A criminal case in Russia involving a large amount of Bitcoin is being investigated, and blockchain intelligence firm Crystal Blockchain has found that some of the evidence of the crime is being moved to crypto exchanges by unknown parties. Marat Tambiev, a 35-year-old mid-ranking officer on Russia’s Investigative Committee, is under investigation for allegedly extorting Bitcoin from hackers. According to the Russian newspaper Kommersant, the hackers paid a bribe of 1,032 BTC to Tambiev so that he would not confiscate all of their crypto. However, the hackers testified that they sent Tambiev more than twice as much crypto – 2,718 BTC – via their attorney.
The hackers met Tambiev at the Investigative Committee office and spent hours going through their crypto wallets. They found that they together had 5,212.9 BTC in total and paid Tambiev 2,718.66 BTC, keeping the rest. In March 2022, Tambiev was arrested and his laptop with Bitcoin was confiscated. On his MacBook, Tambiev’s colleagues found a file titled Retirement, with photos of hand-written notes that contained seed phrases for two wallets. In those wallets, investigators found 931.1 BTC and 100 BTC.
Crystal Blockchain located the wallets that contained the bribe based on fragments of addresses listed in the leaked court documents. The wallets that received 100 BTC and 932 BTC in July 2022 are both empty now, their contents sent to the wallet in the custody of law enforcement in Nov. 2022. Crystal located additional, previously unreported wallets belonging to the Infraud Organization, and those appeared to be closely connected with the darknet marketplaces UniCC and LuxSocks.
The remainder of the bribe money that the hackers said they gave Tambiev may have been stored in a third wallet with 654.1 BTC in it, according to Crystal. During 2022, most of those funds moved to centralized crypto exchanges, namely, Huobi, WhiteBit, and a little-known Estonia-registered exchange Bitexbit, Crystal’s data show.
We assess that these payments were probably made to other officials who have not been held accountable but have some connections to Russia-based cybercrime groups, Nick Smart, director of blockchain intelligence at Crystal Blockchain, said.