Russia Paying Teenage and Untrained Spies Using Bitcoin: Report

Russian intelligence services have been using Bitcoin to pay teenage and untrained spies, according to a Reuters investigation conducted in partnership with blockchain analytics firms Global Ledger and Recoveris.

A report from Reuters detailed the recent case of Laken Pavan, a Canadian national who in December was sentenced to 20 months in prison in Poland after pleading guilty to aiding Russian intelligence.

The Russian Federal Security Service (FSB) had recruited Pavan in late April 2024, after the Canadian—who was then 17 years old—had travelled to Donetsk to volunteer for the pro-Russian Interbrigades, after becoming radicalized online over the course of 2023.

In Donetsk, FSB agents detained Pavan for several days, using threats to recruit him as spy, and then assigning him a handler, known only as ‘Slon’ (Russian for ‘elephant’).

The FSB agents had told Pavan that he would be travelling to various places in Europe, including Ukraine, to gather intelligence, which would be shared with Slon.

From Donetsk, Pavan travelled to Istanbul and then to Copenhagen, which was where he received Bitcoin from Slon worth just over $500.

On May 22, a day after receiving the Bitcoin payments, Pavan travelled to Warsaw, where he turned himself in to Polish authorities.

This is where Pavan’s brief life as a Russian spy ends, but Global Ledger and Recoveris were able to trace the $500 in Bitcoin sent by Slon to two intermediary BTC wallets, which in turn had received hundreds of thousands of dollars in BTC from a large address created in June 2022.

The investigation also revealed that transfers to and from the wallets occurred during Moscow business hours, while analysis revealed that the largest wallet has processed BTC worth a total of $600 million.

The largest wallet had also sent funds to sanctioned Russian exchange Garantex, while Global Ledger reported that it appears to be funded by a “major mining pool and custodial service.”

While neither Global Ledger nor Recoveris could definitively identify ownership of the large wallet (or the two intermediary wallets), both lean towards the conclusion that it’s linked to the FSB.

“Transactions from wallets linked to the FSB followed a structured laundering pattern, involving fund splitting, mixing with larger sums, and routing through unconnected deposit wallets,” Global Ledger explained in its report for Reuters.

Russia’s crypto spy network

While Laken Pavan’s is only one case, Recoveris tells Decrypt that it has been observing how Russia’s intelligence and security agencies are “constantly financing” agents using cryptocurrency.

“This method has been uncovered on multiple occasions; for example, in 2023, a group of young Belarusians and Ukrainians based in Poland was found to be funded by the GRU in cryptocurrency,” said Recoveris CEO Marcin Zarakowski.

According to Zarakowski, the young spies were tasked with installing cameras on a major train route from Poland to Ukraine, tagging city walls with political propaganda to increase divisions in Polish society, and publishing fake news.

Since then, many other instances of GRU and FSB payments in cryptocurrency have been discovered in Poland, with some assets even being paid to commit arson.

“From the ongoing Recoveris intelligence, we can see that GRU/FSB wallets are active on a regular basis,” Zarakowski explained. “As an example, one address identified as FSB-related belongs to the cluster of 161 Bitcoin addresses with hundreds of outgoing transactions—almost all within the Moscow business hours 6am till 6pm.”

Russia’s use of cryptocurrencies also extends to financing private mercenaries fighting in the Donbas region on the Russian side of the war in Ukraine, and even paying off politicians in Europe to spread pro-Russian and anti-Ukraine messages.

And given the extensive range of sanctions placed on Russia and Russian entities, it’s likely that the FSB and other agencies will continue using cryptocurrency for some time to come.

“The advantage of using Bitcoin or cryptocurrency to pay agents or assets is that any amount of money in cryptocurrency (even millions of USD) can be moved instantly throughout the globe without any government barriers, except for the crypto-to-fiat gateway,” Zarakowski said,

On top of this, the Russian intelligence apparatus has plenty of use for the transparency afforded by cryptocurrencies.

“Handlers and higher-ranked intelligence officers can monitor crypto flow,” Zarakowski added. “Anything spent by agents can be audited to ensure it is being spent on operational purposes.”