Cybercrime , Cybercrime as-a-service , Fraud Management & Cybercrime

Greece Will Send Russian Cybercrime Suspect to France

US Accuses Alexander Vinnik of $4 Billion in Bitcoin Money Laundering
Greece Will Send Russian Cybercrime Suspect to France

A Greek court has ruled that Russian national Alexander Vinnik, 38, will be sent to France to face cybercrime charges.

See Also: Webinar | Everything You Can Do to Fight Social Engineering and Phishing

French authorities have accused Vinnik of defrauding individuals worldwide, including about 100 in France, as well as using the e-BTC bitcoin exchange to launder 20,643 bitcoins worth about €133 million euros ($155 million), Associated Press reports (see Criminals Hide 'Billions' in Cryptocurrency, Europol Warns).

Vinnik denies the charges against him.

Greece's Supreme Court had previously ruled that Vinnik would be extradited to the United States, which has also filed charges against him.

But on Friday, a court in the northern Greek city of Thessaloniki ruled that a European arrest warrant issued by France took precedence over extradition requests filed by the U.S. as well as from Russia, which accused him of fraud. Previous court rulings held that he could have been extradited to both countries.

Legal experts say that an arrest warrant from a fellow EU member state - in this case, France - takes precedence over international extradition requests.

Vinnik remains jailed in Greece pending a final decision over his extradition request, which his defense lawyer, Ilias Spyrliadis, says his client will appeal.

Vinnik Arrested at US Request

Last July, Greek police arrested Vinnik at the request of U.S. authorities for allegedly running a massive money laundering operation that processed $4 billion in bitcoins over a six-year period via a cryptocurrency exchange called BTC-e, according to a 21-count federal indictment that was unsealed and partially redacted last year (see Feds Indict Russian Over BTC-e Bitcoin Exchange).

U.S. authorities allege that BTC-e, founded in 2011, operated not only as an unlicensed money service business, but was also used to launder funds for numerous cybercriminal enterprises (see Cryptocurrency Laundering's Explosive Growth).

"BTC-e facilitated crimes, including computer hacking and ransomware, fraud, identity theft, tax refund fraud schemes, public corruption and drug trafficking," according to the indictment. "Since its inception, Vinnik and others developed a customer base for BTC-e that was heavily reliant on criminals, including by not requiring users to validate their identity, obscuring and anonymizing transactions and source of funds, and by lacking any anti-money laundering processes."

If convicted of all of the charges against him, Vinnik would face a penalty of up to $12 million as well as up to 55 years in prison.

BTC-e, meanwhile, has already been fined $110 million by the Financial Crimes Enforcement Network, which is a bureau of the U.S. Department of the Treasury.

Notice displayed on the website of BTC-e, which was launched in July 2011.

Following his arrest last July, Vinnik applied for asylum in Greece. Authorities rejected his application.

Beyond the French arrest warrant and U.S. extradition request, Russia also filed an extradition request for Vinnik with Greek authorities, accusing him of fraud, before filing a second request that accused him of an even greater amount of fraud. Moscow has a history of filing competing extradition requests whenever one of its citizens gets arrested on cybercrime charges in a foreign country - often while vacationing abroad. Thus far, none of these extradition requests has ever been successful (see Russia's Accused Hacker Repeat Play: Extradition Tug of War).

Russia Slams Extradition Ruling

Russia's foreign ministry slammed the Greek court's Friday ruling and threatened reprisals.

"Yielding to external pressure, the Greek authorities continue to complicate relations with Russia," the ministry said in a statement about Vinnik's extradition to France. "These measures have been taken contrary to the legal framework of bilateral cooperation in the area of legal aid in civil and criminal matters. Greece has turned a blind eye to a request from the Prosecutor General's Office of Russia to extradite Vinnik to his home country, a request that should have been given priority. It is obvious that Russia cannot leave these actions unanswered."

The Greek court's Friday ruling that Vinnik would be sent to France came one day after Greece announced that it was expelling four Russian diplomats over Moscow allegedly funding opposition groups aimed at upending a historic deal between Greece and Macedonia that paved the way for Macedonia to join NATO.

Last week, at a NATO meeting attended by U.S. President Donald Trump, Macedonia was formally invited to join NATO.

Alleged Ties to Mt. Gox Theft

The U.S. indictment against Vinnik, meanwhile, reads like a "who's who" of bitcoin-fueled cybercrime.

Last year, the Tokyo-based group of bitcoin security researchers called WizSec fingered Vinnik as the most likely culprit behind the laundering of about $500 million stolen from the defunct bitcoin exchange Mt. Gox.

In 2014, the Tokyo-based exchange shuttered in dramatic fashion after Mt. Gox CEO Mark Karpeles, a French national, blaming "weaknesses in our system," said that a hacker had stolen 850,000 bitcoins, then worth about $480 million, as well as $28 million in cash from the exchange's bank accounts.

Mt. Gox quickly declared bankruptcy, and Japanese authorities launched an investigation.

"We won't beat around the bush with it: Vinnik is our chief suspect for involvement in the MtGox theft (or the laundering of the proceeds thereof)," WizSec said in a blog post after Vinnik's arrest in Greece was announced.

Indeed, according to the U.S. indictment against Vinnik, "a sizeable portion of the stolen Mt. Gox funds were deposited into accounts controlled, owned and operated by BTC-e and by defendant Vinnik and others known and unknown to the grand jury."

The indictment alleges that 300,000 bitcoins stolen from Mt. Gox were deposited into three separate but interlinked BTC-e accounts, one of which was controlled exclusively by Vinnik. The indictment alleges that the bitcoins "were then exchanged into fiat currency and sent to bank accounts in Cyprus and Latvia tied to Vinnik and other identities associated with Vinnik and BTC-e."

Corrupt Silk Road Agents Used BTC-e

Two other alleged users of BTC-e for money laundering purposes were Carl M. Force IV and Shaun W. Bridges, a pair of federal agents who stole bitcoins from the notorious underground marketplace called Silk Road, which they'd been tasked with investigating.

"Their experience with the criminal underworld taught them that using BTC-e, as opposed to a registered exchange with anti-money laundering policies, would maximize their changes of being able to conceal criminal proceeds," according to the indictment against Vinnik. "Each therefore sent several hundred thousand dollars in criminal proceeds - derived from crimes ranging from theft of government property to extortion - to the BTC-e platform for laundering."

Force, formerly a special agent with the Drug Enforcement Administration who'd been assigned to a Silk Road task force, pleaded guilty in 2015 to stealing $820,000 worth of bitcoins while helping to run the U.S. government's investigation. In October 2015, he was sentenced to serve a 6.5-year prison sentence.

Also in 2015, Bridges, a former special agent with the Secret Service's Electronic Crimes Task Force also assigned to the task force, pleaded guilty to stealing $820,000 worth of bitcoins and was sentenced to serve nearly six years in prison.

But in November 2017, Bridges was ordered to serve 24 more months in prison following the end of his first sentence. He'd been arrested - after pleading guilty to the earlier charges, but before started his prison sentence in 2015 - on charges related "to another theft of approximately 1,600 bitcoin from a digital wallet belonging to the U.S. government," according to the Justice Department.

After pleading guilty to those charges, Bridges agreed to surrender the approximately 1,500 bitcoins and "fiat currency," which as of November 2017 was worth about $10.4 million, prosecutors said.

About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.