The Russian encryption platform has been subjected to a multinational law enforcement operation, with a large amount of related funds frozen.

Recently, a Russian centralized encryption currency trading platform was forcibly shut down by a multinational joint law enforcement agency, and its co-founder was arrested. At the same time, a large-scale freezing operation targeting funds associated with the platform also occurred on-chain. This incident highlights the risks and threats that Web3 practitioners face regarding capital.

Sanction Background

This Russian cryptocurrency exchange, established in 2019, has long been accused of providing money laundering services for illegal activities. In April 2022, the U.S. Department of the Treasury's Office of Foreign Assets Control imposed sanctions on it, stating that it handled over $100 million in illegal transactions related to dark web markets, ransomware gangs, hackers, and terrorism-related funds.

On March 7, 2025, the U.S. Department of Justice publicly released an indictment against the co-founder of the platform and his partners, accusing them of engaging in a money laundering conspiracy, violating U.S. sanctions, and operating a money transmission business without authorization.

It is claimed that the exchange has processed at least $96 billion in cryptocurrency transactions since its establishment, including a significant amount of criminal proceeds. U.S. authorities have pointed out that the exchange has provided money laundering services for North Korean hacker groups, Russian oligarchs, and multiple ransomware gangs.

On-chain law enforcement activities

Alongside the arrest operation was a large-scale on-chain freezing action, which was carried out in collaboration between American security firms and a stablecoin issuer. According to on-chain monitoring from a blockchain data analytics company and information disclosed by the exchange itself, the relevant law enforcement activities froze at least $28 million worth of stablecoins.

It is worth noting that this on-chain freezing activity is not directly aimed at the business hot wallet addresses of the exchange, but rather at a large number of intermediary and hoarding addresses used to evade fund tracking. Before being arrested, the individuals involved or their backers extracted large amounts of funds from major encryption cryptocurrency exchanges and payment platforms, and after highly automated fund laundering, transferred them back into other trading platforms.

This law enforcement collaboration forcibly interrupted this process and directly led to the platform ceasing its services.

On-chain funds threat dissemination

After researching the on-chain activities of all frozen addresses, it was found that the exchange extensively utilized centralized entity addresses during the fund laundering process.

Taking a frozen TRON address from this incident as an example, the upstream fund source of this address is a withdrawal hot wallet address from a certain payment or exchange platform, and before being frozen, this address transferred part of the funds to another centralized exchange.

Another frozen Tron address had more connections with payment platforms and even online gambling platforms apart from interacting with exchange users before the freeze.

This situation indicates that if a centralized institution conducts risk control on users receiving such funds for compliance reasons, it may affect innocent over-the-counter traders or ordinary users receiving related liquidation funds.

This event once again reminds Web3 practitioners to remain highly vigilant about the potential threats posed by risk capital and to strengthen compliance awareness and risk management measures.