BTC-e’s Alex Vinnik Pleads Guilty

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, BTC-e head pleaded guilty; arrests were made in Ponzi scheme, ZKasino case; charges filed in Cred scam; individual and Pike Finance were hacked; Hundred Finance’s hacker moved stolen funds; the EU took down an exit scam; the feds probed Block’ and crypto scammers were arrested.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

Co-founder of crypto exchange BTC-e Alexander Vinnik pleaded guilty in U.S. federal court to money laundering conspiracy after investigations showed his involvement in carrying out illegal activities on the exchange from 2011 to 2017.

Hackers used BTC-e to launder funds gained from computer hacking, ransomware attacks and drug trafficking. The platform also operated without legal compliance measures such as registration with the Financial Crimes Enforcement Network and anti-money laundering and know-your-customer protocols. BTC-e processed more than $9 billion in transactions and had a user base of more than 1 million globally during Vinnik’s tenure. He established numerous shell companies and financial accounts globally to facilitate illicit fund transfers through the exchange, resulting in criminal losses of at least $121 million.

Cases against Vinnik have been ongoing for five years, since his arrest in Greece in 2017 on money laundering charges. He was extradited to France in 2020 and convicted of money laundering charges with a five-year prison sentence. Vinnik’s assertion that he was merely an exchange employee with no involvement in illicit activities was unsuccessful. After serving two years in a French prison, Vinnik was extradited to the United States in August 2022. He is a Russian citizen who reportedly sought a prisoner swap deal between his home country and the U.S.

U.S. law enforcement has arrested and charged Idin Dalpour for orchestrating a Ponzi scheme that defrauded investors of $43 million, announced U.S. Attorney for the Southern District of New York Damian Williams. Dalpour allegedly enticed investors with deceptive opportunities in a Las Vegas hospitality venture and a cryptocurrency trading enterprise, promising substantial returns.

The indictment shows that Dalpour solicited investments through his controlled entity, misrepresenting its interests in the hospitality and cryptocurrency sectors. He claimed to buy crypto wholesale and sell it at a profit, offering investors annual returns of 42% and assuring the safety of their investments with false insurance and escrow claims. Dalpour also allegedly fabricated contracts, falsified bank statements and created fake email correspondence. Once in control of the user funds, he paid off earlier investors, covered personal gambling losses and paid his children’s private school tuition fees.

Dutch authorities arrested a 26-year-old man suspected of being involved in the ZKasino online gambling platform scam, accusing him of fraud, embezzlement and money laundering. The arrest by the Fiscal Information and Investigation Service led to the seizure of over 11.4 million euros worth of crypto, real estate and luxury cars. This is the first arrest in the ZKasino fraud case, where investors reportedly lost at least $33 million in digital assets. The platform initially promised investors their money back within 30 days.

ZKasino, posing as a blockchain-based gambling platform, reportedly obtained funds from more than 10,000 investors after its launch on April 20. But suspicion among the investors rose when the platform transferred all the collected 10,515 Ether to the Lido staking protocol on April 20 and altered its website’s language to remove assurances of fund returns. ZKasino also claimed in a March post to have closed a Series A investment round at a $350 million valuation, allegedly backed by entities such as MEXC and Big Brain Holdings, which denied the claim.

Three former executives of bankrupt cryptocurrency lender Cred are facing U.S. federal criminal charges of wire fraud and money laundering. Daniel Schatt, who served as the CEO, and Joseph Podulka, who was the CFO, face 13 counts of wire fraud and money laundering charges. James Alexander, the former chief commercial officer, faces four similar charges. Prosecutors at the U.S. Attorney’s Office for the Northern District of California said that the executives misled customers about Cred’s lending and investment practices, claiming to engage only in collateralized or guaranteed lending and maintaining a hedged approach to cryptocurrency investments for protection against volatility. But Cred’s lending practices were neither collateralized nor guaranteed.

An individual reportedly lost over $71 million worth of wrapped bitcoin in what appears to be an address poisoning attack. The victim transferred 1,155 wrapped bitcoin to the alleged attacker, who created a wallet address that closely resembled the victim’s address, The Block reported. The attacker’s address has since been flagged as “fake” and “phishing” on Etherscan, it said.

Pike Finance suffered its second exploit in three days on April 30, resulting in the loss of $1.68 million worth of digital assets. Pike was also the victim of a $300,000 exploit on April 26. The attacker exploited a vulnerability in Pike Finance’s smart contract, altering the output address and draining cryptocurrency in both attacks. Pike Finance has offered a 20% reward to recover funds.

The hacker who stole $7.4 million from decentralized finance protocol Hundred Finance in April last year and withdrew $800,000 worth of crypto from Curve’s decentralized exchange after a year of inactivity. The hacker converted USDT and other cryptocurrencies into ETH, increasing their Ethereum holdings by more than $1 million. The hacker now holds a total of $4.3 million in assets within the wallet.

Authorities from Austria, Cyprus and the Czech Republic took down an online scam offering a fake new cryptocurrency, arresting six suspects and seizing assets worth EUR 750,000, a EUR 1.4 million property and two cars. The Austria-based fraudsters ran the scam between December 2017 and February 2018, posing as a legitimate online trading company launching a new cryptocurrency. They sold 10 million tokens, accepting payments in bitcoin or ethereum. The perpetrators abruptly shut down their social media accounts and website in February 2018 and pulled the rug on investors with a EUR 6 million loss.

U.S. federal prosecutors are reportedly investigating Block’s crypto unit amid allegations of compliance lapses, including processing crypto transactions linked to sanctioned countries and terrorist organizations, according to sources familiar with the matter who spoke to NBC News. Founded by Twitter co-founder Jack Dorsey, Block is facing scrutiny over inadequate checks that allowed the illicit transactions, NBC News reported, citing unnamed sources. The alleged lax practices are part of years-long broader compliance issues on Block’s Square and Cash App units, it said. NBC reported it reviewed over 100 pages of internal documents from former employees, including records of transactions between Block and sanctioned countries such as Russia and Iran as recently as last year, suggesting that Block had knowledge of the abuses of its services.

A British court sentenced two men, Jake Lee from Bath and James Heppel from Wiltshire, to four years and 15 months months in prison, respectively, for orchestrating a fraud scheme to steal over 5.7 million pounds worth of cryptocurrency. They pleaded guilty to three counts of conspiracy to commit fraud. They spoofed the domain of the cryptocurrency exchange Blockchain.com to gain access to the victims’ Bitcoin wallet credentials, stealing from 55 victims in 26 countries. Law enforcement seized assets totaling 835,000 pounds, including cash, cryptocurrency, a Banksy print and vehicles. Lee faces a confiscation order of nearly 1 million pounds to compensate victims.