U.S. Cracks Down on Crypto Exchanges Linked to Ransomware Activity

• The U.S. government has seized web domains and infrastructure associated with two crypto exchanges 

• Russian crypto exchange PM2BTC has been identified as a “primary money laundering concern” associated with ransomware 

• The U.S. slapped sanctions on a crypto exchange called Cryptex and a Russian individual associated with these networks 

The big picture: The U.S. government has been part of several international disruption efforts targeting Russian cybercrime services this year, but the one announced today focuses on one area in particular: The services that make up the illicit financial backbone of ransomware and other types of cybercrime (think the Tornado Cash mixer crackdown in 2022). 

Key details: A new order issued Thursday by the U.S. government prohibits “certain transmittals of funds by any covered financial institution involving PM2BTC,” saying that nearly half of PM2BTC’s exchange activity had links to illicit activity. PM2BTC, which allows users to exchange between Russian Rubles and virtual currencies like Bitcoin, also utilizes an unusual obfuscation that makes it more difficult to track attribution of transactions to cybercriminal activity - a similar tactic used by other virtual currency exchanges enabling illicit finance, according to the Treasury Department.

The U.S. government has also issued sanctions against a crypto exchange called Cryptex, which operates in Russia and provides financial services to cybercriminals (in fact, the network has received over $51.2 million in funds derived from ransomware attacks). 

The U.S. finally sanctioned and unsealed an indictment against Russian individual Sergey Sergeevich Ivanov, who is associated with PM2BTC and Cryptex and who has allegedly laundered hundreds of millions of dollars in virtual currency for various cybercriminals. The State Department has issued a $10 million reward for information leading to Ivanov’s arrest and conviction.

The takeaway: The crackdown on crypto exchanges is one of many ways the U.S. government is using its international relationships to target cybercrime. The hope is that the disruptions will put further pressure on ransomware groups that leverage these services.

Image credit: Immanuel Kant on Flickr.