UK NCA Uncovers Russian Intelligence-Funded Crypto Laundering Network Linked to Espionage and Organized Crime

The UK National Crime Agency has revealed how Russian intelligence services funneled funds to a convicted espionage network via a cash-to-crypto laundering operation run by businesswoman Ekaterina Zhdanova, who sought to bankroll former Wirecard executive Jan Marsalek’s spy ring. This disclosure connects billion-dollar laundering networks to geopolitics, organized crime, and state-sponsored activity across at least 28 towns and cities in the United Kingdom. According to Bloomberg, nearly a year after dismantling two Russian laundromats that moved billions globally, the NCA disclosed that Zhdanova’s “Smart” network was used by individuals linked to Russian intelligence to fund six Bulgarian nationals now serving sentences of up to 10 years for espionage.

Marsalek, who worked for Russian intelligence and vanished during Wirecard’s 2020 collapse, spent as much as £45,000 ($58,768) on operations that encompassed spying on journalists and politicians, alongside plotting assassinations before the network was dismantled. The laundering networks, Operation Destabilise revealed, converted crime cash into clean cryptocurrency on a massive scale, leading to 128 arrests worldwide and the seizure of more than £25 million ($33 million) in cash and crypto within Britain alone.

The Smart and TGR networks functioned as illicit clearing houses, collecting cash in one country and making equivalent value available elsewhere, leveraging Tether stablecoin to provide substantial liquidity. Clients ranged from sanctioned broadcaster Russia Today in the UK to the Kinahan family crime syndicate, with networks facilitating virtually any criminal activity through seamless cross-border value transfers. “Through this laundering scheme, we can now draw a line between the money involved in the local drugs trade to global organized crime, geopolitics, and state sponsored activity,” said Sal Melki, the NCA’s deputy director for economic crime. The networks reportedly operate at all tiers of international money laundering, from handling street-level drug cash to acquiring banks and facilitating breaches of global sanctions.

Beyond the UK, Russian intelligence increasingly relies on Bitcoin to fund covert operations throughout Europe. In June, a Reuters investigation with blockchain forensics firms Global Ledger and Recoveris detailed how the Federal Security Service (FSB) used cryptocurrency to fund espionage, including recruiting Canadian teenager Laken Pavan after detaining him in Donetsk. Pavan received just over $500 in Bitcoin while in Copenhagen before fleeing to Poland, where he surrendered and received a 20-month sentence. Blockchain analysts traced the payment through intermediary wallets to a larger wallet created in June 2022, which has since processed more than $600 million in Bitcoin, including transactions routed via the sanctioned Russian exchange Garantex. Global Ledger noted that transactions from FSB-linked wallets followed structured laundering patterns, operating exclusively during Moscow business hours, while Recoveris identified 161 Bitcoin addresses tied to the FSB, with hundreds of transactions occurring between 6 a.m. and 6 p.m. Moscow time. Canadian regulators have also found that unregistered crypto exchange firms are facilitating large cash-for-crypto transactions without requiring identity verification, enabling transfers of up to $1 million in untraceable cash.

The broader growth of crypto laundering networks is evident in recent US enforcement actions. Earlier this month, federal prosecutors charged Firas Isa, founder of Chicago-based Crypto Dispensers, with a money-laundering conspiracy, alleging he moved at least $10 million in fraud and drug proceeds through crypto kiosks nationwide between 2018 and 2025. FBI data shows nearly 11,000 crypto ATM-related complaints in 2024 alone, totaling over $246 million. Similarly, the US Treasury’s Office of Foreign Assets Control has sanctioned eight individuals and two North Korean entities for laundering cyber theft proceeds and an IT worker scheme, citing more than $3 billion stolen over three years, largely in cryptocurrency. The designations block property in US jurisdiction and prohibit transactions with designated parties, imposing compliance obligations on crypto businesses to halt flows touching listed names or associated addresses.

Zhdanova herself was sanctioned by the US in 2023 after authorities said she moved more than $100 million for a Russian oligarch to the United Arab Emirates. She has spent over a year in pre-trial detention in France for unrelated charges, while the NCA has arrested 45 suspected money launderers in under 12 months and seized £5.1 million in cash. The case illustrates the convergence of state-sponsored espionage, transnational organized crime, and cryptocurrency laundering, highlighting the increasing role of digital assets in sophisticated international financial crimes.

By fLEXI tEAM