BitOK: The Infraud Organization Laundered ₽10 Billion in Bitcoin

The hacking group The Infraud Organization, the case of which was led by former head of the Investigative Committee’s department for Moscow’s Tverskoy District, Marat Tambiev, allegedly laundered 5,200 BTC (about ₽10 billion). This is according to BitOK’s analysis.

Earlier Tambiev was accused of taking a bribe from an attorney for the criminals in the amount of 1032.1 BTC (about $17.2 million at the time of the authorities’ inspection). He stored the wallet’s seed phrase in a folder labelled ‘Pension’ on his personal computer.

At the time of the arrest, the hackers provided access to ten addresses that had received 2064 BTC in December 2021.

Subsequently all assets were drained from the wallets. According to testimony from one group member, Mark Bergman, the real size of the bribe Tambiev sought amounted to 2718.6 BTC.

BitOK’s investigation focused on two wallets that held the investigator’s assets. It began on 22 January 2022, when 654 BTC was withdrawn from the suspect’s address.

Initial senders were the services LuxSocks and Unicc, controlled by The Infraud Organization. Later, part of the funds were sent to the Huobi exchange.

The laundering method used was the Peel Chain, in which cryptocurrency is split across multiple addresses.

That same day, 2,493.64 BTC linked to the hackers was moved to another wallet. On 1 May, the assets were withdrawn to six addresses, one of which belonged to the crypto mixer Wasabi.

It was from these addresses that the bribe to Tambiev was paid. The investigator received only half of the funds—1,032 BTC out of 2,064 BTC. The remaining portion was sent to an intermediate address.

The second phase of laundering began in late 2022:

• On December 7, 500 BTC were moved to a new wallet;
• From December 7 to 10, 300 BTC were split evenly across three addresses and sent to Huobi using the Peel Chain scheme;
• On December 10, the remaining 200 BTC were directed to two addresses;
• On March 17, 2023, the assets were moved to wallets purportedly belonging to BitexBit and WhiteBit.

As of the investigation, 532 BTC remained unmoved on unidentified addresses. Analysts suggested these funds could soon move.

BitOK also recorded several test transactions to Huobi. The criminals likely had a rehearsed scheme to pass the platform’s verification procedures and several backup accounts.

Experts pointed to similar laundering schemes in 2022 and 2023. Moreover, some addresses were used repeatedly in these two cycles. Thus, some funds not used in the first round were laundered together with other assets in the second via WhiteBit.

Summing up the investigation, analysts counted the volumes of funds moved:

• 500 BTC were sent to Huobi;
• 259.14 BTC — to WhiteBit;
• 295.13 BTC — to BitrexBit;
• 1,032.09 BTC were sent as a bribe to Tambiev;
• 532 BTC remains unmoved.

The lawyer Vadim Bagaturia described the expert report in the Moscow investigator’s bitcoin-bribery case as ‘dubious’ after reviewing the case materials, finding numerous inconsistencies in the documents.