How the WEX admin was questioned by the FSB

Chapter from Andrey Zakharov’s book about the history of BTC-e/WEX

The U.S. authorities accused the WEX exchange administrator Alexey Bilyuchenko and BTC-e developer Alexander Werner of conspiring to launder funds obtained in the Mt. Gox hack. This is just one of the many criminal episodes involving defendants in the BTC-e/WEX case. The tangled history of the Russian exchange is the subject of a book by journalist Andrey Zakharov published by Individuum, Crypto. How crypto-punks, programmers and crooks forged Russia with blockchain. We publish the chapter detailing how WEX’s owners, in the wake of the exchange’s collapse, were offered to move all assets to accounts of security agencies.

Bitcoins into the “FSB fund”

In early August 2019 I received a Telegram message from an anonymous user with a ghost drawn on the avatar. I was not greatly surprised: I had worked at several well-known outlets, my phone is in various journalists’ databases, and strangers occasionally message me. The ‘Ghost’ created a secret chat and immediately intrigued me to the maximum. ‘I know you are looking for the WEX admin. I can tell you about him,’ he wrote to me.

‘The Ghost’ refused to discuss any details in chat or even in a secure call via messenger and insisted on a meeting. But not in Moscow, where I lived then, but in St. Petersburg. Normally in such cases you coordinate with the editor on a system of conditional signals: inform that you met; announce half an hour later that all is well; check in after an hour. We developed such a system as well this time.

‘The Ghost’ scheduled a meeting in a networked cafe in the centre. The workday was in full swing, there were hardly any people, and we sat in a rear room. He introduced himself as Evgeny, but revealed nothing about himself. From his Siberian accent I guessed he might be from Novosibirsk, like Bilyuchenko, and the details of life of the ‘admin’ he immediately poured into me led me to think that Evgeny could be someone from the founder BTC-e/WEX team. The lunch break began, the cafe filled up, and each time people passed by, Evgeny fell silent and waited until they moved far enough away that they could not hear what he was saying. His tale, sprinkled with words and phrases such as ‘FSB’, ‘criminal case’, ‘locked in a hotel’, ‘FBI’, ‘stole’, sounded very intriguing. ‘But I can’t write any of this until I have ironclad proof,’ I finally told Evgeny.

Upon returning to Moscow, he sent me materials of a criminal case opened by the Russian police after the collapse of the Wex crypto exchange. Verification was required — whether they were authentic or not. To start, I called Vasilyev, who at that time was somewhat ‘down’ after his first stint in a foreign prison (Italian), and showed him a copy of his own testimony, which was also in the documents sent to me. He, confirming their authenticity, promptly turned to attack: ‘And where did you get them? Let me read Bilyuchenko’s testimony?’

In the materials there was also a two-hour recording of a conversation between two people, the voice of one of whom was very similar to Malofeyev’s, and the other, by context, belonged to Alexey Bilyuchenko. I asked a mutual acquaintance to listen to whether one of the speakers was the BTC-e founder, and he said that, about 80%, it was him. Unlike Bilyuchenko, there are many voice samples of Malofeyev on the Internet, so the BBC Russian Service, where I worked at the time, decided to approach verification more fundamentally.

We sent a fragment of the recording from the case materials to the Petersburg ‘Forensic Laboratory of Audio-Visual Documents’. The expert — Polina Zubova — previously worked at the Expert-Criminalistics Center of the Main Directorate of the Ministry of Internal Affairs for St. Petersburg and Leningrad region, then headed the Department of Video-Audio Investigations at the Northwest Regional Center of Judicial Expertise. In short, solid credentials.

As a sample of Malofeyev’s voice we presented excerpts from two interviews with the entrepreneur. The surname of the identifiable person was not disclosed to the experts. According to the lab, the quality of the main recording was generally satisfactory, the intelligibility of speech was ‘almost complete’. The main conclusion: the speech on the compared recordings belongs to the same person. Thus, for example, the speakers have the same pitch and volume, the same style of articulation, and the same peculiarities in pronouncing certain vowels and consonants.

I have little doubt that the materials are authentic. The main thing in them are the testimony of Bilyuchenko himself, in which he presents his version of events from 2017–2018. In this version the BTC-e founder appears as a victim, so the ‘Ghost’, clearly connected to the admin, sent me all these documents: it’s unlikely the admin’s circle would have leaked them if the entire client base’s losses ended up on the founder himself. Malofeyev, of course, immediately and unambiguously stated his judgment on this version, telling me via his press service that the materials were ‘fabricated’.

I will try to lay out Bilyuchenko’s testimony in detail while constantly stressing that this is only his version of events.

When Bilyuchenko and Vinnyk launched the BTC-e exchange in 2011, cryptocurrencies attracted only a narrow IT crowd and crypto-punks. In autumn 2017 everyone was talking about crypto, even Vladimir Putin, who had met Vitalik Buterin a few months before Wex appeared. According to Bilyuchenko, when lawyer Musatov suggested cooperating with Malofeyev, he was already interested in cryptocurrencies and even wanted to develop his business project in this field. After several meetings in the office in that very ‘Novinsky Passage’, Bilyuchenko was offered to create the Vladex cryptocurrency exchange in Vladivostok. And not just another trading platform, but a legal platform for exchanging digital money, sanctioned by the state.

‘The Ghost’, together with the case materials, sent me a copy of a document titled ‘Memorandum of Understanding’ allegedly signed by Malofeyev and Bilyuchenko in early 2018. The project’s aim was formulated in a florid way — to build in Vladivostok, ‘on the basis of the existing exchange [Wex], a new exchange as a special settlement infrastructure for preserving the financial- economic sovereignty of the Russian Federation’. It even specifies shares: three-quarters (75%) of the charter capital in the new platform would go to the owner of ‘Tsargrad’, if one is to believe the document.

I found traces of Vladex in open sources: in March 2018 in Vladivostok a company named ‘Vladex’ was registered, 99% owned by a young e-sportsman Kirill Malofeyev, son of Konstantin Malofeyev. However, Malofeyev Jr. told me that this firm has nothing to do with Vladex’s crypto exchange project, and that he does not know a man named admin Alexey Bilyuchenko. I politely asked why, then, the postal address on Vladex’s site matches the legal address of his father’s company Vladex. Then Malofeyev Jr. did not deny the obvious and simply sent me to his father’s company’s press service.

In the recorded conversation a voice thought to be Malofeyev Sr. mentions Vladex several times and says that a high-level government paper has already been signed about creating a ‘white and fluffy service’. ‘So we had a signed paper?’ asks Bilyuchenko. ‘We had a signed paper about [considering] such an idea. And now there will be an actual paper,’ replies the voice of Malofeyev, adding that Vladex will have a stand at the upcoming Eastern Economic Forum (EEF).

In early September 2018 the EEF opened in Vladivostok, where Vladex indeed had a stand with negotiation tables, a motto ‘Flagship of the Digital Economy’, and chocolate tokens shaped like the exchange’s ‘gold tokens’. Then-president adviser Sergei Glazyev spoke about the Vladex project at a session on digitalizing the economy. A lover of pontificating about the dollar’s collapse and the United States, he was then close to Malofeyev and after leaving the president’s administration became a leading figure in the public movement ‘Tsargrad’. At the session in Vladivostok he stated that Vladex is being created ‘in accordance with the instruction of our head of state’, personally handed out those token-chocolates to participants and invited all to the Vladex stand to talk to the platform’s developers — Anton and Evgeny.

Anton, likely, was Anton Nemkin, a former employee of the FSB management of one of the southern regions: on the Russian Association of Managers site, where Nemkin headed the IT committee, he was described as the ‘author of the Vladex investment-system project’. And Evgeny, likely, was his business partner Evgeny Zhulanov: in a photo posted by Nemkin on his VK page from the VEF forum, he stands with Zhulanov and Glazyev. ‘At Glazyev’s forum he blamed the Central Bank for the ruble’s fall. The regulator does not fulfill its constitutional duties, outsourcing rate-setting to ‘financial speculators’,’ Nemkin wrote in the caption to the photo, in which all three are smiling.

I mentioned Zhulanov by name earlier: he is a fellow countryman and business partner of Dmitry Sutormin, with whom I had negotiated to go to an exchange in the ‘Novinsky Passage’. He also ran an IT business with Konstantin Malofeyev. Both Vasilyev and Bilyuchenko testified that the Tsargrad owner’s team gradually took over control of the exchange. Bilyuchenko said that from December 2017 to April 2018 he regularly — one or two times a week — traveled to Moscow, where, he claimed, he met with Zhulanov and other technical specialists recruited to work on Wex. How deep their control over the service was remains unknown, but a Moscow-based lawyer in spring 2018 told me he helped major Wex clients withdraw funds from the collapsing exchange precisely through Malofeyev’s people.

But Wex’s crypto assets remained under Bilyuchenko’s control, though representatives of the powerful partner pressed questions about them. At the end of April the ‘admin’ again travelled to Moscow and allegedly went to Malofeyev’s office in the Novinsky Passage on Sadovoe Koltso. By then Wex was still functioning fairly well, even though it had lost its top-20 standing among world crypto exchanges.

At that meeting Vladex’s prospects were not discussed. Instead Bilyuchenko was asked to hand over the exchange’s ‘cold’ wallets stored on disks that the admin always carried: ordinary USB drives on which information about crypto assets is stored in encrypted form. Bilyuchenko allegedly handed them over; then they ferried him to the FSB reception at Kuznetsky Most in Moscow. There the admin and several plain-clothes officers waited for two and a half hours, and only a person with enormous composure could endure this. Finally, as in a 1930s film, he was taken to a room where several men in plain clothes sat and for nearly an hour discussed Wex with him. But the pressure did not end there.

The admin was not allowed to go home and was taken to the Lotte hotel on Novinsky Boulevard, where he spent the night under guard. Moreover the guard allegedly wished to stay in the same room and only after his protest did he move to the corridor. An official from one of the security agencies who later sought evidence of the admin’s testimony told me that data from nearby cell towers showed that nearly a group from the new exchange team — including the nickname ‘Marichka’ — were consistently in the adjacent room.

The next day, on April 26, Bilyuchenko was again taken to the Novinsky Passage. There he was allegedly asked again to hand over all Wex crypto, but with one more detail — that it would go to some ‘FSB Russia Fund’. In the end, several days of threats had their effect: after another night under guard at the hotel and fearing for his life, Bilyuchenko agreed to transfer bitcoins and other crypto. On April 27 he was brought to an office near the hotel and asked to show the exchange balance. Bilyuchenko connected his laptop, inserted the USB disks and started a decryption process that lasted about 12 hours.

What appeared on screen could not help but impress. The exact amount of crypto stored on Wex at that time is unknown. Bilyuchenko cites a figure of $450m, but this should be treated with caution — it is not corroborated by some clients’ estimates, who believe assets were at least twice as large. And one must not forget that these were clients’ funds, not Vinnyk and Bilyuchenko’s; it was the funds entrusted by clients to Wex that were at stake, in the same way depositors rely on a bank.

In any case, regardless of the amount seen by opponents, they pressed for the admin to surrender the exchange’s crypto. After the trips to the FSB and time at the luxury hotel, the admin grew more amenable and agreed, but a somewhat cryptic moment followed in his testimony — it seems the Malofeyev team did not demand an immediate transfer and he flew home to Novosibirsk, which is supported by Rozysk-Magistral data: two Moscow-bound tickets were issued in his name for April 26 and 27.

‘The Ghost’ replied to my question as to why the admin wasn’t stripped of assets immediately while still hot that perhaps the Malofeyev team simply lacked enough reliable crypto wallets to receive the assets. But two weeks later, in mid-May, Bilyuchenko returned to the capital. Still in the Novinsky Passage he allegedly moved the crypto to new wallets, after which the admin was released to Novosibirsk, as his testimony states. Rozysk-Magistral records show that by May 15 Bilyuchenko had two one-way tickets to Moscow and — perhaps just in case — three return tickets for May 17, 18 and 19. The admin’s testimony is indirectly supported by data from crypto-tracking portals: on May 16, 30,000 bitcoins and 700,000 litecoins were moved from the exchange’s known wallets. Based on mid-May 2018 rates, this would be roughly $350m.

But beyond the crypto, Bilyuchenko also controlled a second valuable asset — the exchange’s user base, without which the platform cannot operate. Forcing him to surrender it became the next stage of the operation. ‘The base will have to be surrendered. It’s not me, it’s the state. And the reason you didn’t surrender it and remain free is that people will defend you. … If you work for a larger story that the state needs, they will take a different approach. … And who knows you, maybe you’re running Al-Qaeda, Navalny?’ — a person with Malofeyev’s voice says on the two-hour recording.

Judging by the context, the conversation likely took place mid-2018: the interlocutors discuss my RBK investigation that ‘Marinok’ is buying Wex. After this discussion, Bilyuchenko, according to his testimony, again went to the FSB reception on Kuznetsky Most. This time two men introduced themselves as FSB officers named Igor and Grigory. The talk lasted five hours, and again they demanded he hand over the user database and threatened him with espionage charges.

Terrified, he agreed but said the base would need to be taken to Novosibirsk. After returning, he locked himself in his country house and did not go to Moscow again. Then, a few days later, the same FSB officers Igor and Grigory allegedly visited Bilyuchenko’s home in Novosibirsk with a search, seizing computers, phones and external drives containing the architecture and the “hot wallets” of the exchange — the wallets used for current exchange operations on the platform. The two-hour conversations with the admin could not be decrypted, and Bilyuchenko apparently retained control over both the base and at least the hot wallets (and perhaps other BTC-e/Wex assets). For this reason some clients consider him a fraudster who misappropriated their funds, though they are willing to concede that his version of Wex’s collapse could be true. ‘If the admin had publicly admitted that he was pressured, that the money was taken, that he kept some and would share it with clients, most would understand him,’ one active client told me.

Despite two visits to the FSB reception, in 2018 there were no formal complaints from the ‘conspiracy’ office against Bilyuchenko. Any active officer could arrange a meeting at the FSB reception; all that was needed was approval at the head of the department. And when Bilyuchenko described to police how he was twice ‘marinated’ at Kuznetsky Most, the FSB Directorate ‘M’ (counterintelligence support for the law enforcement system) allegedly even conducted checks into who used the reception for interviews with Bilyuchenko, according to another official from a rival security structure. It appears there were no plans to create a crypto ‘FSB fund’ after all: the idea was likely invented to frighten the admin with fearsome terms and names and push him to surrender the assets and the user base.

If Malofeyev’s people stood behind all this, their strategy of gradually squeezing Bilyuchenko out of running the exchange is impressive. In effect, hundreds of millions of dollars of crypto assets lay on the ground: most BTC-e/Wex users were anonymous and had little to present as proof that the assets on the exchange belonged to them. The mention of the state, FSB talks and ongoing pressure were meant to scare the admin into surrendering assets and the user base — a solid basis for launching a new crypto platform. At least that was the version the admin himself pushed in his testimony.

The Wex brand itself would not be needed under this approach. By July, when the exchange continued to operate fitfully, a voice attributed to Malofeyev hinted to the admin that the platform could be shut down. ‘In May I told you that we must work; that all decisions must be mine. Did I tell you that? Yes. And you went somewhere else. You didn’t come back in time. There are various events taking place. The world does not stand still. … I say: I don’t need Wex, we will close it down.’

‘Closing a functioning service that brings in revenue?!’ — the admin asks in the recording. ‘Listen, that revenue, it would be better if it didn’t come in at all,’ counters his interlocutor. By year-end the exchange ceased to exist in substance: the domain’s NZ registration expired, and no one wanted to renew it. The shell — a Singaporean legal entity — was bought by ‘Moryachok’ and began pressuring Bilyuchenko to surrender the remaining crypto assets. I met Havchenko in early 2019 in a Moscow steakhouse, where he, as usual, gulped whiskey but did not get markedly drunk, and said that in his view the Wex assets were seized not by Malofeyev but by the admin. And that he, as the official owner of the platform, would now return them.

One and a half months later, at the end of April, ‘Moryachok’ with several men drove up to Bilyuchenko’s country house near Novosibirsk and, after pressing the doorbell, scared his wife. Then followed several tense days: Bilyuchenko and Havchenko spoke on the phone, the ‘Moryachok’ men kept watch at the house, but the admin had already hired his own security. The case materials include transcripts of conversations between them: long, heated disputes over who was to blame for Wex’s collapse and who ultimately held two-thirds of the exchange’s crypto. Bilyuchenko accuses Malofeyev and says that ‘Moryachok’ appeared as a nominal figure and a sort of ‘heat-seeking missile’ to distract clients from the Tsargrad founder. Havchenko stresses that he is an independent figure and even does not know Malofeyev personally.

Here is one of their dialogues.

Bilyuchenko: At the start of the conversation I told you clearly what happened. I can repeat it again if you want.

“Moryachok”: Alex, look. I have another piece of information — how much did you give Kostya [Malofeyev]?

Bilyuchenko: What information? Explain it to me. What information? I just told you what information I have.

“Moryachok”: Okay. Tell me the numbers: how much did you give Kostya?

Bilyuchenko: Kostya took all the crypto. Then the FSB Internal Security officers came and took my laptop with all the data about the exchange. Does that match your information?

“Moryachok”: No.

Bilyuchenko: Kostya took the crypto. You know this, right?

“Moryachok”: I know how much he took. From my information — a small amount, the tiniest fraction of what disappeared. It dissolved.

This dialogue is quite telling, illustrating that both sides withhold parts of the truth about BTC-e’s collapse.

Bilyuchenko evidently kept part of the crypto under his control, though he repeatedly portrayed himself as a victim only, and I must admit that at some point I ceased to critically assess his version. In 2020 lawyer Sergei Shugaev, who had joined the story at the invitation of the ‘Moryachok’ to help clients, commissioned an audit of wallet movements previously linked to BTC-e and Wex. It showed that as of the time of analysis, bitcoins, litecoins and ether remained untouched — nearly $600m — on those wallets.

Who controls them remains a question to which each side offers its own answer. The same applies to where nearly $350m sent from BTC-e/Wex wallets in mid-May 2018 went, when Bilyuchenko says he agreed to part with the exchange’s assets. The traces end at wallets on well-known exchanges like Binance: thus, in theory, law enforcement could query who those accounts are registered to, where the money went and through which exchanges it was cashed out. But I am not aware of any such request, though Binance cooperates with Russian authorities and, according to Reuters, handed over data about crypto-donations to Navalny’s team.

The last time I saw ‘Moryachok’ was in November 2019, on the eve of publication of a new investigation in which I detailed the admin’s testimony. He confirmed that indeed, with a group of sturdy companions, he had come to Novosibirsk to Bilyuchenko. He still blamed the admin for everything and, as I perceived, was less cordial than usual. I shook his hand with the severed fingers and, as I walked to the metro, looked back several times. A few days later my piece came out, and about BTC-e, Wex, ‘Moryachok’, Nemkin and Malofeyev the country learned — not because the investigation gained unusual popularity, but because its publication led to unexpected but dramatic consequences.