Russia has been subject to multiple sanctions and other measures imposed by western countries, yet darknet markets and ransomware teams have continued to thrive in the region. This is according to a report accessed by the World’s Illicit Blockchain House.
Russia’s Crypto Platforms Adapt To Disruptions Resulting From Ukraine Conflict
Prior to the Ukraine-Russia conflict, more than half of global illicit crypto funds were exchanged through cryptocurrency exchanges connecting the two countries. Cybercrime organizations were widely active in both countries. The global darknet market for cryptocurrency trading, TRM, was dominated by Russian DNMs.
Over the last 12 months, the Blockchain Intelligence Agency has checked the changes in the illicit crypto environment to understand how cybercriminals respond to the financial, logistical and political issues caused by the conflict. The firm calls it the “first crypto conflict.” Donations in digital assets are used to fund their military campaigns and humanitarian efforts. Western powers tried to limit Moscow’s alternatives, but crypto currencies came in handy to bypass restrictions.
When the battle began, international governments and law enforcement agencies pursued Russian customers, who are exposed to further risks by DNMs, ransomware syndicates and crypto exchanges linked to DNMs. Nonetheless, they have withstood the extraordinary opposition they faced, as investigators have discovered.
In April, German authorities seized servers belonging to the largest darknet market, Hydra. The US Treasury Department imposed sanctions on Hydra and Garantex, a Russian-based cryptocurrency exchange, accused of processing USD 100 million in illegal transactions. This includes $6 million from the Russian ransomware gang Conti to Hydra.
Despite the crackdown, Garantex has continued to operate, with more than double the trading volume in the first four months of 2022 compared to the same period in 2021, according to TRM Labs. In the meantime, Russian DNMs have quickly filled the void left by Hydra’s demise. Between 5% and 10% of these platforms were sold in May and December 2022.
At the same time, however, Conti, officially closed in May, has been renamed and is still used by small teams. A report released by Chainalysis in January of this year revealed that sanctions had a significant impact on ransomware income.
The TRM report also highlights the politicization of some Russian and Ukrainian hackers and offers Killnet. The group distributes malware and distributed denial of service (DoS) attacks and has pledged allegiance to the Russian state, threatening entities linked to hostile countries. Pro-Ukrainian dump boards are also popular with Russian targets. Both sides are raising cryptocurrency via Telegram for their respective causes. DNMs, darknet forums, and other actors have largely remained politically neutral.
Do you think the majority of these platforms will be seized by international authorities in the region? Share your thoughts in the comments section below.
