Finiko

The Finiko case represents one of the most significant and complex cryptocurrency-related financial crimes in Russia’s recent history. Operating as a Ponzi scheme disguised as a legitimate crypto investment fund, Finiko lured hundreds of thousands of investors with promises of extraordinary monthly returns, accumulating over $1.5 billion in Bitcoin deposits. Beyond the straightforward fraud, the case highlights sophisticated money laundering operations that exploited both domestic and international cryptocurrency platforms to obscure illicit gains. The laundering tactics incorporated high-volume peer-to-peer transfers, token layering, decentralized exchanges, and mixing services, designed to evade Russian regulatory oversight. The involvement of politically connected individuals and shell companies further complicates the enforcement landscape. Ultimately, Finiko underscores the vulnerabilities in Russia’s cryptocurrency regulatory framework and presents a cautionary example of how fraudsters manipulate emerging digital financial systems to perpetrate extensive fraud and money laundering at an unprecedented scale.

Finiko was a massive Ponzi scheme based in Kazan, Russia, operating from 2019 through 2021, using cryptocurrency investments and promises of high returns to defraud over 800,000 investors, primarily within Russia. The scheme laundered funds by channeling large volumes of Bitcoin and other cryptocurrencies through a network of wallets, Russian and international exchanges, and privacy-enhancing tools including mixers and decentralized platforms. This allowed operators to hide proceeds of fraud and evade detection amid Russia’s regulatory gaps, particularly on P2P crypto trading platforms like BitZlato linked to dark markets. Russian authorities arrested key perpetrators, including founder Kirill Doronin, and continue to investigate and prosecute the operation as a significant money laundering criminal enterprise. The estimated laundering volume exceeds $1 billion, marking Finiko as one of Russia’s largest crypto-related financial crimes with sustained money laundering aimed at legitimizing illicit gains and frustrating law enforcement tracing.

Countries Involved

Russia (primary), with cross-border elements involving Turkey and other countries in cryptocurrency transactions.

Date Discovered / Reported

Scheme operated from 2019 until mid-2021; major arrests and investigations began in 2021 and continue through 2024/2025.

Cryptocurrency Involved

Bitcoin (BTC), USD Tether (USDT), USD Coin (USDC), Ethereum (ETH), proprietary FNK token

Type of Crime

Ponzi scheme, cryptocurrency fraud, money laundering, organized crime.

Entities Involved

Kirill Doronin (founder), Marat Sabirov, Zygmunt Zygmuntovich, Edward Sabirov (co-conspirators), former network director Lilian Nurieva; associates linked to major Russian crypto exchanges including Garantex and BitZlato.

PEP Involvement

Yes, indirect links to politically exposed persons (PEPs) via business connections—e.g., Marat Sabirov’s joint venture with former Russian minister Nikolay Nikiforov raised concerns.

Laundering Techniques Used

Finiko laundered illicit proceeds through complex cryptocurrency transactions involving layering and integration stages common in laundering schemes. Funds were collected as Bitcoin from over 800,000 deposits and systematically moved through various cryptocurrency wallets and exchanges, including Russian and global platforms like Binance and decentralized exchanges such as Uniswap. High-volume peer-to-peer (P2P) transfers helped obscure origins amid loose KYC controls at some platforms, notably BitZlato, known for ties to darknet market Hydra. Substantial sums (estimated at over $150 million at points) were routed to cold wallets controlled by Finiko’s owners, then further blended by transfers to mixing services such as Wasabi Wallet to obfuscate the audit trail. These tactics concealed beneficiary identities and muddled transactional records, enabling illegal profits to be hidden and converted into more usable forms. Withdrawal spikes in January 2021 coincided with attempts to exit rapidly, indicating an exit scam with layered laundering activity.

Estimated Value Laundered

While initial local law enforcement estimated laundered funds around $40-95 million, independent blockchain analytics and expert estimates suggest total investor losses and illicit proceeds moved through Finiko exceeded $1 billion, with some estimates reaching up to $1.5 billion in Bitcoin transactions. Large sudden movements of $100 million in BTC within a single week were reported, stirring Moscow’s crypto market. Analysis found over 111 million USDT, 1.8 million USDC, and 888 ETH associated with Finiko, with ongoing transactions distributed globally.

Transaction Analysis Summary

Blockchain forensics revealed a high volume of transaction activity characterized by frequent deposits from individual investors, referral-driven influxes, and layered transfers between wallets and exchanges. Key characteristics included oscillating wallet balances indicative of Ponzi payouts paid from incoming funds, use of native token FNK to mask investor holdings, and a sharp escalation in withdrawals signaling the scheme’s collapse. Transfers to popular mixing services and decentralized exchanges further obscure tracing efforts. Analysis by firms like Crystal Blockchain and Clain noted involvement of exchanges with lax compliance controls facilitating laundering and funds exiting Russia. Transaction flows also showed layering through cross-border movements and integration into legitimate exchange markets.

Regulatory/Enforcement Actions Taken

Russian law enforcement arrested founder Kirill Doronin and several key associates on charges including fraud, money laundering, and creating an organized criminal group. Network director Lilian Nurieva received a three-year prison sentence for fraud-related charges. Finiko was blacklisted by the Bank of Russia in February 2021. Investigations involved joint efforts by Moscow police and financial watchdogs. Criminal cases remain active with ongoing efforts to trace and recover assets. The case has drawn attention to the challenges of regulating cryptocurrency in Russia, particularly in addressing illicit schemes and exchange platforms with weak KYC/AML controls.

Links to Reports / Sources

Case Title / Operation Name:

Finiko Ponzi Scheme and Money Laundering Activities

Country(s) Involved:

Russia, Turkey

Platform / Exchange Used:

Binance, BitZlato, Garantex, Uniswap, Wasabi Wallet

Cryptocurrency Involved:

Bitcoin (BTC), USD Tether (USDT), USD Coin (USDC), Ethereum (ETH), proprietary FNK token

Volume Laundered (USD est.):

Estimated over $1 billion, with some estimates up to $1.5 billion in Bitcoin transactions

Wallet Addresses / TxIDs :

Multiple wallet addresses linked to Finiko's cold wallets and transaction hashes identified by blockchain analysis

Method of Laundering:

Layering via high-volume peer-to-peer transfers, mixing services (e.g. Wasabi Wallet), cross-border transfers, token swaps

Source of Funds:

Funds derived from Ponzi scheme deposits from over 800,000 investors, primarily Russian citizens seeking high returns

Associated Shell Companies:

CyfronCapital OÜ (Estonia-registered crypto developer tied to Finiko’s mobile app)

PEPs or Individuals Involved:

Founder Kirill Doronin, Marat Sabirov (linked to former Russian minister Nikolay Nikiforov), Liliya Nurieva, Edvard Sabirov

Law Enforcement / Regulatory Action:

Arrests of key figures, blacklisting by Bank of Russia, prison sentences for executives, ongoing asset recovery efforts

Year of Occurrence:

2019-2021 (scheme operation), major arrests and actions from 2021 onwards

Ongoing Case:

Ongoing

AML Network Risk Rating:

🔴 High Risk