The Russia-Ukraine war is unique in many ways. One of them is it being the first crypto-funded conflict.
Despite drastic western sanctions cutting Russia from global financial markets and commerce following its attack on Ukraine on February 24, 2022, millions of dollars have continued to flow directly to Russian military and paramilitary groups in a form that’s proven harder to control: cryptocurrency. Cryptocurrencies have been thrust into the spotlight during the Russia and Ukraine war. Ukraine, too has been seeking donations via digital coins, which can be sent quickly across the world. But they’re now also being used by Russian paramilitary groups.
TRM Labs, a San Francisco-based blockchain intelligence company that helps financial institutions, crypto businesses, and government agencies detect and investigate crypto-related financial crime and fraud, has identified pro-Russian groups, including a paramilitary group sanctioned by OFAC in September – Task Force Rusich, collecting cryptocurrency donations to support Russian military operations.
US$4 million in crypto funding tracked
As of September 22, 2022, these groups have collectively raised almost $400,000 since the start of the invasion on February 24, 2022. According to Telegram postings, the groups’ funds are used to purchase supplies for Russian-affiliated militias and to support combat training at physical locations close to the Russia-Ukraine border. According to some estimates, at least $4 million worth of cryptocurrency has been collected by groups supporting Russia’s military in Ukraine, researchers have found.
According to analyses by cryptocurrency-tracing firms Chainalysis, Elliptic, and TRM Labs, as well as investigators at Binance, the world’s largest cryptocurrency exchange, recipients include paramilitary groups offering ammunition and equipment, military contractors, and weapons manufacturers. That flow of funds, often to officially sanctioned groups, shows no sign of abating and may even be accelerating: Chainalysis traced roughly $1.8 million in funding to the Russian military groups in just the past two months, nearly matching the $2.2 million it found the groups received in the five months prior. And despite the ability to trace those funds, freezing or blocking them has proven difficult due largely to unregulated or sanctioned cryptocurrency exchanges—most of them based in Russia—cashing out millions in donations earmarked for invaders.
Telegram & Fundraising
While some groups maintain their websites, Telegram is the principal way cryptocurrency addresses are promoted for donations. Groups that received higher volumes of donations typically had some presence before the invasion in February and appeared to have benefited from greater cross-channel promotion on Telegram. Fiat payment methods, such as transfers through Russian bank accounts, are also provided via Telegram. Generally, these accounts are associated with Sberbank, an OFAC-sanctioned Russian majority state-owned banking and financial services company headquartered in Moscow.
Donations for Drones and Training
The Novorossia Aid Coordinating Center (NACC), founded around 2014 to support operations in Ukraine, announced a pivot in April 2022 to specialize in outfitting Russian forces with drones. NACC raised just over USD 21,000 since it began receiving funds in March 2022, of which approximately 89% was in Bitcoin. On June 4, 2022, NACC announced on Telegram its intention to supply and train Russian-backed forces with drones in July and donate 15 Mavic 2 and Mavic 3 brand drones.
Interregional Public Organization for the Promotion of the Preservation of Domestic Traditions and Cultural Heritage (MOO Veche) is a Russian cultural heritage organization established in 2009 that launched a Telegram channel in March 2022. Since then, MOO Veche has received 103 deposits, totalling over USD 56,000 in Bitcoin, Ethereum, Litecoin, and USDT on Tron.
Based on the group’s Telegram posts, specific brigades within the Donetsk People’s Republic (DPR) militia benefiting from the MOO Veche’s fundraising efforts include the International Brigade (Pyatnashka Brigade), the 1st Slavyansk Brigade, and the Kalimus Brigades, in addition to dozens of other battalions, brigades, and regiments under the People’s Militia of the DPR, as well as Russian Special Forces, Marines, and ground forces.
Administrators of the telegram channel have reported on the results of fundraising campaigns since July 2022. These reports include praise for successfully delivering thermal imaging/sights, battery power packs, body armour, and more than 100 Mavic drone-style vehicles. Additional reports disseminated indicate direct first-hand use of the drones provided by engaging Ukrainian forces.
Romanov Light Fundraises for Russian Special Forces
Romanov Light, a Telegram channel created in April 2020, which has raised over $174,000 in cryptocurrencies since the invasion, launched a targeted fundraising campaign in June 2022 for Special Rapid Response Unit (“SOBR”), an elite Special Forces unit in the Russian military. Romanov Light withdrew just over USD 6,000 in Bitcoin to an exchange during the campaign for SOBR.
Romanov Light disseminated an itemized receipt for collection efforts for SOBR, detailing the use of nearly 500,000 rubles (just over USD8,000).
Sanctioned paramilitary group raises and moves funds
A Telegram channel for Task Force Rusich, a neo-Nazi Russian paramilitary group sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC), frequently solicits donations for items earmarked for combat-related missions. According to TRM Labs intelligence, Task Force Rusich maintains at least 14 addresses across seven blockchains and benefits from message amplification within other pro-Russian Telegram channels. The group has received over $144,000 in cryptocurrency since the start of the invasion.
On June 28, 2022, Rusich disseminated a message indicating collections were closed and stopped publicly requesting cryptocurrency donations for over two months. On September 6th, Rusich disseminated a new wallet address. For the addresses, Task Force Rusich circulated before the collections closing on June 28, 2022, approximately 89% of the withdrawn Ethereum and Bitcoin were deposited into a cryptocurrency exchange. After Task Force Rusich’s message on June 28, 2022, the addresses disseminated by the channel deposited over 99% of the funds received into a different exchange. No further observable funds were deposited at addresses at the previous exchange.
Given the temporal relationship between the fundraising campaigns and the corresponding on-chain withdrawal activity, Task Force Rusich is probably using an exchange for particular fundraising periods and changing the deposit exchange after a given period to obfuscate cashout points.
Sanctions and observed service disruptions to the Russian electronic banking infrastructure will likely lead to further adoption of cryptocurrency amongst Telegram channels fundraising for the invasion of Ukraine. VASPs in the Russian region, other high-risk exchanges, and darknet marketplaces have been observed in the counterparty activity for these entities. Given the lack of enforcement mechanisms, they will likely continue to do so.