TRM Labs Highlights Dominance of Russian-Speaking Crypto Hackers

Russian-speaking hackers from the CIS countries have become a “ubiquitous force” in international cybercrime related to digital assets, according to a report by TRM Labs. 

The study indicates that Russian-speaking perpetrators are responsible for at least 69% of ransomware revenues, amounting to over $500 million in 2023.

The two largest operators of malicious services — Lockbit and ALPHV/Black Cat (both Russian-speaking) — earned approximately $320 million from attacks. 

Additionally, Russian-speaking darknet marketplaces (DNM) account for about 95% of global drug sales traffic. 

The largest “shadow” platform identified by analysts is Kraken Market, operated by CIS-based individuals. Analysts report that in 2023, the three largest Russian-speaking DNMs processed transactions totaling $1.4 billion in cryptocurrency. 

In comparison, the entire Western darknet ecosystem processed less than $100 million during the same period. 

The Estonia-registered cryptocurrency exchange Garantex, listed by the OFAC, processed 82% of the cryptocurrency volumes associated with sanctioned organizations worldwide in 2023. 

According to TRM Labs, a significant portion of these funds was linked to Chinese manufacturers of military equipment and components. Since 2021, the exchange has processed transactions worth approximately $85 million affiliated with wallets from China and Russia. 

“Some Russian-speaking perpetrators maintain ties with the Kremlin and actively use cryptocurrency to purchase foreign equipment for Russian military needs,” analysts noted. 

Earlier, experts at Elliptic uncovered a fraudulent online market with a turnover of $11 billion in cryptocurrencies. Researchers linked the Huione Guarantee online marketplace from Southeast Asia to the ruling Hun family in Cambodia.

In the period from April to June 2024, the crypto industry lost approximately $572.7 million due to hacking and fraud across 72 incidents, according to a report by Immunefi.