US charges two Russians accused of running billion-dollar money laundering schemes

US federal prosecutors have filed criminal charges against two Russian men accused of operating billion-dollar money-laundering services and seized websites associated with illicit crypto exchanges as part of a major US crackdown on Russian cybercrime.

One of the men, Sergey Ivanov, has operated for nearly two decades as one of the longest-running professional cyber money-launderers known to US law enforcement, according to Justice Department officials. The other man, Timur Shakhmametov, is accused of running a notorious cybercriminal marketplace called Joker’s Stash that US authorities said made hundreds of millions of dollars in profits from selling stolen payment card information.

Neither Russian man is in US custody, and the State Department is offering $10 million for information leading to their arrest or conviction.

An indictment unsealed in the Eastern District of Virginia charged Ivanov and Shakhmametov with bank fraud and money laundering-related crimes. Shakhmametov was also charged with conspiracy to commit “access device fraud” for his alleged access to the stolen payment card data.

CNN first reported on the US law enforcement action.

The Treasury Department also imposed sanctions on Ivanov and Cryptex, a cryptocurrency exchange that the department alleges is associated with hundreds of millions of dollars’ worth of cybercrime.

“Working with our Dutch partners, we shut down Cryptex, an illicit crypto exchange, and recovered millions of dollars in cryptocurrency,” Deputy US Attorney General Lisa Monaco said in a statement.

The US Secret Service investigated the case, seized web domains associated with Cryptex and got a court order to seize domains associated with two other money transfer and laundering services associated with Ivanov, the Justice Department said.

Ivanov and Shakhmametov are accused of helping run “carding” websites like Joker’s Stash that sell stolen credit and debit card information. The sites have advertised financial information stolen from tens of millions of Americans, according to US law enforcement. In addition, millions of dollars in ransomware payments and darknet drug sales have allegedly flowed through crypto accounts linked to Ivanov’s services.

The action comes as Ukraine President Volodymyr Zelensky is set to meet with President Joe Biden and Vice President Kamala Harris Thursday in Washington, DC. Zelensky is expected to make an urgent plea for more US support against Russia’s war on Ukraine.

Biden alluded to the crackdown on the alleged Russian cybercriminals in a statement Thursday that said the US had “taken action today to disrupt a global cryptocurrency network, in coordination with international partners.”

The US government has for years tried to get Russia to crack down on cybercriminals that operate from its soil, often to little avail. US officials were briefly optimistic that such cooperation might improve in January 2022, when Russian authorities detained the suspect in a calamitous ransomware attack on a US pipeline operator. But those hopes faded quickly with Russia’s full-scale invasion of Ukraine a month later.

“We reiterate our call that Russia must take concrete steps to prevent cyber criminals from freely operating in its jurisdiction,” State Department spokesperson Matthew Miller said in a statement Thursday.

For years, Joker’s Stash was a dominant player in the Russian-speaking criminal underground. The crime forum touted data stolen in major breaches of US corporations. Shakhmametov allegedly used other online crime forums to get the word out about Joker’s Stash and the massive loot of stolen data that it held, the Justice Department said.

After US and European law enforcement agencies seized some computer servers used by Joker’s Stash, the forum said it was shutting down in 2021. But the US law enforcement hunt for the two Russian men continues.

This story has been updated with additional details.