Known for its innovative e-governing system and booming IT industry, Estonia made a supposedly groundbreaking move in 2017. By launching a licensing system for cryptocurrency companies, the Baltic country wanted to become the first in the European Union to regulate crypto business.

Instead, Estonia became a haven for international crypto criminals attracted by the opportunity to receive the prestigious “licensed in the EU” title for their sham firms. With more credibility, they have laundered or defrauded victims for over 1 billion euros, a new journalist investigation has found.

An international consortium of journalists analyzed close to 300 Estonian-registered crypto companies and discovered dozens of crimes: massive-scale fraud, money laundering, sanctions evasion, and illicit financing of Russian paramilitary organizations such as Wagner Group.

Reporters also found links between an Estonia-registered crypto company and Sberbank, Russia’s largest, majority state-owned bank.

The media outlets involved in the project include Delfi (Estonia), Siena.lt (Lithuania), Frontstory.pl (Poland), Paper Trail Media, Der Spiegel and ZDF (Germany), and Der Standard (Austria), among others.

The Kyiv Independent contributed research to this story. Read the full version of the investigation here. Here are the key findings:

Crypto funding for Russian private army

The Russian private military group Rusich, at the heart of the Wagner Group and responsible for committing multiple war crimes in Ukraine, managed to attract hundreds of thousands of euros in donations via cryptocurrencies, the journalist investigation found.

Funding the Russian private army from abroad with traditional banking would be difficult due to the tight money laundering regulations and the SWIFT ban against Russia, while crypto offers easier solutions and near-total anonymity.

Journalists located nine cryptocurrency wallets Rusich used to crowdfund for their operations and found that between 2022 and 2023, the private army raised at least 200,000 euros through them.

Among the crypto companies aiding Rusich in moving funds is Garantex Europe OÜ, which has been under U.S. sanctions since April 2022.

Garantex is also reportedly connected to many cybercriminals. The journalists found the company’s links to wallets transacting with North Korean cybercriminals of the Lazarus Group and Ivan Vakhromeyev (a.k.a. "Mushroom"), a wanted fraudster connected to Conti, a cybercriminal group with Russian intelligence ties.

Estonia stripped Garantex’s licenses on Feb. 24, 2022, the day of the Russian full-scale invasion of Ukraine. Yet this didn’t stop the company from continuing doing business, according to the journalist investigation.

Sanctions evasion

Estonia is home to crypto exchange companies that help Russians convert their rubles into other currencies, bypassing sanctions.

One is Coinsbit, a crypto multi-billion-dollar exchange company that had a licensed legal entity in Estonia. It enables users to convert their Russian rubles into Bitcoin.

Coinsbit was co-founded by Ukrainian IT businessman Mykola Udianskyi. However, he has claimed to have sold his stake in Coinsbit in 2019, and the current owners are unknown.

Coinsbit’s official operating company has reportedly moved from Estonia to Seychelles, which doesn’t disclose company ownership.

Another way companies bypass sanctions against Russia is through the so-called person-to-person, or P2P, method.

The international crypto exchange MEXC, which has a daily trade revenue of around 500 million euros, reportedly offers ruble payments via the P2P method. A client can send rubles from their private Russian bank account to another private Russian bank account and then receive cryptocurrency to their MEXC wallet in exchange.

MEXC doesn’t allow withdrawing funds directly from its wallets but offers its clients the option of transferring the cryptocurrency to exchanges that cash out dollars and euros via the European and U.S. banking systems.

On YouTube and across Russian forums and websites, journalists also found video tutorials in the Russian language on how to bypass sanctions with Payeer, a popular crypto exchange and payment processor in Russia.

When the tutorials emerged online in 2022, Payeer operated from Estonia and boasted about having millions of customers, many of whom were in Russia.

Companies move, misdeeds continue

In 2022, Estonia tightened its regulations, and many crypto companies reportedly started migrating to neighboring Lithuania en masse.

Among them is Payeer. After losing its license, it moved operations from Estonia in 2023 and was reborn in Lithuania as Payeer UAB. Who owns the enterprise is unclear. The company is registered under different, primarily Russian names across jurisdictions.

Like Payeer, another international crypto-firm, MoneySwap OÜ, operating the virtual assets platform Mercuryo, set up a new business in Lithuania. In 2022, the company entered the local market as MoneyAmber UAB.

The shares of both the Estonian and Lithuanian business entities of Mercuryo are managed through the Cypriot company MRCR Holdings. Among its shareholders is Akshin Dzhangirov, who has close ties to Sberbank. His brother Dzhangir Dzhangirov is the Chief Risk Officer at Sberbank, while Akshin himself reportedly received about 285,600 euros in income from Sberbank in 2021.

A representative of Mercuryo told journalists that the platform has no business relations with Sberbank and has an unequivocal “stance against the ongoing war in Ukraine.”