red 
As Ukraine’s long-awaited counter-offensive continues, Russian military fundraising groups are further upset by the aborted June 23 Wagner Rebellion.
In our Crypto in Conflict report, we examined the crypto operations of such organizations, many of which procured and delivered weapons to the very mercenaries who – briefly – marched 200 kilometers outside Moscow. In this blog, Elliptic looks at how these operations have evolved since the publication of our landmark report in February.
A year after the start of the invasion, Ukraine’s highly popular and successful crypto donation campaign has raised at least $212 million. It accounted for a whopping 20% of all major Ukrainian fundraisers.
Pro-Russian military procurement and disinformation groups, meanwhile, raised a relatively smaller $4.2 million. However, since then, with the identification and sanctioning of new Russian financiers by NATO allies, Elliptic’s research team calculates that pro-Russian crypto payments are much closer to $20 million. Many of these payments are likely donations, but some may also be internal payments to the operatives behind these fundraisers. While the figure may still seem small compared to Ukraine, just over half of these assets involve entities sanctioned by the United States – highlighting the continued risks to virtual asset services.
Among those sanctioned entities are a number of individuals, groups and loose networks that have embraced crypto for various reasons. For some – such as PMC Wagner’s US-sanctioned mercenary group “Task Force Rusich” – they are a source of fundraising beyond the relatively more lucrative campaign of fiat donations.
For others, crypto is used more as an incentive. Senior officials of the so-called Donetsk People’s Republic – which boasts former crypto Ponzi scheme promoters and sanctioned individuals in its ranks – claim to reward defectors and intelligence on Ukrainian military positions with bitcoins. The Rusich Task Force suggested that its supporters could bury dead Ukrainian soldiers and demand bitcoin from their families in exchange for the location of their final resting place.
Task Force Rusich advertises its activities on Telegram (left) and US-sanctioned DPR official Aleksey Muratov promotes the cryptocurrency as a potential means of evading sanctions (right).
Proliferation of Russian military equipment: growing risk of sanctions
Sanctions regimes around the world continue to take an increasingly tough stance against pro-Russian individuals and entities that raise money to purchase military equipment. Among those under sanctions who have cryptocurrency donation wallets are arms dealer Jonatan Zimenkov, Russian-appointed Zaporizhia official Vladimir Rogov and former Donetsk Defense Minister Igor Girkin. Collectively, US-sanctioned war-funding entities raised over $10.6 million in crypto assets – more than half of the observed total crypto activity.
However, the risk is not limited to these threats. Numerous other groups, individuals, and organizations are sanctioned by other jurisdictions or have close ties to US-sanctioned entities. They may also operate in regions of Ukraine annexed by Russia that are subject to sectoral sanctions.
Even groups that claim to be purely “humanitarian” in nature—reportedly collecting cryptocurrency for civilian aid in Russian-occupied regions—have shown exposure to sanctioned individuals. One example is the so-called “Russian Humanitarian Mission” (ROM), which receives support from the Russian Ministry of Foreign Affairs and is involved in imposing a Russian curriculum in occupied Ukrainian schools. ROM requested crypto donations through the wallet of Russian fighter Yevgeny Poddubny, who is under sanctions from Great Britain, Canada, Australia and Ukraine.
The Elliptic Investigator chart below shows how Poddubny himself receives funds from a range of sanctioned entities, such as Hydra Dark Market and Garantex Exchange – as well as criminal entities such as Bitzlato Exchange and dark web market Shkaf.
Elliptic Investigator shows the funds flowing into Poddubny’s wallet from a variety of criminal and sanctioned sources.
Why is this important?
Compared to Ukraine — which topped tens of millions of dollars in crypto donations within days of a full-scale invasion — pro-Russian crypto engagement remains small. However, the increasing focus of the sanctions regime on financiers of Russian military equipment highlights the continuing need for effective compliance regimes by virtual asset services. This is exacerbated by the potential for the risk of sanctions not to be immediately apparent, as in the case of the ostensibly humanitarian organization ROM.
Elliptic researchers analyzed the types of virtual asset services commonly exposed to Russian military fundraising using on-chain data. Tracking the movement of cryptocurrencies from fundraising reveals that centralized exchanges are by far the most common destination for funds. Over 80% of the observed funds originating from these entities end up on exchanges, which highlights the significant risks of exposure to sanctions against such services if precautions are not taken.
However, it is not only centralized services that bear the risk. Sanctioned pro-Russian entities have also engaged in decentralized finance (DeFi) protocols, including decentralized exchanges, cross-bridges, and non-fungible token (NFT) services.
US-sanctioned individual Alexander Zhuchkovsky, for example, heavily promoted “Project Terricon” – a short-lived NFT collection aimed at raising funds for the Russian war effort. NFT marketplace Opensea quickly deleted the collection before it could raise any funds.
The ongoing war and the responses of a range of sanctions regimes around the world have clear implications for a wide range of players in the virtual asset ecosystem. Elliptic’s 2023 Cryptocurrency Sanctions Compliance Guide offers strategies to protect different types of virtual asset services from exposure to sanctions risks. You can also read more about the profile of these threat actors in our aforementioned “Crypto in Conflict” report.
How Elliptic can help
Elliptic takes immediate steps to flag all sanctioned entities within its tools and undertakes research to identify all crypto addresses belonging to them even if they are not listed in the original tag.
This is in addition to our routine monitoring of the pro-Russian military fundraising ecosystem, which ensures that virtual asset services and law enforcement investigators can effectively review, monitor and investigate the blockchain activities of these threat actors. Learn more about our wallet overview, transaction tracking, entity analytics and crypto research solutions or contact us for a demo.
