Coins of War: How Crypto Keeps Feeding Russia's War Despite Sanctions

“Sanctions are good. They prove we’re doing everything right.”

When I ask Alexander Lyubimov if he’s afraid to get on the international sanctions list, he says:

“I’m totally striving for personal sanctions. I believe sanctions would be a sign of recognition for my work. I would even like the Hague Tribunal to learn about my existence and do something, say, put me on a wanted list for war crimes.”

Lyubimov is a director of the Novorossia Aid Coordinating Center (NACC), which is fundraising for Russian troops in Ukraine. Out of two dozen Russian pro-war fundraisers contacted by CoinDesk, he was the only one who agreed to speak with us by phone.

NACC is one of many formal and informal organizations in Russia that together raised at least $1.8 million in crypto to supply the struggling Russian army in Ukraine with ammunition, armor, surveillance drones, optical devices, vehicles and warm clothing.

The number looks modest compared to millions on crypto raised by Ukrainians, and the calls for donations have been much more low-profile, but some of the private Russian efforts managed to raise hundreds of thousands dollars for particular military units.

The sanctions on Russia for its invasion of Ukraine in February 2022 made crypto even more popular as a fundraising tool for pro-Russian groups and influencers: Now, it’s the only working donations channel for Russian army sympathizers from abroad.

According to CoinDesk’s analysis, a significant part of the $1.8 million went to centralized exchanges, including Russian exchanges Garantex and Bitzlato, both suspected of processing large amounts of criminal funds. But popular global platforms such as Binance, Huobi and others received a fair amount of such funds, too.

In the meantime, on the other side of the frontlines, dozens of Ukrainian volunteers are out there looking for such wallets, reporting them and trying to get the money frozen. Sometimes, they prevail.

‘Read the darknet’

NACC’s Lyubimov isn’t joking about wanting the International Criminal Court (in The Hague) to investigate his work as part of its Russian war crimes inquiries.

He actually does not believe he participated in any war crimes, but uses the term with defiance. “Our enemies call it ‘war crimes.’ I believe we’re defending our homeland,” he says.

NACC has been operating since 2014, when Russia annexed the Crimean peninsula and fueled an armed insurgency in southeastern Ukraine.

The group has been raising funds to support the self-proclaimed People’s Republics of Donetsk and Luhansk, the breakaway regions of Ukraine that pledged allegiance to Russia, and the local militia forces fighting the Ukrainian army. One NACC leader, Alexey Markov, even joined the command ranks of the militia. He died in a car accident in 2020.

The NACC has been using crypto for donations for a long time, along with traditional fiat rails, Lyubimov said. However, the war and sanctions on Russia made crypto even more relevant. Before the war, the NACC transacted only in bitcoin. After the war started, some supporters asked for more cryptocurrency options, and the group added ether ETH$3 904,64 and USDT$1,0006 wallets. The donations increased, too.

“We had PayPal once but it had been blocked multiple times and now it doesn’t work as a tool for foreign donations anymore,” Lyubimov said. “A lot of people living far away want to support our work, and the only available way for them now is crypto.” He said Russian army sympathizers are donating crypto from Europe, Australia, the U.S. and other countries.

Lyubimov says the group long ago figured out ways to avoid getting its crypto blocked by exchanges. When asked how it does it, he responds obscurely: “Read the darknet. Everything has been invented long before us. People run shadow businesses and explain in detail how to do things right and smart.”

I ask him whether he means buying verified exchange accounts with other people’s names – a flourishing market CoinDesk investigated last year. Lyubimov refuses to confirm or deny it.

Read more: For $200, You Can Trade Crypto With a Fake ID

Since the beginning of the war, NACC has raised more than 1.3 BTC, 2.75 ETH and 5,700 USDT on the wallets it published on its website, or about $40,500 in total. In September, blockchain analytics company TRM Labs found about $21,000 on NACC’s wallets, which shows the fundraising drive only accelerated during the fall and winter.

Together with researchers from the Ukrainian crypto startup HAPI, which are monitoring such money flows, CoinDesk located many other wallets raising funds for the Russian troops. Then, with the help of blockchain analytics firm Crystal Blockchain, we took a close look at how crypto is flowing from donors around the world to the Russian troops in Ukraine.

Russia needs more money

Wars are expensive, and the Russia-Ukraine conflict is no different.

As for the underequipped Russian troops, a constant money flow is needed to buy everything from surveillance drones to warm clothing – at least that’s what pro-war influencers tell their Russian followers as they solicit for donations.

Part of those donations comes in crypto.

“The ammunition guys needed, it was just absent, we were buying warm underwear, socks, winter boots,” said Anastasia Mikhaylovskaya, a Russian right-wing celebrity raising funds for the troops, in an interview in December. Russian troops appeared to be “totally unprepared” for the winter war as “nobody expected the [military] operation would drag on for so long,” she added.

Mikhaylovskaya wears many hats: a movie actress, a prominent public figure on Russia’s far-right, an ally of the conservative ideologist Alexander Dugin and Ukraine’s breakaway republics’ leadership. She has been actively raising funds for food, clothing, medicine, bulletproof vests and helmets, optical equipment and drones. In her December interview she claimed her team had raised over 400 million rubles ($5.6 million) to that point.

The wallets Mikhailovskaya put on her website for donations received over 6.36 ETH and 25,000 USDT since Feb. 24 (the beginning of the 2022 invasion), or about $34,000. More came to wallets published in anonymous Telegram channels raising funds in Mikhailovskaya’s name, like this one.

Several pro-Russian fundraisers who spoke to CoinDesk, including NACC’s Lyubimov, said crypto provides a smaller part of all donations and not many donors use this channel.

Inside the war coffers

Among Russian war fundraisers, the NACC and Mikhaylovskaya’s team appeared among the most efficient crypto fundraisers, according to CoinDesk’s analysis: Their wallets received significant amounts of crypto. However, some other groups raised even more.

For example, Rusich, the infamous right-wing paramilitary group linked to the Wagner private military company, which has been sanctioned by the U.S., raised over 2.7 BTC, 30 ETH and $88,000 in various stablecoins, a total of over $212,700, since the start of the war. The money raised helped Rusich buy optical devices, radios, various ammunition and medical supplies, according to the reports in its Telegram group.

Donations are not the only source of money for Rusich: In November, Russian news outlet Meduza found that at least once the group hacked a Ukrainian charity fund’s website and replaced one of the Ethereum blockchain addresses with its own. That wallet received 24.6 ETH, the most crypto of any of Rusich's other known wallets. Rusich leader Alexey Milchakov confirmed to Meduza that cybercrime is one of the group’s sources of funds.

Another influencer driving large flows of donations is Vladimir Romanov, a Crimea-based blogger who gained prominence after the war began. Last spring, Romanov started posting videos of visibly scared and exhausted Ukrainians apologizing for speaking badly about the Russian army on social media. The videos could have been filmed in Russian army tents, Novaya Gazeta Europe wrote.

In his channel, Romanov gives updates on the Russian troops’ advancement, often posing in military fatigues alongside active artillery. He’s raised funds to buy drones, cars and other equipment for various regimens of the Russian army, including unidentified units of rocket artillery and Special Rapid Response (SOBR).

Romanov’s wallets received over 4.3 BTC, or about $177,000, according to Crystal Blockchain.

Sisters Yekaterina and Valentina Kornienko from the Donetsk region use a totally different image: two blond women with soft smiles, accompanied by a little girl, presumably a daughter of one of the sisters, driving truckloads of drones, helmet, optical devices and other war supplies to the troops.

According to Kornienko’s Telegram channel, by September 2022 crypto wallets alone brought them 15 million Russian rubles, or about $210,000 of donations. The wallets Kornienko published on Telegram received over 2.7 BTC, 5.1 ETH and over $106,000 in stablecoins since the beginning of the war.

Other prominent fundraisers include sanctioned Russian state TV reporter Yevgeny Poddubny, who raised more than $215,000 in crypto; the Organization for the Promotion of the Preservation of Domestic Traditions and Cultural Heritage (MOO Veche), which raised about $82,000; and Interregional Organization Development of a Social Justice Society which has raised $86,700 since the war began, according to CoinDesk and Crystal Blockchain’s calculations.

Wallet hunters

While war-supporting Russians are chipping in to supply the army, Ukrainians opened a “hunting season” on such crypto accounts. HAPI, a Ukrainian startup building decentralized anti-money laundering (AML) tools, announced a two-week campaign to search for scam- and crime-related addresses last summer. People who found the most wallets got some of the project’s own HAPI token as a prize.

This first hunting season received good feedback from the Ukrainian crypto community, says Mark Letsyuk, head of analytics and research at HAPI. People asked the next one be focused on Russian war financing, he added. So in October the community hunted for war-related crypto wallets.

This is not just a fun exercise. HAPI works closely with Ukraine’s cyber police. Following their reports, dozens of exchange accounts have been blocked from helping to fuel Russian military aggression, Letsyuk said. Now, HAPI wants to allow volunteers to submit crime-related addresses and get rewards automatically if their submissions are verified as valid.

CoinDesk analyzed HAPI’s database and selected only addresses posted by accounts explicitly saying they’re helping the Russian army and paramilitary groups. Together with the blockchain intelligence firm Crystal Blockchain, we analyzed 302 such wallets.

Almost half of them never received funds, and it’s hard to check whether those that did spent the money on goods for the Russian troops. But the exercise has shown that despite the sanctions on Russia, crypto donations are still flowing to the Russian troops, often through known crypto exchanges.

The 160 wallets that received funds together got over $1.8 million worth of crypto, Crystal Blockchain calculated for CoinDesk, or over 35.2 BTC, 147 ETH and $588,000 in various stablecoins.

A significant part of all the crypto raised by those wallets has been sent to known centralized exchanges and crypto services. This should not come as a surprise. According to Chainalysis, centralized exchanges are still the main recipients of such illicit funds, with just four exchange deposit addresses receiving over $1 billion in criminal funds during 2022.

Crypto exchanges deal with it

In some cases, after the law enforcement weighs in, centralized exchanges freeze war-directed crypto. But often the legal process is just too slow to catch up with the speed of blockchain transactions, and there are ways to trick the exchanges’ know your customer/anti-money laundering (KYC/AML) controls.

For example, the anonymous author of the popular Fighterbomber Telegram channel, who raised over $21,800 to buy supplies for Russian fighter pilots, told CoinDesk his exchange account has never been blocked.

A representative for Rusich, when reached via an anonymous contact account on Telegram, told CoinDesk the group had its money frozen on exchanges in August, even before it was officially put on the U.S. sanctions list, but it “found other ways.” Then he stopped responding to CoinDesk.

In some cases, fundraisers received crypto directly to their deposit addresses on popular exchanges. Many of those addresses are on Binance, the world’s largest exchange by volume. Out of the 302 addresses CoinDesk looked into, 15 turned out to be Binance deposit addresses. These include two addresses belonging to the Russian gun-maker Vladislav Lobaev, which Binance allegedly blocked previously at the request from Ukrainian law enforcement.

A Binance spokesperson confirmed to CoinDesk that the remaining 13 addresses (out of the 15) also belong to the exchange and Binance “blocked all transactions where our investigations team was able to link to illicit use and any others are under ongoing investigations with local law enforcement.”

“When the war in Ukraine broke out, we quickly assembled a dedicated global compliance task force which included our leading sanctions experts. We took proactive steps against sanctioned individuals and entities. And, our investigations team has been tracking the illegal funding of military groups which is an ongoing effort and evolving investigation,” Binance spokesperson added.

CoinDesk also found deposit wallets at Huobi, Kucoin, HitBTC and other centralized services that have been used to raise funds for the war. The exchanges did not respond to CoinDesk’s requests for comment by press time.

Interestingly, some of the funds ended up on Ukrainian exchanges WhiteBit and Kuna. Kuna founder Michael Chobanyan told CoinDesk the exchange froze several accounts related to funding the Russian military, and Ukrainian authorities have opened criminal investigations into the owners.

WhiteBit CEO Volodymyr Nosov told CoinDesk the exchange froze over $250,000 worth of crypto related to war sponsoring and that it works with the Ukrainian law enforcement closely. However, blocking money flows is a tricky task for exchanges because often crypto moves faster than blockchain analytics and law enforcement can investigate.

In such cases, “money goes in and out, and instead of the funds to freeze, we only have a paper trail,” Nosov said.

Another issue is the black market of exchange accounts, he added: “Say the money arrived from a Croatian user who went through the KYC/AML checks and has no clue. And the addresses themselves are not on sanctions lists.”

Remember Alexander Lyubimov hinting about darknet sources? Those tricks work.

It’s also hard to stop the money coming through over-the-counter (OTC) brokers’ accounts nested at exchanges, Nosov said. “[Imagine if] an OTC did their KYC/AML. Not under sanctions. How and for what reasons can you hold their money for a long time?”

Low-key fundraising

The $1.8 million raised by the wallets is a conservative number because we did not include the fundraisers declaring goals to help civilians on the occupied Ukrainian territories, as well as pro-Russian channels raising funds to support their own operations – although such campaigns might also contribute to Russia’s military efforts.

For example, Rybar, a Telegram channel publishing updates on the war, hasn’t explicitly raised funds for the troops. However, it’s actively looking for volunteers to track airplanes, deanonymize social media accounts and convince foreign citizens not to join Ukrainian army, which might help the Russian army in this war, too.

Another example is the hacker group KillNet. It has been raising crypto for itself, however, at least once boasted it helped one of Russia’s special forces units to buy binoculars, blockchain intel firm TRM Labs said in a blog post.

Madeleine Kennedy, director of communications at Chainalysis, told CoinDesk that the wallets the firm has been monitoring received $5.4 million, including both accounts raising money for the troops and propaganda channels soliciting donations to keep their own operations going.

Binance’s own investigation showed an even greater number: $7.2 million, a company spokesperson told CoinDesk. This indicates a notable progress in the war-sponsoring efforts: in October, Chainlaysis’ estimate was $4 million, and Binance found $4.2 million of such donations, Wired reported back then.

The amount raised also might seem very modest compared to the over a hundred million in crypto raised by major Ukrainian funds, both state-sponsored and private initiatives over the course of the war. It should not come as a surprise: while Ukraine has been openly calling for help – a government Twitter account asking for bitcoin and ether donations – Russia acts in a more clandestine way.

Ukraine’s message to the world has been very straightforward since the beginning of the war: “Help us defend against the aggression.” Russian leaders, by contrast, have been struggling to find a convincing narrative and didn’t even officially say the nation was at war until very recently. Russia is even less willing to officially recognize the lack of equipment and supplies for its troops.

Russian online fundraising goes in a volunteer, guerilla-style mode, with information shared in social networks but never by official army or government sources. This is true both for campaigns to help out Russian regular troops and arm the private paramilitary groups like Rusich.

The U.S. and other Western countries have been trying to stop those crypto flows, but it’s not that easy with crypto. While the U.S. Treasury Department is using a targeted approach and going after selected entities and crypto wallets, the European Union acted in a broad-brush style last fall, banning Russian citizens from using crypto services. Affected by those sanctions were also Russian journalists and activists who did not support the war and had to leave the country because of their position.

WhiteBit’s Nosov believes the existing KYC/AML systems in place don’t really work for crypto because they use approaches of the traditional fiat system, and are not catching up with the new reality of 24/7 crypto markets.

“The banking system is using tools that don’t work for crypto,” he said.

Additional reporting by Sage D. Young and Trista Luo.