An operation led by French and US authorities, and strongly supported by Europol, has targeted the crypto exchange platform Bitzlato. The globally operating Hong Kong-registered cryptocurrency exchange is suspected of facilitating the laundering of large amounts of criminal proceeds and converting them into roubles. Law enforcement authorities took down the digital infrastructure of the service, based in France, and interrogated leading members of the platform’s management. The operation also involved law enforcement and judicial authorities from Belgium, Cyprus, Portugal, Spain and the Netherlands.   

Almost half of all Bitzlato transactions linked to criminal activities

Targeting crucial crime facilitators such as crypto exchanges is becoming a key priority in the battle against cybercrime. Bitzlato allowed the rapid conversion of various crypto-assets such as bitcoin, ethereum, litecoin, bitcoin cash, dash, dogecoin and USDT into Russian roubles. It is estimated that the crypto exchange platform has received a total of assets worth EUR 2.1 billion (BTC 119 000). 

While the conversions of crypto-assets into fiat currencies is not illegal, investigations into the cybercriminal operators indicated that large volumes of criminal assets were going through the platform. The analysis indicated that about 46 % of the assets exchanged through Bitzlato, worth roughly EUR 1 billion, had links to criminal activities. 

Cryptanalysis uncovered that the majority of suspicious transactions are linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), with others linked to cyber scams, money laundering, ransomware and child abuse material. For example, investigations showed that 1.5 million BTC transactions have been made directly between Bitzlato users and the Hydramarket, taken down in April 2022. 

This exchange platform, available both in Russian and English language, rented dedicated servers from a hosting company in France. The coordinated action of the judicial and law enforcement authorities from the different involved countries led to the takedown of the platform, seizures of present financial assets, and further technical analysis.

Overall results

• 5 individuals arrested so far (1 in Cyprus, 3 in Spain and 1 in the US);
• 1 individual questioned in Portugal;
• The main administrator arrested in the US;
• CEO, Financial director and Marketing director arrested in Spain;
• 8 house searches (4 in Spain, 1 in Cyprus, 2 in Portugal, 1 in US);
• Takedown of the digital infrastructure of the service, enabling further analysis and investigation;
• Seizures include crypto wallets worth about EUR 18 million in cryptocurrency at the time of writing, vehicles and electronic equipment;
• 100+ accounts at other crypto exchange frozen, involving a total of EUR 50 million.

Cryptoanalysis and international coordination to uncover links

During the first phases of the investigative activities, Europol facilitated the information exchange, provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through the analysis of millions of cryptocurrency transactions. 

On the action day, Europol deployed 13 of its experts on the spot (10 in France, 1 in Cyprus, 1 in Spain and 1 in Portugal) and supported the deployment of national investigators in other countries taking part in the operational activities. Europol supported the law enforcement authorities involved with coordination related to cryptocurrency analysis, cross checking of operational information against Europol’s databases, and operational analysis. At this moment, already over 3 500 bitcoin addresses and over a 1 000 Bitzlato user details showed links with various criminal cases reported in Europol’s systems. Analysis of this data and other related cases is expected to trigger further investigative activities. 

Law enforcement authorities involved

• Cyprus: Cyprus Police
• Belgium: Federal Police (Federale Politie/Police Fédérale)
• France: National Gendarmerie (Gendarmerie Nationale)
• United States: Federal Bureau of Investigation
• Spain: Civil Guard (Guardia Civil) 
• Netherlands: National Police (Politie) and the Fiscal Information and Investigation Service (FIOD)
• Portugal: Judicial Police (Policia Judiciaria)

Judicial authorities involved

• Belgium: Federal prosecutor office (Parquet fédéral)
• France: Paris Prosecutor / JUNALCO (Parquet de Paris / JUNALCO)
• United States: United States Department of Justice (US DOJ)

Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.