BTC-e founder sentenced to five years in prison for laundering ransomware funds

December 7, 2020 TH Author

A French judge has sentenced today the founder of the now-defunct BTC-e cryptocurrency exchange to five years in prison and a fine of €100,000 for laundering funds for cybercriminals, including ransomware gangs, ZDNet France reported today.

Alexander Vinnik, 41, a Russian national, dodged a bigger sentence after French prosecutors failed to prove that the BTC-e founder was directly involved in the creation and the distribution of Locky, a ransomware strain that was active in 2016 and 2017.

“Mr. Vinnik, the court acquitted you of the offenses relating to the cyber-attacks linked to Locky, as well as the offenses of extortion and association to criminal activities, but finds you guilty of organized money laundering,” the judge said when reading the sentence.

Vinnik is at the center of a disputed legal battle

Vinnik was trialed in Paris this fall after a long and complicated legal battle. He was initially arrested in July 2017 while vacationing in a summer resort in northern Greece.

He was taken into custody by Greek police under an international warrant issued by the US for his involvement in running BTC-e, a cryptocurrency exchange that Vinnik founded in 2011, together with fellow Russian national Aleksandr Bilyuchenko.

US authorities said Vinnik operated BTC-e as a front company for a money-laundering operation, knowingly receiving funds from hacks and other forms of cybercrime and helping crooks cash out stolen funds into fiat currency.

But Vinnik’s arrest wasn’t an open and shut case, and a disputed legal battle ensued. As soon as Vinnik’s arrest became public, Russian authorities also filed an extradition request of their own, claiming that Vinnik was also a suspect in an investigation in Russia in relation to a 2013 €9,500 ($11,000) fraud charge.

Details about the case remained murky, but experts said Russian authorities were trying to bring Vinnik back home to prevent the BTC-e founder from spilling secrets to US intelligence.

The extradition battle dragged for more than a year and got even more complicated when French authorities also filed their own request with Athens, asking for Vinnik to be trialed in Paris on 14 charges related to money laundering and hacking.

Vinnik’s lawyers initially won their case in 2018, when an Athens court ruled to extradite Vinnik back home to Russia.

However, as Athens sought to find a middle ground following intense political pressure applied by both Russian (Greece’s main supplier of natural gas) and US (NATO ally) officials, Vinnik was eventually sent to France in the spring of 2020.

French laywers couldn’t prove Locky involvement

But the French trial didn’t pan out as French officials had hoped. ZDNet France reported that French prosecutors managed to prove only one of the 14 charges they brought, with the defendant’s lawyers successfully challenging the evidence brought by Europol for Vinnik’s involvement in cybercrime operations and malware distribution — and specifically his involvement in the Locky ransomware operation.

The BTC-e founder currently remains under arrest, and both the US and Russia have filed new extradition requests with France, still hoping to get Vinnik to face charges in their respective jurisdictions.

While Russian authorities are investigating Vinnik in a case of $11,000 in fraud, US authorities said that Vinnik’s BTC-e platform helped criminals launder more than $4 billion in illegal funds.

Following Vinnik’s arrest, at the Black Hat USA 2017 security conference, a team of security researchers said that before BTC-e went down, the platform had helped convert 95% of all ransomware ransom payments into fiat currency, playing a key role in the burgeoning ransomware ecosystem.

Furthermore, a group of Bitcoin experts calling themselves WizSec also published the results of an investigation that linked Vinnik’s personal BTC-e Bitcoin accounts to the laundering of funds stolen during hacks at the Mt. Gox, Bitcoinica, and Bitfloor cryptocurrency platforms.

In July 2019, the US filed a separate civil lawsuit to try to claw back more than $100 million worth of Bitcoin from BTC-e and Vinnik’s accounts.

In June 2020, New Zealand authorities announced they successfully seized $90 million that they said were linked to Vinnik’s accounts.