US sanctions Bitcoin exchange Suex with offices in Moscow and Saint Petersburg

The U.S. Treasury placed on the sanctions list a cryptocurrency exchange, Suex, with offices in Moscow and Saint Petersburg, as well as 25 addresses on the Bitcoin, Ethereum and Tether networks.

According to the Office of Foreign Assets Control (OFAC), funds flowed through Suex on behalf of operators of at least eight ransomware programs, scam projects and dark-net marketplaces.

Analytical firm Chainalysis found that since February 2018 Suex has received more than $480 million in Bitcoin. Not less than $160 million of this sum is linked to illicit activity.

Experts found that cryptocurrency transactions totaling more than $50 million were sent from addresses linked to the now-defunct BTC-e exchange. In most cases these transfers occurred after the exchange ceased operations.

More than $24 million is linked to fraudulent cryptocurrency projects, including the Finiko financial pyramid. Another $20 million came from dark-net platforms, including the Russian Hydra. Almost $13 million is linked to ransomware operators Ryuk, Conti, Maze and others.

According to Elliptic analysts, starting in 2018, Suex handled cryptocurrency transactions totaling no less than $934 million. More than $370 million of that sum is linked to cybercriminals.

The legal entity of the exchange – SUEX OTC s.r.o. – is registered in the Czech Republic. The largest shareholder of Suex is Russian national Yegor Petukhovsky. He also serves as the director of listing in the popular Telegram bot for crypto exchange Chatex. TRM Labs believes that the two companies have significant corporate connections. We have approached Yegor Petukhovsky for comment, but have not received a response at the time of writing.

Initially Suex was owned by the Estonian company Izibits OÜ, which still holds the local license for a virtual asset service provider.

On the Russian-language site of Suex, Izibits OÜ is listed as its corporate owner. It is also the owner and operator of the Telegram bot for crypto exchange Chatex.

The domain Suex.io is owned by Hightrade Finance Ltd., registered in Saint Vincent. It is also mentioned in Chatex’s Terms of Use as the legal entity.

According to OFAC documents, the crypto exchange Suex is registered at two addresses. One is in Prague, the other in Moscow City, in the Q Suite on the 31st floor of the Federation Tower. Another office is located in Saint Petersburg.

Executives named by analysts include Czech venture capitalist Tibor Bokor and Russian Vasiliy Zhabykin. The latter owns 10% of Suex. His LinkedIn profile shows that he now heads NUUM, a neobank from mobile operator MTS.

Also associated with Suex are Ildar Zakirov, Maksim Subbotin and Maksim Kurdangaleev. ForkLog spoke with the latter.

Kurdangaleev said he has no ties to Suex, although in 2019 he and his business partners considered a collaboration with the company. “Even at the discussion stage we realized that the service did not meet our business objectives due to its poor usability and the unsuitable tech stack. Negotiations on cooperation ended in early November 2019.”

“Even at the discussion stage we realised that the service did not meet our business objectives due to its poor usability and the unsuitable tech stack. Negotiations on cooperation ended in early November 2019.”

He added that information about his involvement with Suex in his LinkedIn profile, where he calls the service “ours”, was “hastily added” on the advice of a marketer, and after negotiations he forgot to remove it.

In an archived version of Yegor Petukhovsky’s personal blog, we found a history of Suex’s creation, where he states that the partners were Ildar [Zakirov] and Maksim [Subbotin].

“…That’s when the three of us decided to try to exchange more systematically, with client search and accounting. The first deal took place on August 29, 2018.”

Petukhovsky also notes that a “key role” in Suex’s emergence was played by Ivan Petukhovsky, one of the founders of the EXMO exchange. According to the blog, the first exchange with Yegor Petukhovsky involved 4000 USDT.

According to the history, Suex’s first trades were conducted on EXMO. We requested comments from the platform.

“I would like to note that Ivan indeed played a major role in the development of cryptocurrency in Russia — and Yegor was not the only person whom he pushed to start his own crypto business. Indeed, such an exchange did take place — there is nothing illegal about it. The first SUEX exchanges were indeed conducted on EXMO, but he soon stopped doing so. For three years every transaction on EXMO is checked by CipherTrace and manual verifications; we have full verification of all users and a serious UK-compliance process,”

Stankevich also stressed that Ivan and Yegor Petukhovskys are merely surnames, not relatives.

TRM Labs and Chainalysis both state that Suex is an “embedded service” — i.e., it works with addresses hosted on larger exchanges, using their liquidity and trading pairs. In other words, the exchanger does not offer custody services directly.

According to TRM Labs, Suex requires clients to complete deals in its offices and accepts them only via referrals. A ForkLog source in the exchange market said that Suex is one of the largest exchanges in Russia and spoke positively about its reputation among professionals.

Analysts have not identified the exchanges Suex worked with, but TRM Labs says the company had “access to funds from unknown sources”.

OFAC designated Suex as an organisation suspected of terrorism and drug trafficking. The agency blocked any Suex property within the United States. Residents and citizens are prohibited from dealing with the platform, under penalty of fines or imprisonment.

The sanctions do not extend to current employees of the exchange. OFAC officials did not respond to questions about whether the sanctions list would be expanded in this case.

ForkLog contacted Suex for comment but received no prompt response.

As noted earlier, after a wave of high-profile attacks on the United States’ infrastructure in early 2021, authorities began an active crackdown on ransomware programs.

The administration of the U.S. president stated the need for monitoring of cryptocurrency transactions directed at hackers. In the future, the White House plans to develop a mechanism to restrict such payments.

Media also reported plans by the government to adopt by the end of 2021 new rules to combat money laundering and terrorist financing.

Read more about ransomware campaigns and their impact on Bitcoin in ForkLog’s coverage.

Bitcoin addresses were first placed on the U.S. sanctions list in November 2018. They belonged to two Iranian residents, operators of the SamSam ransomware.

In March 2020, Bitcoin addresses of two Chinese citizens, alleged members of North Korea’s Lazarus hacking group, were sanctioned.

In April 2021, the U.S. Treasury added wallets to this list, linked to the “troll factory”.

Subscribe to ForkLog’s news on Telegram: ForkLog Feed — all the news, ForkLog — the most important news, infographics and opinions.