Bitzlato

🔴 High Risk

Bitzlato, a cryptocurrency exchange registered in Hong Kong but predominantly operated by Russian nationals, emerged as a critical hub for laundering illicit funds, especially linked to Russian cybercriminal enterprises. Labeled by FinCEN as a “primary money laundering concern,” Bitzlato flagrantly disregarded anti-money laundering (AML) and know-your-customer (KYC) standards, enabling widespread anonymous trading that facilitated ransomware payments, darknet market transactions, and scams with little to no oversight. The platform’s operational methods consciously catered to Russian ransomware actors, criminal darknet markets like Hydra, and other illicit financial flows. Despite public enforcement actions aimed at darknet markets, Bitzlato perpetuated its illicit services, illustrating a systemic failure to disrupt criminal laundering channels. The arrest of Bitzlato’s Russian founder in the United States and ensuing enforcement actions marked a historic escalation emphasizing the vulnerability of unregulated crypto platforms as conduits for global criminal finance, posing significant challenges for regulators and financial institutions striving to combat Russia-linked money laundering with geopolitical implications. This case exemplifies the complex nexus of cryptocurrency, cybercrime, and international regulatory enforcement.

Bitzlato, a Hong Kong-registered cryptocurrency exchange, became a major enabler of money laundering for Russian ransomware groups, darknet markets, and scammers by offering services without any real KYC or AML controls. Operating globally with strong ties to Russia, Bitzlato processed billions in cryptocurrency including nearly half a billion dollars from illicit transactions between 2019-2021, primarily connected to Russian illicit finance including ransomware proceeds. Its founder, Russian national Anatoly Legkodymov, was arrested by U.S. authorities and charged with unlicensed money transmission and laundering criminal proceeds. FinCEN issued a landmark enforcement order recognizing Bitzlato as a primary money laundering concern under the Combating Russian Money Laundering Act. This case highlights the peril posed by crypto platforms lacking regulatory oversight and their role in fueling global illicit finance schemes centered in Russia and beyond.

Countries Involved

Hong Kong, Russia, United States (enforcement jurisdiction), China (residence of key individual prior to arrest)
Bitzlato is registered as a Hong Kong entity but has deep operational and client connections primarily linked to Russia. Russian illicit finance heavily utilized the platform, while enforcement occurred mostly under U.S. jurisdiction due to the arrest of its Russian founder.

The investigation and enforcement actions began publicly around early 2023, with major revelations and institutional actions starting January 2023, continuing with expansive reporting through 2023 and 2024.

Bitcoin (BTC), other major cryptocurrencies including those used in ransomware and darknet transactions

Money laundering involving ransomware payments, darknet market proceeds, scam-related funds, and illicit finance transfers. The exchange functioned as a platform facilitating unlicensed money transmission and heavy laundering of criminal proceeds.

  • Bitzlato Ltd., a Hong Kong-registered cryptocurrency exchange

  • Anatoly Legkodymov, the Russian national and founder residing in China before U.S. arrest

  • Russian ransomware groups such as Conti (pledged allegiance to Russian government)

  • Darknet markets linked with Russia including Hydra, BlackSprut, OMG!OMG!, and Mega

  • Various scammers, darknet vendors, and criminal actors globally, especially in Russia.

No direct Politically Exposed Person involvement reported, but strong ties and facilitation of Russian illicit finance linked to geopolitical conflict contexts.

Bitzlato openly advertised no KYC (Know Your Customer) and no AML (Anti-Money Laundering) controls, allowing users to trade with an email only, no identification, selfies, or passports. This facilitated anonymous transfers and layering of funds. The platform processed transactions tied to ransomware attacks, darknet marketplace sales, and scams by Russian criminal groups. Methods included transfer of ransomware extortion payments, cryptocurrency conversions, and funneling through multiple accounts to obscure origins. The platform’s advertised simplicity and lax controls attracted significant money laundering volume.

Since 2018, Bitzlato processed over $4 billion in transactions, with a significant portion linked to criminal proceeds. Specifically, between 2019-2021 nearly $500 million in cryptocurrency from illicit activities, including darknet and ransomware sources, flowed through Bitzlato. Half of these transactions involved Russian illicit finance. Estimates show millions of dollars laundered connected to sanctioned ransomware groups like Conti.

Blockchain analyses found Bitzlato as a critical money laundering node, with large volumes connected to Russian cybercriminal entities. The exchange enabled ransomware groups to launder proceeds, supported darknet markets like Hydra (which alone exchanged $700 million through Bitzlato), and hosted users connected with scams and illicit online sales. The platform’s high-risk profile was recognized officially by FinCEN, which cited its key role in facilitating criminal finance. Bitzlato’s lack of AML controls allowed for unfettered laundering, helping criminals convert and move illicit funds globally while evading sanctions and law enforcement detection.

  • U.S. Department of Justice unsealed charges against founder Anatoly Legkodymov for running an unlicensed money transmission business and laundering criminal proceeds.

  • FinCEN issued a historic enforcement order in January 2023 citing Bitzlato as a primary money laundering concern linked to Russian illicit finance under the Combating Russian Money Laundering Act.

  • The platform was banned by U.S. financial authorities, marking a precedent in crypto regulation enforcement.

  • Bitzlato’s founder was arrested in the United States, disrupting the exchange’s operations but also signaling increased scrutiny of crypto platforms facilitating ransomware and darknet crimes.

  • Reports indicate Binance moved seized Bitzlato funds (~$346 million) per enforcement actions.

Bitzlato
Case Title / Operation Name:
Bitzlato Cryptocurrency Exchange Money Laundering Case
Country(s) Involved:
Russia, United States
Platform / Exchange Used:
Bitzlato
Cryptocurrency Involved:

Bitcoin (BTC), other major cryptocurrencies including those used in ransomware and darknet transactions

Volume Laundered (USD est.):
Estimated $700 million in illicit cryptocurrency transfers between 2016 and 2022, including millions linked to ransomware proceeds
Wallet Addresses / TxIDs :
Various known wallet addresses involved in ransomware and darknet market transactions linked to Bitzlato (not publicly detailed for privacy/security)
Method of Laundering:

No KYC/AML controls allowing anonymous exchange, peer-to-peer trades; laundering through ransomware payments (e.g., Conti group), darknet market sales (Hydra and successors), layered transfers to obfuscate origin; no meaningful controls to detect or disrupt illicit funds flow

Source of Funds:

Ransomware extortion payments, darknet marketplaces such as Hydra, BlackSprut, OMG!OMG!, Mega; scam and fraud proceeds; other illicit transactions connected primarily to Russian cybercriminal enterprises

Associated Shell Companies:

N/A

PEPs or Individuals Involved:

Anatoly Legkodymov, founder and majority owner (Russian national arrested by U.S. authorities); no direct PEP involvement reported

Law Enforcement / Regulatory Action:
Charged by U.S. DOJ for unlicensed money transmission and laundering; FinCEN enforcement order under Combating Russian Money Laundering Act; coordination with EU and international agencies resulting in arrest and seizure of assets; prohibited transmittal of funds from/to Bitzlato under U.S. law
Year of Occurrence:
2023 (public enforcement actions and charges)
Ongoing Case:
Ongoing
🔴 High Risk