, but communities engaging and innovating with decentralized finance technologies are better for it. In its desire to help Ukraine, innovation in the crypto space has accelerated, matured and proven that it can have a formidable role in shaping major world events – predominantly for the better.

Cryptocurrency in Conflict

Crypto Intelligence at Elliptic

Elliptic’s core aim is to help crypto become a freer, fairer and more accessible medium of finance for everyone. Achieving this rests on virtual asset services and criminal investigators being able to detect, manage and mitigate crypto crime risks through accurate and up-to- date crypto intelligence.

Harnessing expertise from a wide range of sectors, Elliptic’s research, intelligence and data functions deploy a multitude of techniques to enrich our dataset of both licit and illicit crypto activity. Ranging from open source intelligence analysis to machine learning solutions, Elliptic ensures that its formidable dataset informing compliance and investigations can contribute to the safe and sustainable development of crypto.

Building a World-leading Crypto Dataset

Building and maintaining an accurate and robust dataset of crypto activity is made possible through a range of processes deployed by Elliptic’s crypto intelligence functions. These include:

• Open Source Intelligence (OSINT): Elliptic maintains broad analytical, investigative and

linguistic capabilities to identify and assess crypto crime intelligence from public and private sources. Our OSINT operations involve both overt and covert data gathering to detect and understand the nature of illicit activity.

• Dark Web Investigations: our specialist researchers are dedicated to in-depth

investigations and risk assessments in the dark web ecosystem. This ensures that Elliptic maintains accurate coverage of a range of illicit activities, including dark web markets, stolen data vendors, terrorist financing and forums dedicated to facilitating ransomware and malware attacks.

• Data Science: our data scientists are well versed with the unique requirements

of analyzing patterns in blockchain activity and complex transaction heuristics. Additionally, we are a leading innovator in key industry-specific needs that give investigators crucial advantages over crypto criminals, such as tracing through mixers and privacy wallets.

• Pre-empting Threats with Horizon Scanning: we recognize that crime moves fast, and

is often at risk of outpacing prevention efforts. Our research and data prioritization is based on identifying the likely trajectory of the wider crypto ecosystem, so that we can pre-empt coverage of emerging criminal threats before they become mainstream.

Cryptocurrency in Conflict

• High Capacity Engineering: The fast-moving pace of crypto means that we often

handle tens of thousands of data points every minute. Our data engineering capabilities are scaled and innovated to meet the challenge, ensuring that data is entered, processed and verified quickly to provide timely insights.

• Industry Partnerships: Elliptic recognizes that the push for a safe and secure

cryptoasset ecosystem is shared by other stakeholders and competitors. Whether it is to combat child sex abuse, ransomware or fraud, Elliptic partners and shares data with other reliable industry leaders under the common goal of combating crypto crime.

• Quality Assurance: Bringing down false positives is crucial for more efficient crypto

compliance and wider trust in the blockchain ecosystem. Elliptic takes great care to ensure that its data is accurate, verifiable and robustly evidenced before incorporating it into our tools.

It is these processes that power Nexus, our next-generation blockchain analytics engine, and solidify it as an industry-leading platform for crypto compliance and investigations. Nexus allows virtual asset services and investigators to trace cryptoassets both within and across blockchains concurrently. At Elliptic, we leverage our world-class intelligence through Nexus to make detailed analytical queries, enhanced due diligence reports and bespoke solutions for our clients – allowing us as an industry to remain ahead of even the most complex risks and criminal threats.

A Positive Impact For the Wider Industry

Our crypto intelligence capabilities do not only serve to underpin our leading compliance solutions. Elliptic is also proud to have facilitated crucial industry-specific and data-driven research in the form of blogs, research reports and briefing notes. Topics have included cross- chain crime, an investigation into the Conti ransomware group and the financial crime risks of non-fungible tokens (NFTs) and the metaverse.

Elliptic also leverages its crypto intelligence capabilities to conduct in-depth investigations and advise industry partners on key risks and crypto crime trends. Our data and expertise has helped inform sanctions agencies, law enforcement, financial intelligence units, policymakers and regulators across many jurisdictions. As crypto expands and matures, Elliptic is committed to maintaining, expanding and informing the wider industry through its world-leading data collection and analytical capabilities.

See for yourself, book a personal demo with our expert team!

Cryptocurrency in Conflict

Elliptic Crypto Intelligence in 2022

Read our Crypto Intelligence Insights on Elliptic Connect: www.elliptic.co/connect

Cryptocurrency in Conflict

Methodology

Unless otherwise stated, all data included in this report is current, up to and including November

  1. Where aggregate cryptoasset incoming or outgoing values are shown, these denote the USD value at the time of the transaction. These values consider all transactions made in the following assets: Bitcoin (BTC), Ether (ETH), Tron (TRX), Bitcoin Cash (BCH), Litecoin (LTC), Dogecoin (DOGE), Stellar (XLM), Polygon (MATIC), Polkadot (DOT), Tether (USDT), USD Coin (USDC), DAI (DAI), Binance USD (BUSD), Decentralized USD (USDD), BNB Coin (BNB), Solana (SOL), Cardano (ADA), Algorand (ALGO), EOS (EOS), Ripple (XRP), Near (NEAR), ZCash (ZEC), Dash (DASH), Wrapped Ether (wETH), Wrapped Bitcoin (wBTC) and any Ethereum-based NFTs (ERC-721 only) with at least one prior sale from their collection (so that a USD valuation for them can be determined). For data on donations over time or incoming exposure data, amounts are based on a sample of wallets that are not hosted by virtual asset services. Monthly data incorporates BTC and ETH only, while exposure data incorporates BTC, ETH and USDT/USDC/DAI on the Ethereum blockchain. Exposure data for cryptoasset wallets are based on Elliptic’s internal dataset. These figures – where visualized or presented – exclude funds originating or being sent to unknown entities. So-called “Exposure” denotes funds originating or destined for entities, regardless of the number of intermediary transactions (i.e. “hops”) between them. Customers of Elliptic will be able to screen and investigate these entities and replicate these results using our wallet screening tool, Elliptic Lens or blockchain forensics tool, Elliptic Investigator. A large number of Ukrainian causes have often donated to each other, for example in the case of Ukraine DAO or RELI3F UKR dispersing funds to the crypto wallets of Come Back Alive and Aid For Ukraine. This accounts for over $12.5 million of cryptoasset receipts by Ukrainian causes and a near-negligible amount for Russian causes. This has been reflected and deducted from aggregate figures provided by this report. Elliptic takes a conservative approach when considering what entities to consider as “pro- Russian” in this report. For example, pro-war podcasters and journalists are not included unless (a) they are explicitly raising funds for military procurement or (b) have been subject to legal proceedings or sanctions for their support. This is likely to explain discrepancies between the figures provided in this report and other sources that have conducted similar research. Certain individuals or entities subject to ongoing investigations are deliberately anonymized throughout the discussion, but may be included in aggregate figures denoting overall crypto activity. Further information regarding the individuals or entities discussed throughout this report is available on request.

Cryptocurrency in Conflict

Index

  1. vitalik.eth [@VitalikButerin], ‘@technocrypto I’ll out Myself as Someone Who Has Used TC to Donate to This Exact Cause.’, Tweet, Twitter, August 9th 2022, https://twitter.com/VitalikButerin/status/1556925602233569280

  2. H.E. Justin Sun🇬🇩🇩🇲🔥 [@justinsuntron], ‘@FedorovMykhailo I Am Glad to Announce That I Have Made My Initial Donation of $200,000 USDT on #TRON to #Ukraine 🇺🇦 The People of Ukraine Are Not Left Alone in Their Fight against Humanitarian Crisis! @VitalikButerin @ FedorovMykhailo @Ukraine Check My Hash: Https://T.Co/Q0a2xgaIwK’, Tweet, Twitter, February 26th 2022, https://twitter.com/justinsuntron/status/1497615473478823938; Joseph Hall, ‘Ukraine Accepts DOT, Founder Gavin Wood Donates $5.8 Million’, Cointelegraph, 1 March 2022, https://cointelegraph.com/news/ukraine-accepts-dot-founder-gavin-wooddonates-5-8-million

  3. Everstake [@everstake_pool], ‘1/6 Certain Twitter Users, Including Fake Accounts of US Congressmen and Biased Media Outlets, Have Disseminated Rumors That Hundreds of Millions of USD Donated to Ukraine Were Illegally Transferred to the US Democratic Party through @FTX_Official. Https://T.Co/C6WMpeE3kV’, Tweet, Twitter, November 15th 2022, 6, https://twitter.com/everstake_pool/status/1592621937054085120

  4. ‘Aid For Ukraine – Donate Crypto to Ukraine’, Aid For Ukraine, July 7th 2022, https://aid-for-ukraine.io/

  5. Amitoj Singh, ‘Ukraine Has Received Close to $100M in Crypto Donations’, March 9th 2022, https://www.coindesk.com/business/2022/03/09/ukraine-has-received-close-to-100- million-in-crypto-donations/

8. ‘How Is Ukraine Using Crypto to Fund the War?’, The Economist, April 5th 2022, https://www. economist.com/the-economist-explains/2022/04/05/how-is-ukraine-using-crypto-to- fund-the-war 9. ‘Aid For Ukraine – Donate Crypto to Ukraine’. 10. ‘Our Largest Cryptocurrency Contribution to Date — $500,000!’, United24 (blog), September 10th 2022, https://u24.gov.ua/news/our_largest_cryptocurrency_contribution 11. ‘Attention! The Azov Regiment’s response to the allegations published in “TIME” magazine’, Azov Regiment (blog), January 10th 2021, https://azov.org.ua/the-azov-regiments-response- to-the-allegations-published-in-time-magazine/ 12. ‘Binance to Donate $10M to Ukraine Humanitarian Effort and Launch Crypto-First Crowdfunding Site to Further Help Provide Aid to Ukraine | Binance Support’, Binance (blog), February 27th 2022, https://www.binance.com/en/support/announcement/binance-to- donate-10m-to-ukraine-humanitarian-effort-and-launch-crypto-first-crowdfunding-site- to-further-help-provide-aid-to-ukraine-6bce8615076a4173a4738817c597b09e 13. ‘Unchain Fund » HELPER’, Unchain Fund, accessed November 24th 2022, https://helper.unchain. fund/en/about/ 14. Marieke Flament, ‘NEAR Foundation’s Response to the War in Ukraine’, NEAR Protocol (blog), March 11th 2022, https://medium.com/nearprotocol/near-foundations-response-to-the- war-in-ukraine-ea588c941bd5 15. Sam Reynolds, ‘Celsius Once Solicited Donations for Ukraine. Here’s What Happened Next’, CoinDesk, 25 October 2022, https://www.coindesk.com/business/2022/10/25/celsius- once-solicited-donations-for-ukraine-heres-what-happened-next/; feyd27, ‘Post Mortem: UkraineDAO’, Medium, October 25th 2022, https://medium.datadriveninvestor.com/post- mortem-ukrainedao-a317496bf12f 16. feyd27, ‘Post Mortem’, 2. 17. ‘UAH 21.7 Billion Transferred for Needs of Defense, Over UAH 663 Million Remitted to Special Account in November’, National Bank of Ukraine (blog), December 2nd 2022, https://bank.gov. ua/en/news/all/nbu-pererahuvav-na-potrebi-oboroni-ponad-217-mlrd-grn-za-listopad- na-spetsrahunok-nadiyshlo-ponad-663-mln-grn

Cryptocurrency in Conflict

18. Annabelle Liang, ‘Russia Considers Accepting Bitcoin for Oil and Gas’, BBC News, March 25th 2022, sec. Business, https://www.bbc.com/news/business-60870100 19. Will Stewart, ‘Sickening Moment Pro-Putin Veteran Waves Ukrainian Soldier’s SKULL’, Mail Online, August 28th 2022, sec. News, https://www.dailymail.co.uk/news/article-11154153/This- guys-dead-let-burn-hell-Sick-moment-pro-Putin-veteran-waves-Kyiv-soldiers-SKULL.html 20. Igor Mangushev, Grandma sells sprouts, sends the money to fighters battling Ukraine’s forces: How Russia’s civil society helps support the Donbass, interview by Dmitry Plotnikov, Russia Today (RT), May 22nd 2022, https://www.rt.com/russia/555872-our-civil-society- equips-battalions/ 21. ‘Treasury Escalates Sanctions Against the Russian Government’s Attempts to Influence U.S. Elections’, U.S. Department of the Treasury, April 15th 2021, https://home.treasury.gov/news/press-releases/jy0126 22. Nick Grothaus and Robert Kim, ‘NFT Sale Linked to Sanctioned Russian Terrorist Group Attempts to Support War in Ukraine’, Kharon (blog), July 14th 2022, https://www.kharon.com/ updates/nft-sale-linked-to-sanctioned-russian-terrorist-group-attempts-to-support-war- in-ukraine 23. Christina Wilkie, ‘Biden Presses Putin to Disrupt Cybercriminals in Russia as U.S. Grapples with Latest Ransomware Attacks’, CNBC, July 9th 2021, https://www.cnbc.com/2021/07/09/ ransomware-biden-presses-putin-to-disrupt-cybercriminals-in-russia.html 24. Tom Balmforth and Maria Tsvetkova, ‘Russia Takes down REvil Hacking Group at U.S. Request

Cryptocurrency in Conflict

27. Akartuna, ‘Troubled Dark Web Carding Market Loses Another Key Vendor as FBI Seizes SSNDOB | Elliptic’, Elliptic Connect (blog), June 8th 2022, https://hub.elliptic.co/analysis/ troubled-dark-web-carding-market-loses-another-key-vendor-as-fbi-seizes-ssndob/ 28. A. J. Vicens, ‘REvil Prosecutions Reach a “dead End,” Russian Media Reports’, CyberScoop, May 27th 2022, https://www.cyberscoop.com/revil-prosecutions-reach-a-dead-end-russian- media-reports/; Sergey Mashkin, ‘До Российских Хакеров Америке Нет Дела ’, Коммерсантъ, 27 May 2022, https://www.kommersant.ru/doc/5369361 29. ‘More Than Half a Billion Dollars Has Been Laundered Through a Cross-Chain Bridge | Elliptic’, Elliptic Connect, August 10th 2022, https://hub.elliptic.co/analysis/cross-chain-crime-more- than-half-a-billion-dollars-has-been-laundered-through-a-cross-chain-bridge/ 30. Sean Lyngaas, ‘“I Can Fight with a Keyboard”: How One Ukrainian IT Specialist Exposed a Notorious Russian Ransomware Gang | CNN Politics’, CNN, March 30th 2022, https://www.cnn. com/2022/03/30/politics/ukraine-hack-russian-ransomware-gang/index.html 31. ‘Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure’, U.S. Cybersecurity & Infrastructure Security Agency, April 20th 2022, https://www.cisa.gov/uscert/ncas/alerts/aa22-110a 32. ‘Donate to Ukraine’s Defenders’, War in Ukraine, accessed November 23rd 2022, https://war.ukraine.ua/donate/ 33. ‘Prizm Review: MMM Global Scammer Launches Own Scamcoin’, Behind MLM (blog), February 11th 2019, https://behindmlm.com/mlm-reviews/prizm-review-mmm-global-scammer- launches-own-scamcoin/; Elise Thomas, ‘The Separatist’s Guide to Circumventing Sanctions: An OSINT Investigation into Cryptocurrencies Linked to the Donetsk People’s Republic’ (Center for Information Resilience, March 2022), https://www.info-res.org/post/report-the-separatist- s-guide-to-circumventing-sanctions 34. ‘Prizm Review: MMM Global Scammer Launches Own Scamcoin’; Thomas, ‘The Separatist’s Guide to Circumventing Sanctions: An OSINT Investigation into Cryptocurrencies Linked to the Donetsk People’s Republic’.

Cryptocurrency in Conflict

35. ‘Prizm Review: MMM Global Scammer Launches Own Scamcoin’; Thomas, ‘The Separatist’s Guide to Circumventing Sanctions: An OSINT Investigation into Cryptocurrencies Linked to the Donetsk People’s Republic’. 36. ‘Prizm Review: MMM Global Scammer Launches Own Scamcoin’; Thomas, ‘The Separatist’s Guide to Circumventing Sanctions: An OSINT Investigation into Cryptocurrencies Linked to the Donetsk People’s Republic’. 37. ‘Crypto Platform Blocks Thousands of Russia-Linked Wallets’, BBC News, March 8th 2022, sec. Technology, https://www.bbc.com/news/technology-60661763 38. Helen Partz, ‘Binance Blocks Crypto Accounts of Relatives Tied to the Russian Government’, Cointelegraph, April 29th 2022, https://cointelegraph.com/news/binance-blocks-crypto- accounts-of-relatives-tied-to-the-russian-government 39. Helen Partz, ‘Kraken Crypto Exchange Is next to Close Doors to Russian Users’, Cointelegraph, October 20th 2022, https://cointelegraph.com/news/kraken-crypto-exchange-is-next-to- close-doors-to-russian-users 40. ‘SSU for First Time Uses Mechanism to Block Wallets of Russian “Volunteers” Who Raise Funds for Russian Army (Video)’, Security Services of Ukraine (blog), August 23rd 2022, https:// ssu.gov.ua/en/novyny/sbu-vpershe-zastosuvala-mekhanizm-blokuvannia-hamantsiv- rosiiskykh-volonteriv-yaki-zbyraiut-koshty-dlia-armii-rf-video 41. a Akartuna, ‘Cross-Chain Crime: How Coin Swap Services Have Laundered $1.2 Billion in High- Risk Crypto | Elliptic’, Elliptic Connect, October 21st 2022, https://hub.elliptic.co/analysis/cross- chain-crime-how-coin-swap-services-have-laundered-1-2-billion-in-high-risk-crypto/ 42. ‘The Prosecutor’s Office Handed over UAH 50 Million, 830 Kg of Silver and Real Estate of a Group of People Involved in Fraud on the Cryptocurrency Market to ARMA’, Prosecutor’s Office of Ukraine (blog), July 12th 2022, https://www.gp.gov.ua/ua/posts/prokuratura-peredala- arma-50-mln-grn-830-kg-sribla-ta-neruxomist-grupi-osib-pricetnix-do-maxinacii-na- rinku-kriptovalyut 43. Emily Couch, ‘Russia’s Minorities Don’t Want to Be Putin’s Foot Soldiers’, Foreign Policy (blog), October 14th 2022, https://foreignpolicy.com/2022/10/14/russia-minorities-putin-partial- mobilization/

Cryptocurrency in Conflict

Other Reports by Elliptic

NFTs and Financial Crime

This report provides and explains the latest NFT trends to understand their financial crime risks. Guidance is also provided on regulatory matters concerning NFTs and the utilization of blockchain analytics to detect, investigate and prevent exposure to illicit activity. The report is intended for all stakeholders engaging with NFTs. It provides red flag indicators and recommendations to improve the safety, security and enjoyment of partaking in this rapidly growing industry.

The Future of Financial Crime in the Metaverse

The Future of Financial Crime in the Metaverse

This guide deep dives into financial crime typologies using metaverse-related cryptoassets, in order to arm compliance teams with a comprehensive set of warning signs and case studies on:

• Illicit activity involving cryptoassets in the metaverse.

• Examples of how these indicators fit into broader criminal behaviors.

• Context on how criminals engaged in these activities are working to clean their illicit funds.

The Definitive Practical Guide for Governance, Risk and Compliance Professionals

Preventing Financial Crime in Cryptoassets

Preventing Financial Crime in Cryptoassets: Typologies Report 2022

• Evolve the controls in place to manage risk to business, customers, and society.

• Develop anti-money laundering and counter terrorist financing (AML/CTF) governance systems

About Elliptic

Elliptic is the global leader in cryptoasset risk management for crypto businesses, governments, and financial institutions worldwide. Recognized as a WEF Technology Pioneer and backed by investors including J.P. Morgan, Wells Fargo Strategic Capital, SBI Group, and Santander Innoventures, Elliptic has assessed risk on transactions worth several trillion dollars, uncovering activities related to money laundering, terrorist fundraising, fraud, and other financial crimes. Elliptic is headquartered in London with offices in New York, Singapore, and Tokyo.

ELLIPTIC

London ● Tokyo ● New York ● Singapore

Connect on LinkedIn

Follow us on Twitter

Contact us at hello@elliptic.co