The Greek Areopagus upheld the decision of the court in Thessaloniki on the extradition to the United States of Russian Alexander Vinnik, who is considered the owner of the BTC-e crypto exchange. RBC magazine found its other possible beneficiaries and found out what Vinnik was doing
Illustrations: Sofia Miroyedova
Material from No. 1–2 of RBC magazine for 2022, which will go on sale on December 21
Athens, December 6, 2017. The meeting room of the Areopagus, the highest court of cassation in Greece. Seven judges sit on a dais, looking down at the audience from a ten-meter height. They consider one case after another without pause. The doors to the hall are open: as in ancient times, anyone can freely enter the room and evaluate the fairness of the judging.
In the corner, two foreigners are waiting in handcuffs for their turn: the United States is seeking the extradition of both. Fate brought together a Chinese citizen who tried to buy American army antennas in Greece and Russian Alexander Vinnik: the Northern District of California court calls him the owner of the BTC-e crypto exchange, through which “cybercriminals laundered money.”
In the United States, 38-year-old Vinnik, who has been in custody for about six months, faces 55 years in prison: in his speech at the trial, he directly calls this term life. A whole force arrived in Areopagus to rescue Vinnik: Russian lawyer Timofey Musatov and three Greek lawyers, including ex-member of the local parliament Alexandros Lykourezos.
A translator is trying hard next to Vinnik; he can barely keep up with the eloquent Greek lawyers. The accused himself gives the impression of an extremely reserved person: he watches the process with restraint and without emotion. He also answers dryly the questions of the chairwoman of the Areopagus. “Why don’t you want to be extradited to the United States?” - “In the USA there is no independent justice in relation to Russians.” “What was your relationship with the platform in question [BTC-e]?” - “I am a technical expert, I provided consulting services.”
Before the collapse in the summer of 2017, BTC-e was among the top 20 largest crypto exchanges in the world and was the most popular among Russian-speaking users. Over the six years of its existence, about 700 thousand people have used BTC-e services - they bought or sold more than 9.4 million bitcoins, according to data from the Northern District of California court. If in 2012 the monthly trading volume on the site was $1 million, by 2016 the scale had grown to $6 million per day (Bitcoincharts data). The trading platform took 0.2–0.5% commission from each transaction.
Illustrations: Sofia Miroyedova
Before his arrest, even veterans who had been trading on the site since its inception did not know that Vinnik was involved in BTC-e. The administration of BTC-e has always maintained anonymity, and among the probable owners the names of a certain resident of Crimea, a DJ in a Moscow karaoke club, or a builder from a village in the Zaporozhye region of Ukraine have surfaced. But this list was never complete or true.
RBC magazine tried to find out who could have been at the origins of the exchange, who served its needs, and also what role Vinnik, who was arrested in Greece, played in the work of BTC-e.
"Sasha-WME"
“In the 15th house there is a Moskvichka store, in the 17th house there is a “Sorceress”, between them there is a yellow arch under the advertisement “Three Lions. Furs,” go into it. At security, you must say that you are going to WMExpress, and please specify who you are going to - Alexei or Alexander.” This instruction was published in the mid-2000s on the website of a Moscow company involved in transactions in the WebMoney system. The Alexander indicated in the ad is Alexander Vinnik.
The future hero of the international crime chronicle was born in the Kurgan region. In the early 2000s, he and his mother moved to Moscow, his first wife Natalya Molokova told RBC magazine. Vinnik decided to try his luck in the Internet business. At first, he could work under the nickname kurganlab: in particular, it was under him that Vinnik’s only possible account on social networks was registered - in “My World”. One of the first projects of kurganlab was the website “Prazdnikovedenie.ru”, where toasts and congratulations were published.
Soon, the IT entrepreneur moved on to more profitable activities - servicing transactions between electronic payment services, which were still a novelty at that time. In 2004, the website Wm-Exchanger.com appeared (now it does not open): the domain was registered to the mail, in the “Contacts” section there was an ICQ number that Vinnik could use. The website published price tags for transactions, for example, the cost of transferring from a ruble wallet to a dollar wallet within WebMoney or from the E-Gold system to the same WebMoney. The young entrepreneur earned commissions from each transfer.
Vinnik could publish advertisements for his services in specialized communities under the nickname WME, which can be deciphered as WebMoney Exchanger. Many Moscow IT specialists knew him under this virtual name: “When he was arrested in Greece, they started telling me: “So this is Sasha-WME,” recalls the owner of a large payment service. The same nickname was subsequently included in the indictment of an American court.
Illustrations: Sofia Miroyedova
In 2006, Vinnik exchanged his free schedule for office work at WMExpress. “I knew him [Vinnik] as our client and invited him to work with us,” Andrei Klimov, the permanent director and owner of WMExpress, told RBC magazine. Vinnik worked at the premises on Novy Arbat for about three years, helping clients receive bundles of bills instead of electronic money.
Despite his regular work, Vinnik did not give up his exchange business Wm-Exchanger: in addition to accounts in electronic payment services, he had bank accounts in offshore zones, which made his services in demand - there were five or six such people throughout Russia, Klimov recalls.
The clients of such intermediaries were Forex market participants, programmers and freelance designers - everyone whose activities even at that time were connected with payment of labor using electronic money. Soon, exchange services became a favorite among hackers and carders (fraudsters who steal information from bank cards), says Vinnik’s ex-colleague at WMExpress. According to him, the company sometimes received inquiries from law enforcement agencies about some clients in this area.
Vinnik himself was not a programmer, much less a specialist in hacking computer systems, according to two interlocutors from WMExpress. He always specialized in financial transactions, constantly “searching and looking for” new opportunities to earn money, his friend recalls. The 2010s gave Vinnik a truly revolutionary method - Bitcoin.
In October 2011, a WME user left his first post on the largest specialized crypto forum Bitcointalk.org: “I’ve been involved in exchanges for more than ten years, and now I’ve started working with bitcoins. I can exchange them for anything. I give preference to cash in Moscow <…>, dollar bank transfer from offshore and other options. I give preference to large sums.”
The BTC-e exchange, which later played a fatal role in Vinnik’s life, had existed for several months at the time of writing this post.
Criminal crypt
“Your logo is very scary and absolutely untrustworthy,” one of the Bitcointalk.org users commented in August 2011 in response to a proposal to test the new BTC-e trading platform. One of the exchange administrators, who communicated with the community under the nickname btc-e.com, promised three bitcoins to the author of the best symbol. So few entries were received that the results of the competition were not even summed up. Perhaps no one was impressed by the amount of the reward: then three coins could be exchanged for $30 at best.
The first online bitcoin trading exchange, Japanese Mt. Gox, began work in 2010 - a year after the production of the first batch of digital currency. The creators of BTC-e hit the nail on the head with their project: for example, in the same summer of 2011, the American Kraken and the European Bitstamp appeared, both are now in the top 10 largest crypto trading platforms (Bitcoincharts data).
Unlike its competitors, BTC-e, launched in 2011, was aimed at the Russian-speaking public. People from the post-Soviet space were immediately attracted by the lack of a language barrier, recalls the trader, the third user who registered on BTC-e, Evgeniy (he asked not to indicate his last name). Moreover, the exchange was chosen due to the ability to convert bitcoins into rubles, another oldest user of BTC-e, blockchain entrepreneur Mikhail Solomatin (he registered fifth on the site), suggests in a conversation with RBC magazine.
Illustrations: Sofia Miroyedova
It was possible to turn digital money into the national currency of Russia not only in a non-cash way: the exchange immediately and officially offered users cash delivery in Moscow. The minimum amount that a courier was willing to carry was from 15 thousand rubles. You had to pay for convenience - the commission for “cash” withdrawal was 7%. For comparison: through QIWI it was possible to receive rubles for 4%, and through a transfer to an account in Sberbank - 6%, as follows from the posts of the BTC-e administrator on Bitcointalk.org.
Thanks to its “Russianness,” the exchange quickly gained popularity. When, after a year of work, it was translated into English, the daily turnover of bitcoin trading reached $60 thousand at a price of $10 per piece. Users became increasingly involved: in 2013, the figure grew to $600 thousand, in 2014 - to $2 million (Bitcoincharts data). In August 2016, the total daily trading volume of various cryptocurrencies on BTC-e reached $10.4 million, and in June 2017 exceeded $66 million (Coinmarketcap statistics).
The exchange consistently ranked among the twenty largest exchanges in the world in terms of total turnover. BTC-e withheld a commission of 0.2–0.5% from each operation. Thus, during the peak days of 2017, with a daily turnover of $66 million, the profit from transactions could be from $240 thousand.
The beneficiaries were safely hidden. Some users were satisfied with such anonymity for ideological reasons, as the second registered user, programmer Roman (also asked not to give his last name), is sure: cryptoeconomics is generally considered to be free from total control - it is a whole “religion” created by unknown people under the pseudonym Satoshi Nakamoto.
However, law enforcement agencies have no time for ideology. The lack of a customer identification system, according to the Northern District of California court, attracted cybercriminals. BTC-e wallets received payments from users whose computers were infected with the CryptoWall virus, which blocked the operation of the operating system until bitcoins were paid to the hackers (the virus spread in 2013–2014). The hacker group Fancy Bear purchased cryptocurrency using BTC-e to pay for servers from which attacks were subsequently carried out, for example, on the computers of the German parliament, the BBC reported.
Some BTC-e users did not share the desire for anonymity; they periodically conducted their own investigations, trying to find out who was behind the platform. Vinnik’s surname did not come up even once in these studies, but another one came up - Svetleyshiy.
Sudden Invasion
On October 25, a new bomb dropped on the BTC-e - WEX battlefield: Binance froze several accounts that received more than 93,000 ether from two wallets indirectly associated with WEX.
Binance speaker Leah Lee said that this measure was taken in response to complaints from WEX users who noticed the flow of funds through the ether blockchain, on which the WEX exchange wallet is stored. The explorer data shows that two wallets controlled by WEX-related parties sent ether to Binance in 25 transactions from the end of July to the end of October. Given that WEX has not allowed withdrawals in Bitcoin and Ether since July, traders suspect that if they successfully transfer funds to Binance, they will no longer be able to get their assets back.
At current rates, the amount of Ether transferred to Binance is about $18 million, but the exchange's total debt is likely much higher. Judging by the size of Telegram groups dedicated to discussing the return of funds stuck on the exchange, hundreds of users are listed as affected. Thus, one of the chats has 1,000 members, another, in which filing a complaint with the police is discussed, has more than 400.
“Help us get our money back,” trader Maxim M. wrote to Binance technical support on October 20. “If you do not want to follow the path of BTC-e, which was closed by the authorities due to its involvement in laundering cryptocurrencies stolen from Mt.Gox, you must freeze all WEX wallets and accounts.”
A Binance spokeswoman said the exchange "was not aware of the specific situation on WEX" but that "we always look into user complaints in detail and we will freeze access to accounts if any unusual activity is detected."
“We encourage users who may have been harmed to file a report with local law enforcement and ask them to send us case numbers or legal notices/letters regarding the progress of the investigation. At the moment, we have not received any notifications,” the speaker added. At the same time, Lee noted that the current freeze is temporary, since the exchange has the right to freeze accounts only for a short period, while a long-term freeze requires notification from law enforcement agencies.
Crimean origins
At any time of the year, guests of Alushta can rent a room in a one-story private house: the room has been renovated with modern furniture, and the beds are covered with leopard print bedspreads. You need to agree on rent with the owners of the house - their phone numbers are published on housing search sites. One of them is 39-year-old resident of Crimea Dmitry Svetleyshiy. He allegedly became the founder of the BTC-e exchange, according to public information.
The main domain BTC-e.com (historical data from the Whois service) was registered with His Serene Highness for about two and a half years. A year before the appearance of the exchange, the Smallarena.com portal was recorded on it, where you could play StarCraft II for money. The design and structure of the first page of the site was very similar to the appearance of BTC-e. Finally, on behalf of His Serene Highness, at the end of 2011, an announcement was posted on the Freelance.ru portal about the translation of BTC-e into English.
His Serene Highness, when a correspondent for RBC magazine called him, silently listened to arguments about his involvement in the stock exchange, and then remarked: “I had nothing to do with it. My friend and companion will call you and explain everything.” He refused to answer further questions.
The “companion” turned out to be 40-year-old Konstantin Voronchikhin. He introduced himself to a correspondent for RBC magazine as “a man from the 1990s.” In the first half of the 2000s, Voronchikhin was engaged in agricultural business (data from the Ukrainian YouControl system), and in 2005, the Simferopol prosecutor’s office accused him of attempting to illegally seize a construction site, during which the ex-director of the enterprise allegedly had his eye knocked out, Crimean media wrote. After the initiation of a criminal case, Voronchikhin left Ukraine and is now, according to him, in one of the Asian countries.
Illustrations: Sofia Miroyedova
Smallarena is a project of one of Voronchikhin’s team members, created together with programmers from Eastern Ukraine: the partners met precisely because of their passion for StarCraft II. To register a gaming site in 2010, passport data and the Webmoney wallet of His Serene Highness were used, recalls Voronchikhin.
The same Ukrainian programmers could subsequently use the name and address of the Most Serene One when creating BTC-e, Voronchikhin believes and immediately clarifies: he and his “companion” learned about this after Vinnik’s arrest and angry messages from exchange clients on social networks. Voronchikhin also claims that he does not know the names of the programmers who borrowed the data of the Most Serene One to register the crypto portal.
A person under the nickname ne0n could be behind the Smallarena project: this conclusion can be made after analyzing the correspondence on the forum of the gaming site Peka2.tv. In the same way, ne0n, in the BTC-e chat in the first months they addressed one of the exchange administrators, although he already communicated with the audience under the nickname dev. Dev-ne0n was responsible for the technical part of the crypto platform, his colleague support was responsible for financial issues. At first, both founders were “quite open,” recalls exchange user Solomatin. In particular, they told one of the interlocutors of RBC magazine that they spent $20 thousand on the launch of BTC-e.
In 2013, in an anonymous interview with Coindesk.com, administrators said that BTC-e was founded by programmers Alexey and Alexander, who previously worked at the Skolkovo technology park. Clients actually addressed support as Alexey, two exchange veterans recall. It was not possible to establish his last name, nor to reveal the identity of dev-ne0n.
RBC magazine found an example in the exchange chat archive when support responded to Alexey - on December 31, 2011, at the same time he shared his readiness to sell 49% of the increasingly popular exchange. The deal could have taken place in 2012–2013, when BTC-e made a breakthrough both in terms of trading volumes and in terms of functionality: according to one of the interlocutors of RBC magazine, the platform had investors - in private online conversations, both dev and support complained that they “no longer resolve some of the issues.”
Around that time, in 2013, exchange operations specialist Vinnik and the forex company FХOpen began to work closely with BTC-e.
Public Blockchain Privileges
Due to the fact that the data on the ether blockchain is publicly available, anyone can become an “investigator”. Thus, in the Etherscan explorer it is clear that the two wallets from which the ether was sent to Binance ultimately lead to an address that was controlled by BTC-e.
Further analysis reveals that this address is linked through multiple forked transactions to a wallet owned by WEX.
And if the BTC-e address was publicly linked to the exchange (exchange platforms often ask Etherscan to attach their name to their wallet, and if they can prove that they actually own it, their name is attached to it - for example, Binance wallet addresses are designated in the same way ), but none of the more than 10 addresses involved in the transaction between BTC-e and Binance were linked in this way.
The series of transactions began on July 29, 2022, when 485,705 ether were transferred from the BTC-e address at one time to another address, which users believed to be a WEX wallet.
First transaction. Source.
This address subsequently sent another 480,000 Ether in 32 large transactions from September 2022 to January 2022 to the same address.
CoinDesk confirmed that the wallet identified in the image below belonged to WEX, as 6 users provided screenshots of their withdrawals from WEX, all of which included the address 0xb3AAAae47070264f3595c5032eE94b620A583a39.
WEX wallet scheme. Source.
But this WEX wallet was not the only recipient of BTC-e ether. Another 184,772 ethers were transferred to the address 0x95cDdecd01856aA896426bd1ee021D87F3A5c199, and from there, in smaller portions, to several other addresses.
Ultimately, two addresses - both connected to the BTC-e wallet through a chain of 6 addresses - sent a large amount of ether to an address that was recorded on Etherscan to belong to Binance.
The first wallet sent 78,581 ETH to Binance in approximately 24 transactions from August to October. The other is 14,794 ETH for 3 transactions: October 15, October 18 and October 22.
Travel of WEX funds. July 2017−October 2022. Source.
Trader Maxim M. says Binance's first response to his complaint was unsatisfactory: "They said they couldn't do anything but would keep a close eye on these wallets." “We are truly grateful for the information and we want to work with you. But at the moment it is difficult for us to verify all WEX accounts and take action. In any case, we will monitor this situation, and if any new information appears, contact us,” the letter from support said.
The affected users were also unaware of the suspension of suspicious accounts until they contacted Binance CEO Changpeng Zhao directly via Twitter. “WEX cold wallets transfer funds via @binance. It turns out that Binance is potentially helping to launder millions of dollars of funds stolen from WEX users. We have evidence. @cz_binance [Changpeng Zhao's handle]," Twitter user John James tweeted Monday night.
Changpeng promptly responded that the accounts in question were frozen and asked to report the problem to local law enforcement, making sure to obtain a case number: “We also hate this part of centralization [which implies] interaction with the complicated affairs of other exchanges (we don’t even know the details). But we will do what we can,” Zhao writes.
Rich offshore
Moscow, September 2013. Vinnik is dating an employee of the UK-registered company Mayzus Financial Services (MFS), owned by Russian Sergei Mayzus. Before the conversation begins, the MFS representative asks Vinnik to show his passport to make sure that he really is who he claims to be. “The purpose of the meeting was to get acquainted and discuss the services necessary for the BTC-e company,” states the explanatory note from the director of MFS, which Mayzus submitted to the Greek Areopagus on December 6, 2017.
MFS owns the OkPay and MoneyPolo payment systems. Through them, BTC-e users could top up their accounts on the site - along with Yandex.Money and other services. However, MFS had one exclusive service: BTC-e users could make a transfer directly from a bank account, bypassing the conversion to electronic money. Bitcoin lovers did not know who the final recipient of funds from BTC-e was, thanks to the presence of the first intermediary in the form of MFS.
Illustrations: Sofia Miroyedova
In 2013, after a meeting with Vinnik, MFS opened accounts for several companies, in particular the English Always Efficient and the Seychelles Canton Business - these, follows from the explanatory note. Canton Business, according to the indictment from the Northern District of California court, is the “offshore management company” of the exchange. Since mid-2015, Always Efficient has been listed on the BTC-e website as the official operator of the site (WayBack Machine data).
In addition to the accounts opened for law firms, Mayzus’ company also opened accounts for two private individuals, according to a note submitted to the Athens court. Both were registered “as management bodies,” that is, company directors. Always Efficient was represented by 30-year-old Alexander Buyanov, and 37-year-old Stanislav Golovanov by Canton Business.
To talk with Buyanov, a correspondent for RBC magazine went to the Moscow karaoke bar Shishas on Novy Arbat, where he works as a DJ: to talk about cryptocurrencies, he had to go outside, making his way through the dancers. The owner of a fashionable beard and a dashingly curled mustache, Buyanov least of all looks like the owner of a stock exchange with a turnover of millions of dollars. The DJ himself insists that until the scandalous news, he did not know about the existence of BTC-e, Always Efficient and that he was its leader.
RBC magazine was unable to communicate with the formal head of Canton Business, Golovanov. Unlike the capital’s DJ, who, according to him, only learned about Vinnik six months ago, Golovanov could have known him: according to RBC magazine, it was in the apartment of the future manager of Canton Business in the north of Moscow that Vinnik and his mother could have been registered at the beginning 2000s, when we moved from Kurgan.
Representatives of MFS never communicated with either Buyanov or Golovanov: as follows from the explanatory note, all matters related to the cooperation of Mayzus’ company and BTC-e were resolved with Vinnik remotely.
The IT entrepreneur himself has repeatedly stated in court that he only advised the exchange as a “technical expert.” All communication took place via the Internet, he does not know the names of his interlocutors from the trading platform, Vinnik told a correspondent for RBC magazine while he was waiting for the meeting of the Areopagus. When asked whether he gave recommendations only on the issues of conducting exchange operations and withdrawing and depositing funds, the Russian replied: “And not only.” He does not remember the specific date of the start of cooperation with the exchange: “Perhaps earlier than 2013.”
The cash flow from BTC-e users was filtered not only thanks to MFS. Offshore companies, probably associated with Vinnik and opening accounts with Mayzus’ company in 2013, sent funds to the next authority.
Insight
In July, the lawyer of the exchange founder Dmitry Svetleyshiy, who wished to remain anonymous, agreed to comment on the situation around BTC-e/WEX. According to his information, the operation to “liquidate” the exchange began to be carried out by the FBI around July 2016, and a special FBI agent known from the time of the Silk Road case took part in it. The fact that the proceedings against BTC-e were conducted long before its collapse in July 2022 is evidenced, in particular, by a document registered by the US Department of Justice on January 17, 2022, in which BTC-e and specifically Alexander Vinnik are accused of laundering stolen bitcoins from the Mt.Gox, Bitcoinica and Bitfloor exchanges.
According to the lawyer, Vinnik is a former administrator of BTC-e and has access to offshore accounts containing $1 billion. “Vinnik knows who actually owns $1 billion offshore. If we talk about the likelihood of his extradition to the United States, then this issue has already been resolved. He will be deported there - that’s 101%,” he said this summer (when no equivalent decision had yet been made to deport Vinnik to Russia).
As for Mayzus, whose company, according to the United States, is involved in fraud on the stock exchange, the lawyer of the Most Serene One said that he was deliberately pitted against the Most Serene One by the former leaders of the platform in order to deflect the blow from themselves. And although after a personal meeting the disagreements were resolved, Mayzus did not want to take the side of His Serene Highness and, according to an anonymous lawyer, is participating in the game as a separate party, protecting his reputation.
According to his information, at the time when Vinnik was already being held in a Greek prison, one of the “influence groups” appropriated 45% of users’ balances and allegedly organized two failed attempts on Vinnik’s life and on his Serene Highness.
The opposing group, the real owners of the exchange, according to the lawyer, had nothing to do with business management until 2022 and did not initially intend to fight for $1 billion. They were asked to pay 500 BTC compensation in order to reach an agreement on the amount missing from their accounts. That is, by paying $1 million at that time, those responsible for the theft of 45% of balances could have gotten rid of their competitor in the fight for offshore companies, but they refused the deal. “Everything has gone too far because of simple greed. Now the real creators of the business, the only ones according to the documents, claim everything except what the US authorities will confiscate. This is not the case of the Winklevoss brothers against Zuckerberg, the founders are clearly known here,” the lawyer said.
The next figure who appeared already in the WEX era is the failed buyer of the exchange, former DPR militant Dmitry Khavchenko, known under the call sign “Sailor”. His intentions to acquire the exchange became known in early July 2022. However, already on July 26, the media reported that the deal did not take place - according to Khavchenko, due to unsuccessful negotiations with Dmitry Vasiliev. “[Representatives of the DPR], by the way, were also deceived and gave away the exchange after 45% of the balances were ripped apart so that those responsible for the theft would not be torn to pieces,” commented an anonymous lawyer a few days before the failed purchase of the exchange.
“My client invites all parties to a meeting. “Moryachka”, those responsible for the theft of balance sheets and other interested parties, in order to reach some kind of consensus, but those who ordered the assassination attempt on Vinnik are simply afraid to make contact,” says the lawyer.
Exchange relatives
In May 2017, the BTC-e administration took the first step towards abolishing the basic principle - the ability to buy and sell cryptocurrency anonymously, indicating only an email during registration. Users were offered to undergo voluntary verification in exchange for a number of benefits for replenishing personal accounts: for devirtualization, they had to provide a scan of their passport and, for example, copies of payment of utility bills. It was necessary to go through the procedure not on BTC-e, but on another trading platform with a similar name - xBTCe.com, which may be associated with the FXOpen company.
FXOpen was founded in the mid-2000s. The holding, which unites a network of legal entities from Russia, Latvia, Great Britain, New Zealand and other countries, provides trading services on the foreign exchange market (forex). The Russian division of the group is headed by Elena Isaeva, deputy of the expert advisory council under the budget committee of the Federation Council. In various online ratings based on broker assessments, FXOpen is among the top 20 companies in the world.
Cooperation between FXOpen and BTC-e began in 2013, when clients of the exchange had the opportunity to trade the BTC/USD currency pair through the MetaTrader platform, and since 2014, users have the opportunity to give the cryptocurrency to a trader for management (so-called PAMM accounts). All software for pumping BTC-e was provided by FXOpen. No exchange offered such a service at that time, so users perceived it as a breakthrough, recalls cryptocurrency veteran Roman.
In the second half of 2013, two new administrators registered on BTC-e - support5 and support1: they used the Latvian IP addresses of the Soft-FX company, part of the FXOpen holding (data from the exchange's user base). Support1 subsequently acted as a moderator and even banned trading platform participants, as follows from the chat archive. “This exchange [BTC-e] is the cousin of FXOpen. “Everything speaks about this,” wrote one of its clients, Alexander, back in early 2014 in the chat of the trading platform.
The relationship could be not only technical, but also financial. In Athens, Mayzus handed over to the Areopagus a report to the UK National Anti-Crime Agency, prepared by MFS after the BTC-e scandal, which analyzed the transactions of Vinnik’s structures for 2014–2017. The exchange's money was transferred in transit to companies related to FXOpen, as follows from the document: in 2017 alone, the New Zealand company XP Solutions Ltd, associated with the forex holding, received about €26 million and $900 thousand through MFS.
The beneficiary of FXOpen is 36-year-old native of Belarus Alexander Klimenko. He owns one of the holding's parent structures, the British FXOpen Ltd, and the company's trademarks (data from the UK Trade Register and the Justia Trademarks service).
FXOpen “did not own a stake in the BTC-e exchange and did not even cooperate with it, but simply provided technical solutions,” Klimenko said in a conversation with a correspondent for RBC magazine. For all services, including verification through xBTCe.com, the exchange paid the holding, he added, refusing to name specific amounts. When asked if he knew Vinnik personally, Klimenko replied: “Of course, they came to our office.” The entrepreneur could not remember who exactly represented BTC-e, except Vinnik.
Klimenko's acquaintances claim that he lives permanently in Riga. Vinnik, according to RBC magazine, traveled to the Latvian capital at least six times from February 2016 to May 2017 alone, but Klimenko says that he did not meet with him during this period. When asked to talk about his acquaintance with the owner of FXOpen, Vinnik himself remarked: “I can’t answer this question right now.”
Vinnik’s last trip to Riga for one day took place in May 2017. Two months later, he went to Europe again - this time he and his family flew to Greece on vacation. And since then he has not been able to leave this country.
How the incarnation of BTC-e became a WEX scam
Less than 2 months have passed since the disappearance of BTC-e, when a similar trading platform World Exchange Services or the WEX exchange entered the crypto market, which by December of the same year reached a huge figure of $80 million in daily trading volume! The exchange quickly entered the TOP 20 most popular crypto exchangers in the world. However, this is a completely different story, given that in just a year, the new managers of the exchange have practically turned it into a prime example of scam. Why this happened, what factors, in our opinion, became decisive - more on this later.
Continuity and legitimacy
The first thing that interested participants in the crypto industry in connection with the launch of the new exchange was its legitimacy and attitude towards the closed BTC-e. It must be said that, despite the WEX exchange administration’s denial of any intersection with the disgraced trading platform, the idea of continuity in the crypto community arose immediately. And there were good reasons for this:
- First of all, BTC-e itself stated in August 2022 that its relaunch would take place on September 15 and that the client base would be transferred to the investment company prior to the offer agreement. And indeed, former BTC-e clients became WEX users;
- The WEX interface was almost identical to the BTC-e website in terms of design, functionality and trading capabilities;
- Finally, the head of the new exchange, Dmitry Vasiliev, promised that his company would pay off BTC-e’s debts to clients.
Probably, in a similar way, the new team tried to secure the project from the US authorities, who could hypothetically seize the platform and assets.
WEX interface
// Source: WEX.nz website
Be that as it may, the WEX exchange became the heir not only of infrastructure and obligations, but also of the shadow history and far from crystal image of its predecessor. Later, the lawyer of the founder of BTC-e, Musatov, confirmed the information about the “hereditary” nature of the WEX exchange. From him it became known that part of the assets of the closed exchange was to be transferred to pay off its obligations to clients.
Regarding legitimacy, it is more complicated. Firstly, it was no longer a Russian exchange, but a Singaporean one at the place of registration. However, the domain used belonged to New Zealand - WEX.nz.
Debt recovery and daily turnover growth
For some time since its launch, the WEX exchange enjoyed the trust of traders and had an excellent reputation. At first, the company sought to fulfill its obligations to return debts to users affected by the collapse of BTC-e. Funds were transferred to client wallets in the original currencies - about 60% and a little more than 40% were credited in WEX debt tokens specially issued for this purpose. The exchange promised clients to buy all these coins from them in 1-2 years.
Everything went as planned, and by the end of 2022, the daily turnover on WEX was already more than $79 million. Spot trading of Bitcoin (BTC), Litecoin (LTC), Ether (ETH), Namecoin (NMC), Novacoin (NVC), and Peercoin (PPC), Dashcoin (DSH), Bitcoin Cash (BCH) and Zcash (ZEC). In addition, transactions were concluded on currency pairs with EUR, RUR and USD.
Depositing and withdrawing assets was convenient for clients and was carried out through payment systems AdvancedCash, PerfectMoney, Payeer, Yandex.Money. The fee charged depended on the withdrawal method: the most expensive, respectively, for an international bank transfer. There were so-called Wex codes used to authorize transactions. Thanks to the codes, assets were entered instantly and without any commission.
Features of the trading platform
WEX scam
Unlike BTC-e, the WEX exchange guaranteed clients compliance with KYC / AML standards. And this was a big plus for the image of the new exchanger. At the same time, verification on the exchange was not mandatory and was used only for depositing fiat money or withdrawing it from an account to a bank card, as well as when performing a bank transfer service or when using payment services that require identification confirmation.
The exchange interface was localized in three languages - English, Russian and Chinese. Operations were distributed across intuitive tabs - “Finance”, “Security”, etc. Convenience was added by the function of calculating the transaction amount and exchange commission. The highlight of the service is the Bitcoin Betting sweepstakes. It placed bets on forecasts for the exchange rate of Bitcoin to the US dollar. However, it seemed more like a way to attract clients than a useful tool.
Security on the exchange was no different from other exchangers; in particular, two-factor authentication was supported. There were also several useful features, such as login history and the ability to independently block account functions for up to 30 days. All that was required was a Google Authenticator key.
There were also disadvantages, namely:
- Damaged reputation of predecessor;
- High trading commissions compared to the average of other exchanges;
- A small number of cryptocurrency pairs;
- Password generation by the company, not by users, etc.
The lack of information about the owners and team of the exchange was also confusing.
Who is the owner of the WEX exchange
Without a doubt, the success or failure of a project largely depends on the competence of its management. But the irony is that neither then nor now has it remained a mystery to the public who actually managed/was the owner of the exchange - first BTC-e, then WEX. It was suggested that neither Vinnik nor Vasiliev were such. We will not delve into this topic due to the lack of reliable facts, but we will still dwell, at least schematically, on the personality of the manager of the WEX exchange and those who one way or another applied for this place.
The official owner and head of the WEX exchange is Dmitry Vasiliev, a 32-year-old native of Minsk (Belarus).
Dmitry Vasiliev
// Source: promining.net
There are conflicting rumors about him. Some say that he is a well-known card player - a gambling addict “Belorus” with fabulous poker debts and numerous ill-wishers in St. Petersburg. Perhaps so, if we take into account the fact that in 2022 the arbitration court declared him bankrupt for a debt of 2.3 million rubles.
Unified Register of Bankruptcy Information
// Source: fedresurs.ru
According to others, the head of the WEX exchange was previously one of the major clients of the BTC-e crypto platform, and up to ⅓ of the daily trading volume passed through him. They say that he allegedly contacted one of the site’s creators, developer Alexey, who was known under the name support, and “offered his candidacy for resuming the exchange.” It seems that he received consent with the condition - to pay debts to BTC-e clients and help in the release of Vinnik.
Coder Alexey is perhaps the most mysterious figure in this whole story. According to those who knew him personally, he is a man of his word. According to the PrivateFX forum, Alexey B. could be Alexey Belan, one of the FBI's most wanted hackers for a $100,000 reward. He managed to hack the services of large American corporations such as Yahoo and steal client databases.
There is another contender for ownership of the WEX exchange, which cannot be ignored, because, as observers note, its problems began from the time of his application to acquire the exchange.
We are talking about Dmitry Khavchenko, who fought in the ranks of the DPR self-militia under the name “sailor”. In the 1990s and 2000s, he worked in Kyiv at the gas company, and in 2007 he headed the Ukrainian subsidiary of the Russian SU-155 construction group. Khavchenko is also known as an employee of the special unit of the Prosecutor General’s Office in the Donetsk People’s Republic and as a deputy of the “Parliament of Novorossiya”. They talk about his connection with the then Prime Minister of the DPR, Alexander Borodai, who was a consultant to Russian businessman Konstantin Malofeev. True, the Ministry of Internal Affairs of Ukraine added Khavchenko’s name to the list of people wanted for committing financial crimes.
Dmitry Khavchenko
// Source: csef.ru
And again, complete contradictions.
On the one hand, it seems that the deal to sell the exchange did not take place for two reasons:
- Due to the fact that Dmitry Khavchenko, as a possible owner of the WEX exchange, did not like the administrator - that same mysterious Alexey, and he simply disappeared with the keys;
- Allegedly, the “sailor” himself was not satisfied with the terms of the deal and the growing difficulties in WEX. It was alleged that 45% of user balances had already been plundered, and the sale of the company was seen as an attempt to avoid liability.
On the other hand, persistent rumors are multiplying that the deal was completed after all, and Khavchenko’s 29-year-old daughter, Daria, became the owner of the trading platform.
At the same time, the former owner of the exchange, Dmitry Vasilyev, continues to be listed in the Singapore register. He himself once said that he had lost access to crypto exchange servers and was only the nominal owner. It is even suggested that Malofeev’s structure is behind the attempt to buy WEX through Khavchenko. However, his press service denies this.
In general, the story is getting darker and more confusing. This happens when they bet on the wrong person.
Coin exchange rate imbalance, domain loss and asset withdrawal restrictions
Problems became noticeable in mid-2022. At first, the crypto community was surprised by the disproportion in the exchange rate of coins, then by the loss of the New Zealand domain of the exchange and, finally, by the exponential growth of complaints from users who could not withdraw their assets from the WEX exchange.
If we talk about the imbalance in the exchange rate of coins, then since the beginning of July, the exchange value of Bitcoin (BTC) on WEX has significantly exceeded the average value: for example, on July 26, 2022, it was possible to buy Bitcoin on the platform for $9,600, while on other sites for $7,949 (CoinMarketCap ). Or the same ether (ETH), trading on WEX for $309 against the average level of $204.
Another problem that indicates a clear problem with the exchanger is the loss by the WEX exchange of its .nz domain and the transition to wex1.in. It turns out that the wex.nz Internet address was registered with fake contact details (!), which is not permissible under the rules of the New Zealand Domain Name Commission (DNC).
“The Domain Name Commission has suspended domain names due to false registration information, in accordance with their verification measures and .nz policy,” explained representatives of the organization and called on victims of crypto exchange fraud, if any, to contact law enforcement and Netsafe.
Since July 2022, restrictions on the withdrawal of funds from the exchange also began: for example, the platform allowed the exchange of BTC, ETH and other cryptocurrencies for fiat money only through the Yandex.Money service, with a very large commission (!). As a result, users lost up to 90% of their investments. Only a few coins, such as XMR and ZEC, remained available for withdrawal, but their liquidity was too low.
Already in the fall of 2022, users, mainly from Russia and neighboring countries, who were unable to return their crypto and fiat assets deposited in the WEX exchange, began to file complaints with the police. Accordingly, criminal cases appeared.
WEX was talked about as a scam.
"Washing Dirty Bitcoins"
Bitcoin Laundering
In addition to all the exchange's problems, consulting firm PricewaterhouseCoopers (PwC) added fuel to the fire in March of this year by publishing a "Strategic Alliance Bulletin" on the growing use of cryptocurrency for illegal and fraudulent activities such as money laundering. It mentioned a connection between SamSam Ransomware and the crypto trading platform WEX.
PwC reported that two Iranian nationals, Faramarz Shahi Sawandi and Mohammad Mehdi Shah Mansouri, who are said to be the SamSam ransomware hackers, used WEX to launder more than $6 million.
“We have determined that this Iranian money laundering operation is linked to the WEX (formerly known as BTC-e) currency exchange,” the document noted.
PwC clarified that hackers are deliberately using "lesser-known" cryptocurrency exchanges to launder coins, as popular platforms typically have tools to detect illegal activities such as phishing, making it more difficult for hackers to launder money." And this is again a very serious accusation against WEX.
Extradition war
On the hot morning of July 25, 2017, more than a dozen men wearing shorts, T-shirts and sunglasses came to one of the beaches on the Halkidiki peninsula. They could be mistaken for tourists, but they did not go down to the sea for a swim: they were interested in a man relaxing on a sunbed next to his two young sons, Vinnik’s current wife Alexandra Shevchenko said in an interview with the RT channel. This is how the whole world learned about Vinnik, whom Greek law enforcement agencies arrested at the request of the US Department of Justice.
At the same time, FBI officers arrested the exchange servers, which had been located in the US state of New Jersey since 2011. The BTC-e website stopped loading: the domain was seized - now there is a stub with the emblems of various American law enforcement agencies.
The Northern District of California court approved the indictment against Vinnik back in January 2017. The arrest was made only after the entrepreneur went online from a mobile phone number known to Americans, the RIA Novosti agency wrote. In the United States, Vinnik is considered the owner of BTC-e, which was used by cybercriminals for money laundering. The specific amount is not indicated in the indictment: it is only written that the value of the bitcoins passed through the exchange exceeds $9 billion. At the same time, in the release of the US Department of Justice, published after the arrest of the Russian, a different estimate was given - $4 billion.
In particular, American law enforcement officers believe that Vinnik was involved in the withdrawal of 530 thousand bitcoins stolen from 2011 to 2014 from the wallets of the Japanese Mt. Gox: 300 thousand went to three accounts on BTC-e, including WME and Vamnedam, which are associated with Vinnik, as indicated in the materials of the American court.
The Greeks are considering the issue of Vinnik's extradition slowly. He was transported from the beach in Chalkidiki to a prison in Thessaloniki: in early October, the city’s council of judges supported the Americans’ request. But the Russian filed a complaint with a higher authority, the Areopagus, and he was transported to an Athens prison. The final decision on Vinnik's extradition will be made by the Greek Minister of Justice. He will have to choose: Russia also sent a request for extradition.
On August 11, 2017, the Ostankino District Court ruled in absentia to arrest Vinnik on charges of large-scale fraud (up to 1 million rubles). The basis was a criminal case: Vinnik allegedly did not supply certain equipment to a commercial company, after which its director contacted the police, it follows from the impersonal arrest warrant. We are talking about, a representative of the Ostankino court told RBC magazine. In Russia there is only one company with this name (data from SPARK-Interfax): this Samara company supplies pipeline fittings, and its director Leonid Mashkov, who allegedly wrote a statement to the police, first heard about Vinnik and the criminal case from the author of this article. The Main Directorate of the Ministry of Internal Affairs of Russia for Moscow did not answer RBC’s questions.
Five years ago, a similar scenario followed the rescue of employee Dmitry Zubakha, who was arrested while on vacation in Cyprus at the request of the American authorities. In the US, he was suspected of hacking attacks on Amazon and eBay. Before the completion of formal extradition procedures, a criminal case was opened against Zubakha in Russia, accusing her of stealing money via the Internet from Russian companies. A long consideration of requests for extradition from different countries ended in a victory for Russia: in the spring of 2013, Zubakha was taken to Moscow, where he was sentenced to a suspended sentence.
The similarity of the cases does not end there: like Zubakha, Vinnik is defended by lawyer Timofey Musatov. In the late 2000s, he represented the interests of Natalya Kasperskaya in the conflict between Kaspersky Lab shareholders, and now he owns 10% of the shares in it (data from SPARK-Interfax). Kasperskaya’s husband, Igor Ashmanov, hired a successful lawyer to rescue his employee Zubakha from a Cyprus prison, Ashmanov himself wrote in a column on Roem.ru.
Musatov said that he took up Vinnik’s case after an appeal from his wife, who contacted him through Zubakha. The latter confirmed that he had become a mediator: Shevchenko read about his Cypriot story and, five or six days after the events on the beach, asked for Musatov’s contacts. Vinnik’s wife pays for legal services; Ashmanov does not participate financially, the lawyer clarified.
But it couldn’t have happened without Ashmanov’s help. He didn’t know Vinnik and didn’t understand whether he was a criminal or not, but the businessman doesn’t like the fact that the United States “considers the whole world to be its jurisdiction.” “I helped them with connections, brought them together with different people, including government officials,” said Ashmanov.
Something went wrong
In July 2022, the fairy tale of the stock exchange coming to life ended when some assets traded on the site experienced significant inflation. For example, Bitcoin was trading 30% higher than the average market rate. In parallel with this, fees for withdrawing fiat money increased (it was possible to withdraw fiat money only with a 10% loss), and a message about planned technical work was published on the official Twitter.
The market reacted accordingly, and the price of debt tokens plummeted.
Dmitry Vasiliev announced his position on Facebook, calling on users to file reports with the police and blaming the current state of affairs on the new management of the site, in particular, the vice president for the development of organized trade in digital financial assets of RACIB Dmitry Sutormin.
