MOSCOW — The money moved fast. Stolen from Russian citizens through phone-based fraud schemes, it passed through unregistered cryptocurrency exchange offices before disappearing abroad — all of it, according to Russian authorities, coordinated from Ukraine. On Friday, the Federal Security Service said it had shut that system down, at least in part.
Russia’s FSB announced the detention of more than 20 employees of unregistered cryptocurrency exchange offices operating out of the Moscow City business center, the gleaming riverside complex of towers that has become Russia’s primary address for financial services firms. Working alongside the Russian Interior Ministry, the agency said it had simultaneously dismantled nine separate channels used to funnel funds out of the country using digital currencies.
The FSB statement described the exchanges as infrastructure for what Russian law enforcement calls remote fraud — the phone-based and online scam operations that have drained hundreds of millions of rubles from Russian bank accounts in recent years, with victims ranging from retirees persuaded to hand over their pension savings to working professionals who believed they were protecting accounts from hackers. Ukrainian call centers, the agency said, were on the other end of the operation, directing the fraud and receiving the converted proceeds.
“In Moscow, more than 20 employees of unregistered cryptocurrency exchange offices were detained at the Moscow City business center, through which Ukrainian call centers legalized funds stolen from Russian citizens as a result of remote fraud,” the FSB said in its statement Friday.
What made the operation significant, and what investigators have not yet fully accounted for publicly, is the location. Moscow City is not the back alley of Russian finance. Its towers house major banks, law firms, and financial advisory companies, which made the unregistered exchanges operating there either invisible against the noise of legitimate commercial activity or deliberately chosen for the cover that setting provided. The nine channels the FSB says it stopped were described as coordinated from abroad — an arrangement that, if proven in court, would make this a transnational financial crime case with a direct line to the conflict in Ukraine.
The operation is the latest in a series of moves by Russian security services to target financial networks they say are exploiting the country’s growing cryptocurrency sector for criminal purposes. Russia’s relationship with digital assets has been defined by tension between their utility for sanctions-related financial flows — which authorities have at times tolerated — and their equal utility for moving criminal proceeds in ways that are difficult to trace. Both uses have expanded significantly since 2022, when Russia’s military operation in Ukraine began reshaping the country’s financial infrastructure.
The Interior Ministry’s involvement alongside the FSB signals the operation was treated as a criminal financial investigation rather than purely a counterintelligence matter, even as the FSB’s framing emphasized the Ukrainian connection. Russian law enforcement has historically prosecuted cryptocurrency-related financial crime through the Interior Ministry’s financial crime units, while the FSB takes the lead when foreign state involvement is alleged. The joint operation suggests investigators believe they have evidence of both dimensions.
Remote fraud targeting Russian citizens has grown substantially since 2022, a pattern that security researchers and Russian law enforcement officials have documented at length. The schemes typically involve callers impersonating bank security staff, police officers, or investment advisers. Victims are persuaded to transfer money or grant access to their accounts, after which funds move rapidly through a series of intermediaries before reaching cryptocurrency conversion points like the ones the FSB says it found at Moscow City. The use of registered business addresses, rather than anonymous servers, reflects a sophisticated effort to blend criminal infrastructure into the formal economy. A United Nations report published last week estimated that 300,000 people across Southeast Asia are currently trapped in similar scam call center compounds, underscoring how deeply transnational fraud networks have embedded themselves across the region.
The placement of exchange offices inside Moscow City would have allowed the operation to blend into an environment where large financial transfers are routine and where oversight of smaller fintech operations has historically been less intensive than at traditional banking institutions. Russia’s central bank and financial monitoring agency Rosfinmonitoring have been working to close regulatory gaps around digital asset exchanges — a pressure that mirrors the European Union’s move earlier this year to propose new powers to ban crypto exchanges found to be helping Russia circumvent sanctions, targeting a pipeline estimated at $11 billion annually. The FSB statement appears aimed in part at demonstrating that enforcement now reaches inside formally licensed financial districts.
What the FSB has not yet provided is the total volume of funds moved through the nine channels, the identities of any suspects beyond their employment at the exchanges, or any details about the structure of the Ukrainian call center operations that were allegedly directing the scheme. Russian authorities have attributed numerous financial fraud campaigns to Ukrainian operatives since 2022, and the pattern of those attributions — delivered through formal FSB statements without supporting documentation released publicly — has become a recurring feature of the broader conflict. Whether the Ukrainian call center connection can be established in a Russian court, or whether the case will rest on the domestic money-laundering charges against the Moscow City workers, is a question the initial statement leaves open.
The more than 20 people detained Friday are likely to face charges under Russian criminal statutes covering money laundering, participation in illegal financial operations, and potentially financing criminal activity. The Interior Ministry typically handles such prosecutions, with the FSB’s involvement ensuring that any foreign-connection charges are preserved for later use. None of the detainees were named in the agency’s public statement.
The sweep also draws renewed attention to the regulatory environment around cryptocurrency in Russia. While the Russian government has moved toward a framework that permits certain digital asset transactions, exchanges that operate without registration remain a persistent feature of the market, often offering rates and anonymity that registered platforms cannot. Moscow City, where real estate and office costs are among the highest in the country, may have been attractive precisely because the overhead lent the operations a degree of legitimacy they could not establish through licensing.
The FSB said the operation was carried out in cooperation with the Interior Ministry but provided no further detail on the investigative timeline, how long the nine channels had been under surveillance, or what triggered the decision to move on Friday. Those gaps are the ones that will matter most when the case reaches prosecutors.
