NCA Exposes Billion-Dollar Russian-Linked Laundering Network Running Cash-to-Crypto Pipeline Across the UK

A vast criminal ecosystem worth billions has been revealed by the National Crime Agency (NCA), which uncovered a sophisticated cash-to-crypto infrastructure operating across at least twenty-eight towns and cities throughout the UK. According to investigators, this network transformed profits from drug trafficking, firearms supply, and organised immigration crime into cryptocurrency before funnelling it into a Kyrgyz financial institution acquired specifically for sanctions evasion. Intelligence assessed by the NCA indicates that money channelled through this mechanism ultimately bolstered entities associated with Russia’s military industrial base, effectively making the operation an active financial facilitator of the war in Ukraine. A number of key figures—including Ekaterina Zhdanova, George Rossi and Elena Chirkinyan—were instrumental in linking UK street-level offending to state-aligned financial activity abroad, demonstrating how domestic criminality can merge with geopolitical objectives when managed by professional launderers.

At the centre of this Russian laundering structure was a multi-layered system merging physical cash logistics, digital asset conversion and international fund transfers. Its foundation consisted of couriers who travelled extensively across major cities such as London, Birmingham, Manchester and Leeds, as well as smaller regional locations. Their role was vital: they gathered large quantities of illicit currency arising from various criminal markets and moved it through designated routes to specialists responsible for crypto conversion. These handovers were arranged in low-visibility environments—car parks, residential properties and service stations—to minimise risk.

Once the cash was in hand, it was swiftly converted into cryptocurrency through intermediaries adept at completing high-volume exchanges. This step allowed the group to circumvent conventional banking channels. The converted digital assets flowed into wallets and accounts controlled by Smart and TGR, two laundering groups identified by the NCA in December 2024. Smart was overseen by Ekaterina Zhdanova alongside associates Khadzi Murat Magomedov and Nikita Krasnov, while TGR was led by George Rossi with assistance from Elena Chirkinyan and Andrejs Bradens.

The operation’s sophistication escalated higher in the chain. Smart and TGR worked together to process payments for Russian clients aiming to sidestep financial restrictions. A pivotal development came when Altair Holding SA—a company linked to Rossi—purchased a seventy-five percent share of Keremet Bank in Kyrgyzstan on Christmas Day 2024. With direct access to a regulated banking institution, the network could orchestrate international transfers for Promsvyazbank, a Russian state bank that supports firms connected to the military industrial complex. By combining crypto conversion, cross-border payment structures and bank ownership, the group created a system capable of moving funds rapidly and with plausible legitimacy.

The international footprint of the laundering operation required an equally broad coalition to counter it. The NCA worked closely with UK partners including the Metropolitan Police Service, Police Scotland, HM Revenue and Customs, the Crown Prosecution Service, Border Force and the National Police Chiefs’ Council. Cooperation extended across borders to authorities in Jersey, Ireland, the United States, France, Finland, the Netherlands and Spain, enabling synchronised arrests, asset seizures and intelligence sharing.

US agencies such as the Drug Enforcement Administration, the Office of Foreign Assets Control, the Federal Bureau of Investigation and the United States Secret Service played significant roles. France’s central police judiciaire directorate contributed to investigative efforts, while Ireland’s An Garda Síochána engaged through its serious and organised crime units. Additional expertise from Finland, the Netherlands and Spain enriched the operation with insights into crypto flows, financial intelligence and cross-border payments. These collaborations resulted in major outcomes, including overseas seizures amounting to twenty-four million dollars and more than two point six million euros.

The multinational approach also shed light on Russian-linked actors embedded across Europe. Zhdanova was later arrested in France pending trial, while individuals connected to Russian intelligence attempted to utilise her Smart Group to finance operations on the continent. One example involved a UK-based cell of Bulgarian nationals under the leadership of Orlin Roussev, subsequently convicted of espionage for Russia. This highlighted how the network functioned not only as a way to turn illicit cash into crypto, but also as a conduit for intelligence work, covert financing and destabilisation efforts.

The scheme’s footprint reached Moldova through the involvement of Ilan Shor, a Russian-Moldovan oligarch previously implicated in the notorious one-billion-dollar Moldovan bank theft of 2014. Shor’s payment service provider A7—sanctioned by both the UK and EU—formed part of the sanctions-evading infrastructure tied to Keremet Bank. A7 and Promsvyazbank jointly announced the creation of the A7A5 token, promoted as a rouble-backed stablecoin intended to support cross-border settlements for sanctioned clients. This development illustrated how the laundering network moved beyond ordinary criminal commerce and into the sphere of state-aligned financial tactics.

The exposure of this system presents important lessons for compliance teams. The reliance on cash couriers reinforces that physical cash remains a central component of complex laundering schemes, despite the influence of digital finance. Cash-to-crypto typologies continue to be appealing to criminals because they enable the severing of the link between tangible money and traceable electronic transfers. Institutions should evaluate the risks associated with patterns such as repeated small deposits, constant rapid conversion of incoming funds or accounts displaying unexplained asset growth.

The case also underlines the need for stringent oversight of financial institution acquisitions, especially in jurisdictions where regulatory scrutiny may differ. The Keremet Bank purchase exemplifies how criminal groups may seek to obtain control over financial infrastructure to carry out sanctions evasion and disguise illicit activity as legitimate transactions. Enhanced due diligence on beneficial ownership structures and cross-border deals is therefore essential.

Crypto asset service providers occupy a frontline position in detection. They should apply robust monitoring to spot behaviours such as rapid conversion cycles, dispersal to multiple unrelated wallets or transactions involving stablecoins associated with sanctioned regions. Blockchain analysis must be merged with conventional AML checks to fully understand the behaviours behind wallet movements.

Further insight comes from cases involving Popovych, Lutsak and Tabatadze. Popovych and Lutsak exploited the Russia-Ukraine conflict as a cover to launder funds through vehicle purchases, resale and eventual conversion to cryptocurrency—a classic trade-based laundering model with a crypto endpoint. Tabatadze, meanwhile, acted as a courier transporting £2.2 million in cash, illustrating how low-level operatives sustain high-throughput systems by maintaining anonymity and volume. Institutions can detect such activity through anomalies in customer profiles, suspicious belongings, multiple phone numbers, unusual travel, or persistent cash-heavy behaviour.

The behaviour of the laundering groups also showed their ability to adapt swiftly. During summer 2024, Russian-speaking laundering operations in London sharply increased their commission rates, signalling heightened operational risk. Compliance frameworks need to evolve continuously to keep pace with such changes.

The dismantling of this network underscores the necessity of integrated AML, sanctions awareness and crypto supervision. Street-level criminality was directly connected to an international scheme aiding Russia’s war effort, illustrating the merging of organised crime, financial technology and geopolitical conflict. This convergence is likely to intensify, demanding that compliance frameworks incorporate sanctions intelligence, advanced crypto analytics and extensive global information exchange.

The NCA’s targeted campaign aimed at couriers—with posters displayed in English and Russian—represented a fresh tactic in reducing supply. By focusing on individuals at the lowest rung of the chain, the agency disrupted recruitment and emphasised the minimal financial gain compared with the significant prison sentences couriers face. This blended model of deterrence and enforcement points toward a broader strategy for disrupting laundering networks.

For compliance professionals, the environment is set to become increasingly challenging. Criminal groups may continue pursuing ownership of banks, develop specialised crypto tokens and manipulate geopolitical volatility to obscure financial flows. Collaboration between public and private sectors will be essential, along with investments in crypto tracing, sanctions due diligence and early-stage anomaly detection.

As Operation Destabilise progresses, this case provides a blueprint for tackling transnational laundering systems linked to state-aligned actors. The coordinated use of multi-country intelligence, rapid enforcement activity and pressure applied at every level of the chain sets a new standard for how such complex networks can be confronted.

By fLEXI tEAM