In July 2016, Ekaterina Zhdanova’s star was rising. The glamorous socialite and entrepreneur, who had opened a series of hotels and leisure businesses across Moscow, was splashed across the cover of N Style, a Russian fashion and culture magazine.
“I dreamed of business since childhood,” she explained in the now inaccessible interview, as she described her ambitions and love for Russia. She partied with famous Russian TV and pop stars, and posed with expensive watches over the coming years—a world apart from her upbringing in a Siberian town.
But Zhdanova had a secret, and the first cracks were beginning to show.
As her social clout grew, she posted on social media about buying “huge volumes” of cryptocurrency, asking sellers to contact her. “It all depends on the mood,” Zhdanova told N Style when asked if she was a risk taker. “I’m probably a chameleon.”
International authorities believe she was much more than that. At the end of 2023, the United States government hit Zhdanova with economic sanctions for her alleged role in a crypto money-laundering operation used by Russian oligarchs, ransomware gangs, and other criminals. Today, Western law enforcement officials have gone even further, claiming that Zhdanova has acted as the head of a sophisticated money-laundering network that swaps cash for cryptocurrency, the likes of which law enforcement has never seen.
On Wednesday, Britain’s National Crime Agency (NCA), along with the US Federal Bureau of Investigation, Drug Enforcement Administration, and Department of the Treasury’s Office of Foreign Assets Control (OFAC), as well as authorities in Ireland and France, revealed that they have taken action against two massive Russian money-laundering networks that handle billions of dollars every year and have their tentacles in more than 30 locations.
The two alleged money-laundering networks—identified by a law enforcement action called Operation Destabilise—include the Smart Group, which officials say Zhdanova runs, and TGR Group, a series of companies led by George Rossi, who is either a Russian or Ukrainian national, according to authorities. The networks are distinct but often work together, officials say. As a result of Operation Destabilise, OFAC has imposed new sanctions against Rossi, four associated companies, two other members of TGR staff, and two individuals authorities say are linked to Zhdanova.
Over the course of several months, officials from the NCA provided WIRED with rare detail into their investigation and how the alleged money-laundering schemes operate. This includes tracing illicit transactions from Russian cybercriminals, finding payments linked to Kremlin propaganda outlet RT, and identifying links to organized crime in South America and the notorious Irish Kinahan crime group. The NCA also says the money laundering has also funded Russian espionage, although it refused to provide any more information.
Perhaps the most unusual element of the laundering, according to investigators, is how huge sums of Russian cryptocurrency are sent to criminal groups, often drug gangs, operating across Europe, where operators swap it for equivalent sums of cash to help obscure the money’s origins. In short: Criminals are trading bags of cash for crypto.
“This methodology of money laundering is new,” Will Lyne, head of cyber intelligence at the NCA, tells WIRED.
In addition to the newly issued sanctions, Lyne says Operation Destabilise has disrupted all parts of the money-laundering pipeline. The “head” of an intermediary network that works with one of the money-laundering groups has been arrested, the NCA says, and authorities have arrested dozens of people internationally and seized tens of millions in cash and crypto in the UK over the past two years.
Crypto Shuffling
Since Russia’s full-scale invasion of Ukraine more than 1,000 days ago, the country’s economy has been squeezed by sanctions—and cryptocurrency payments are banned domestically. However, increasingly, digital currencies are being used to move Russian money internationally.
“There is growing evidence that Russia is embracing cryptocurrencies and other alternative payment systems in order to circumvent sanctions and transfer funds around the world,” says Ben Cowdock, a senior investigations lead at the UK branch of anticorruption organization Transparency International. “While the Kremlin’s been closed out of the conventional banking sector, this does not mean it can no longer make international payments.”
Money laundering plays its part. By its very design, laundering is vastly complex and deceptive—and that can be exaggerated when crypto is used. Broadly speaking, money laundering takes place in three phases: placement, where money is added to financial systems; layering, where sums are shuffled between accounts or crypto wallets to hide its origin; and integration, where “clean” money can be spent freely.
The NCA’s Lyne says the two money-laundering networks are helping Russian elites to use their money outside of Russia. “This is definitely being utilized as a vector for sanctions evasion—and it’s perfect for that,” Lyne says. Investigators say the networks operate in different parts of the laundering chain: The Smart Group, allegedly run by Zhdanova, is at the top of the funnel, dealing with money from Russians, plus directing cash exchanges involved in the layering. The newly sanctioned TGR companies are often involved in integration, it is alleged.
NCA investigators started unraveling the two networks at the end of 2021, Lyne says, after spotting that ransomware payments linked to the Ryuk group were allegedly being further channeled to Zhdanova. At around the same time, authorities intercepted the first cash handovers in the UK. The lengthy investigative process used staff from across the NCA and drew upon open source data, messages from seized mobile phones, cryptocurrency and blockchain tracing and analysis, and physical investigative work and surveillance.
Through the Smart Group, Lyne alleges, Zhdanova can take Russian cryptocurrency from elites or ransomware groups and start routing it around the world. This often happens using a broker, known as an international controller, in the UAE, which has positioned itself as friendly to cryptocurrencies. The head of an international controller network has been arrested as part of the law enforcement action, the NCA says without providing any more information on their identity, location, or specific activity.
The money-laundering groups, officials at the NCA say, frequently use the Tether stable coin (known as USDT), which has a $130 billion market cap and is reportedly being investigated by the US government for the cryptocurrency’s potential to be used in money laundering and sanction violations.
According to details shared by the NCA, both the Smart Group and TGR have a “heavy exposure” to Russian cryptocurrency exchange Garantex, which was itself sanctioned by the US in 2022 for its links to cybercrime and illicit payments.
After The Wall Street Journal reported that Tether is under investigation, the company called it “wild speculation” and denied having “knowledge of any such investigations into the company.” A spokesperson for Tether tells WIRED it “unequivocally condemns the illegal use” of stable coins and works to combat money laundering, including having frozen all cryptocurrency addresses included in the sanctions against Garantex.
“You see direct exposure, so point to point, from Garantex to these criminals’ accounts,” says the NCA’s tactical lead for Operation Destabilise, whom WIRED granted anonymity due to the sensitivity of their work. The tactical lead says the two networks have copied techniques from traditional laundering processes, but using crypto means they don’t have to worry about banks detecting the activity and freezing payments.
“There’s so much layering that goes on,” the tactical lead says. “They’ll send funds through maybe three or four crypto addresses that we believe may be their own cold storage addresses before they go into an exchange,” they say of some of the activity around TGR. The groups are involved in the movement of “single-figure” billions of dollars each year, the official says, adding that it is hard to calculate an overall figure due to the layering.
Photograph: National Crime Agency
Kathryn Westmore, a senior research fellow at the defense and security think tank Royal United Services Institute, says money laundering is often built upon trust and personal relationships, but the two networks have “industrialized money laundering” on a scale that hasn’t previously been understood. “I don’t think anyone could anticipate the size and complexity of this operation, the huge amounts of cash involved, and the number of different organized criminal gangs which used the services,” Westmore says.
As well as moving money—using cryptocurrency and through more traditional Russian financial systems—the Smart Group allegedly also coordinates with cash handlers in European cities. “Smart are orchestrating those cash-for-crypto swaps,” Lyne says. The network could, for example, arrange for Russian cybercriminals with cryptocurrency to exchange it for cash held by a drug gang in the UK, before the money is further laundered. Criminal gangs can, the NCA says, use the crypto to further buy drugs or guns.
A cryptocurrency investigator at the NCA, who also asked not be named for security reasons, showed WIRED a review of cryptocurrency wallets that have been allegedly linked to the Destabilise investigation. One wallet had more than £800 million ($1 billion) linked to it; another had £169 million. “The amount of activity is huge—it is daily,” the investigator says.
Zhdanova’s alleged involvement in crypto laundering was revealed in OFAC’s November 2023 sanctions. At the time OFAC claimed she laundered $2.3 million on behalf of a Ryuk ransomware affiliate; was asked by a Russian oligarch to move more than $100 million in wealth to the UAE; helped another Russian to obscure payments of more than $2.3 million to Western Europe; and provided tax residency services and UAE identification cards for Russian clients.
Operation Destabilise investigators say that Zhdanova, along with members of the TGR companies, used cryptocurrency and the traditional UK finance system in March 2022 to move more than £2 million ($2.5 million) into the country to buy properties for an elite Russian client. They allegedly tried to hide the source of the funds and bypass customer authentication checks, according to the NCA.
The sanctions issued by OFAC also name two other individuals, Khadzi-Murat Magomedov and Nikita Krasnov, who allegedly worked with Zhdanova as part of the money laundering. The NCA claims Zhdanova and Magomedov would broker deals, while Krasnov would work with courier networks in the UK. Magomedov could not be immediately reached for comment, and Krasnov did not immediately respond to a request for comment.
Investigators believe Zhdanova may have split time in recent years between Russia and the UAE. A review of available material from data breaches provided by Constella Intelligence shows Zhdanova’s Gmail address, which was previously published by OFAC, is the last seven digits of her phone number, and is linked to a Telegram account called Smart Group.
On Telegram, the Smart Group account has been a member of Russian-language channels focused on cryptocurrencies and life in Dubai and the UAE. The account has posted publicly about hiring a personal assistant and childcare issues in the region. Other publicly available information linked to Zhdanova shows a 13-room Moscow hotel for sale; a Facebook page for a travel business with one “like”; and a variety of online accounts from Chess.com to Instagram, where she has several thousand followers.
Zhdanova did not respond to WIRED’s requests for comment. The Smart Group Telegram account displays a message saying it was “last seen a long time ago.”
The NCA says that Zhdanova is in “pre-trial detention” in France, after she was arrested for separate offenses—it did not detail what those suspected offenses are. A spokesperson for the French Gendarmerie declined to comment, citing an ongoing judicial investigation.
Bags of Cash
Towards the end of 2022, investigators followed a van from Kensington, in London, on a 300-mile round trip to Oldham in the north of England. Saju Sasikumar, an operations manager with the NCA who has been involved in Destabilise and showed WIRED surveillance footage captured during the investigation, says when the vehicle arrived back in the capital, bags removed from it contained more than £200,000. An associated apartment, he says, contained a cash counting machine and empty bags, while another address contained around £400,000 in cash.
Officials ultimately identified Semen Kuksov, now 24, and Andrii Dzektsa, now 28, who were sentenced to five years in jail each after pleading guilty in February this year for their role in this money laundering and organizing cash couriers. Over a 74-day period, the NCA says, the pair helped launder £12.3 million. Information provided by the NCA says it has connected cryptocurrency wallets to Kuksov that have received more than £30 million and that he has allegedly coordinated with Krasnov, the associate of Zhdanova.
Sasikumar says Kuksov, who is the son of a former Russian oil executive and admitted to running an “underground” cryptocurrency exchange to investigators, abandoned his work phone, allowing officials to download data from the device and get a glimpse of the operations. “He was conducting cash handovers on a very global scale,” Sasikumar says.
On the phone they found evidence for cash exchanges all across Europe, including in cities in Germany, France, Portugal, and Spain. Cash couriers were hired through advertisements in group chats, with people putting in bids for each of the handovers, Sasikumar says. “There’s clear instructions about what happens,” he says, adding that individuals could be given a percentage of the cash transfer they were involved in. Kuksov’s operations used ripped bank notes as tokens during the cash handovers—both sides of the swap would have part of the ripped note and then match them up before money changed hands.
Vast sums of crypto being shuttled between digital wallets can be traced, but it is not as blatant as stuffing thousands of bank notes into gym bags. In total, Operation Destabilise has led to 84 arrests, with more than £20 million of cash and crypto being seized by UK law enforcement. Across the country, at least 22 criminal actors have been linked to the money laundering, officials say, with one courier network conducting 55 cash handovers in just four months.
The UK, and London in particular, has long been a home to dirty money and laundering, with cryptocurrencies apparently increasingly being linked to cash in the capital. When cash has been handed over by the money-laundering networks, investigators observed an almost immediate movement of cryptocurrency for the same amount. Lyne estimates the networks may have moved more than £100 million in the UK every year.
The NCA says it and international law enforcement bodies have arrested multiple couriers linked to the money-laundering operations. The NCA points to a case where a courier, Fawad Saiedi, was found with more than £250,000 in cash in his car in November 2021—he was sentenced to four years in prison after pleading guilty in May 2022. The NCA says it is believed he processed more than £15 million and was “directed” by Zhdanova and Krasnov.
Across the UK, investigations have uncovered a van with more than a dozen washing powder boxes containing £1 million in cash, a vehicle with £350,000 under its passenger seat, and another van with £2.1 million hidden inside a door. Of the 84 arrests, the NCA’s tactical lead says that the majority of the potential prosecutions are still ongoing.
Photograph: National Crime Agency
Close Connections
While investigators say the Smart Group is involved in moving money and other assets largely from people in Russia, the second money-laundering network targeted by Western officials operates at the other end of the spectrum. Law enforcement officials say George Rossi and TGR are allegedly involved in integrating money into financial networks.
NCA officials say Rossi has used identity documents from other countries besides Russia, including Ukraine, and a LinkedIn profile lists him as the founder of TGR. He’s also a member of a startup organization in Dubai, and his companies have previously partnered with blockchain and cryptocurrency events in Dubai. He has also faced bankruptcy proceedings in the UK in recent years.
OFAC announced sanctions against the founder, as well as Elena Chirkinyan and Andrej Bradens, who also goes by the surname Carenoks, both of whom work for TGR—Chirkinyan is described as Rossi’s “second in command.” Four companies tied to Rossi and TGR have also been included on sanctions lists: TGR Partners Ltd, TGR Corporate Concierge, TGR DWC LLC, and Siam Expert Trading Company Ltd. The companies, on their websites, claim to provide a range of financial services, events management, and similar corporate services.
“What TGR will do is provide an interface to be able to take illicitly generated cash and put it into the legitimate banking system, although that might be in jurisdictions of risk for example,” Lyne from the NCA says. In 2023, the sanctions claim, TGR’s Chirkinyan allegedly helped transfer funds out of Russia, from Russian state-media media outfit RT, which has been widely sanctioned by Western governments, to help fund a Russian-language media organization in the UK.
However, the sanctioned TGR companies are likely the tip of a dense iceberg, with multiple legal identities linked to the brand name or company records. Archived versions of the now sanctioned TGR Partners’ website have in the last few years claimed the business has “partner” offices in the UK, Singapore, Russia, Ukraine, Turkey, the UAE, Latvia, Cyprus, Luxembourg, Bulgaria, and the US. (The most recent version of the website only includes the UK and UAE addresses.)
TGR Corporate Concierge, which was also sanctioned, was previously called TGR Wealth Solutions, according to public company records. Many of the businesses linked to TGR—which also includes those not sanctioned by officials—share the same phone numbers, legal addresses, and similar website designs, a WIRED review shows.
Bradens also owns at least 50 percent of Pullman Global Solutions LLC, a Wyoming-based entity, according to OFAC.
Rossi and Bradens did not immediately respond to requests for comment. Chirkinyan could not be immediately reached for comment.
The companies have a limited public presence. Many of the websites do not contain many specifics about what the businesses do and often include boilerplate-style text. The TGR Partners website also includes a peculiar series of blog posts from early 2020, listing the most expensive wines in the world, Europe’s best virtual museums and galleries, and the winners of the 2020 Oscars. “I think that is very typical of traditional money-laundering typologies, where a website will simply be lifted, a new company will be put on there, and the images and text won’t necessarily correlate to what the company purportedly does,” the NCA’s tactical lead for the operation says.
While both TGR and the Smart Group are separate but linked entities, the tactical lead says there may be times where they work together using “each other’s specific capabilities” for those they work on behalf of. The official says that social connections likely also help to power what they do and generate business, and that some of the networks, and those linked to them, are likely still operating.
“Street-level harm is being enabled and is being powered by these types of networks,” Lyne says, emphasizing that the NCA operations, US sanctions, and arrests internationally have limited the entire network. Officials say that during their investigations over the last two years, they have seen individuals being more reluctant to operate in the UK, as more arrests have taken place and the risk of laundering has risen.
With Zhdanova also in French custody, there could be greater limits on how the networks operate. Although with legal cases ongoing, many details about the total money movements in recent years remain unknown, but Zhdanova’s chameleon nature appears to be coming into focus, as are her alleged ambitions.
“Sometimes I worry that I lack a flight of fantasy,” she said in the 2016 N Style interview. “Then I lie down and always come up with something at night.”
