UK spy probe exposes crypto laundromat used by Russian intelligence

UK authorities have detailed how a sophisticated crypto laundromat helped move Russian intelligence money into an espionage network operating across Britain and Europe.

How did Russian intelligence leverage cash-to-crypto laundering networks?

The UK National Crime Agency (NCA) has revealed that Russian intelligence services routed funding to a convicted spy ring through a cash-to-crypto system run by businesswoman Ekaterina Zhdanova. According to the agency, her so-called “Smart” network attempted to bankroll former Wirecard executive Jan Marsalek and his espionage operations in the UK.

Moreover, investigators say the scheme shows how billion-dollar money laundering infrastructures intersect with geopolitics, organized crime, and state-backed activity. The flows linked to Zhdanova’s operation touched at least 28 British towns and cities, underlining the reach of Moscow-linked financial networks inside the UK.

According to Bloomberg reporting, the NCA disclosure comes nearly a year after it dismantled two major Russian laundromats that had moved billions globally. However, new evidence indicates that the Smart network was used by individuals working with Russian intelligence to fund six Bulgarian nationals now serving up to 10 years for espionage.

What role did Jan Marsalek’s spy ring play?

Marsalek, a former Wirecard executive who worked for Russian intelligence, disappeared following Wirecard’s 2020 collapse. Before vanishing, he allegedly spent as much as £45,000 ($58,768) on covert operations financed via these laundering networks. These activities reportedly included spying on journalists and politicians, as well as plotting assassinations, before the network was ultimately dismantled.

That said, the NCA’s latest findings suggest Marsalek’s ring was only one component of a wider architecture in which criminal money, oligarch wealth, and state operations intertwined. The same infrastructure that moved espionage funds also served drug traffickers, arms suppliers, and sanctions evaders across multiple jurisdictions.

How did Operation Destabilise hit billion-dollar crypto networks?

The NCA’s flagship Operation Destabilise targeted the backbone of these laundering systems. The operation led to 128 arrests worldwide and the seizure of over £25 million ($33 million) in cash and cryptocurrency in Britain alone, highlighting growing law-enforcement pressure on cross-border crypto infrastructures.

The Smart and TGR networks acted as illicit clearing houses, collecting physical cash in one jurisdiction and making equivalent value available in another. Moreover, they relied heavily on Tether’s stablecoin to provide high-speed, high-volume liquidity for clients seeking to convert large sums rapidly across borders.

These crypto-rich criminal rings gathered illicit proceeds from the drugs trade and firearms supply chains, converting them into ostensibly clean digital assets. “Through this laundering scheme, we can now draw a line between the money involved in the local drugs trade to global organized crime, geopolitics, and state sponsored activity,” said Sal Melki, the NCA’s deputy director for economic crime.

However, the agency stresses that the same networks also operate at the upper tiers of global finance. They can channel street cash from low-level drug deals into the acquisition of banks, while simultaneously enabling systemic breaches of international sanctions regimes.

How do FSB Bitcoin payments expose Russian tradecraft?

Beyond the UK probe, Russian intelligence agencies have increasingly leaned on Bitcoin and other digital assets to bankroll covert operations across Europe. In particular, blockchain analysis has exposed distinctive payment patterns used by Russia’s Federal Security Service, or FSB, to support espionage activities.

Back in June, a Reuters investigation with forensics firms Global Ledger and Recoveris detailed how the FSB used crypto to finance operations, including the recruitment of Canadian teenager Laken Pavan. After being detained in Donetsk, Pavan was allegedly approached by Russian operatives and later received Bitcoin payments while in Europe.

He obtained just over $500 in Bitcoin while in Copenhagen before fleeing to Poland, where he ultimately turned himself in. That said, Polish authorities sentenced him to a 20-month term, underscoring how small crypto transfers can mask much larger state-directed operations.

Blockchain analysts traced that Bitcoin payment through intermediary wallets to a larger address created in June 2022. That wallet has since processed more than $600 million in Bitcoin, including transactions routed via sanctioned Russian exchange Garantex. The scale suggests industrialized laundering rather than isolated transfers.

Global Ledger’s analysis found that FSB-linked wallets followed strict patterns, moving funds in structured batches rather than ad hoc transfers. Moreover, the transactions operated exclusively during Moscow business hours, providing a temporal fingerprint that tied on-chain activity to Russian working schedules.

Recoveris identified a network of 161 Bitcoin addresses associated with the FSB, recording hundreds of transactions occurring between 6 a.m. and 6 p.m. Moscow time. This narrow operational window strengthened the assessment that the wallets were controlled by a centrally managed unit rather than freelancers.

At the same time, Canadian regulators recently uncovered that unregistered crypto exchange firms are enabling large cash-for-crypto deals without enforcing identity checks. In some cases, these entities delivered up to $1 million in untraceable cash, illustrating how gaps in oversight abroad can feed into state-linked financial schemes.

Are crypto kiosks and exchanges widening the laundering pipeline?

The picture is not limited to Russian intelligence. Earlier this month, US federal prosecutors charged Firas Isa, founder of Chicago-based Crypto Dispensers, with money-laundering conspiracy. Prosecutors allege that between 2018 and 2025 he moved at least $10 million in fraud and drug proceeds through crypto kiosks nationwide.

The indictment coincides with growing concern about automated crypto infrastructure. According to FBI data, there were nearly 11,000 crypto ATM-related complaints in 2024, with reported losses totaling more than $246 million. Moreover, these machines increasingly appear in fraud schemes that route victims’ funds into opaque wallets.

Similarly, the US Treasury’s Office of Foreign Assets Control (OFAC) recently sanctioned eight individuals and two North Korean entities for laundering proceeds from cyber theft and a remote IT worker scheme. The agency cited more than $3 billion stolen over three years, primarily in cryptocurrency, often moved through complex cross-border chains.

The OFAC designations block any property of those parties within US jurisdiction and prohibit transactions involving them by US persons. That said, they also impose direct compliance obligations on crypto businesses worldwide, which must halt flows involving listed names or connected wallet addresses to avoid secondary exposure.

What is the status of the Ekaterina Zhdanova operation?

Zhdanova herself was hit with US sanctions in 2023, when authorities said she moved more than $100 million for one Russian oligarch to the United Arab Emirates. Her networks, including the widely discussed ekaterina zhdanova operation, are alleged to have catered to sanctioned elites, cybercriminals, and state proxies.

Moreover, she has spent over a year in pre-trial detention in France, where she faces accusations in a separate criminal case. While those proceedings continue, the NCA reports that it has arrested 45 suspected money launderers in under 12 months linked to the wider ecosystem, seizing £5.1 million in cash during that period.

These investigations underscore how a single crypto-focused financial network can bridge local drug markets, international fraud, and state-sponsored espionage. However, they also show regulators and law enforcement ramping up pressure on high-risk venues, from informal cash-to-crypto brokers to major exchanges handling cross-border stablecoin flows.

Overall, the UK revelations tie together Russian intelligence funding, organized crime, and digital asset rails, signaling that the next phase of financial surveillance will focus heavily on complex crypto infrastructure and its role in national security threats.