When Ekaterina Abreu awakened on Nov. 9 at 5 a.m. in her Russian home, she grabbed her phone and checked her cryptocurrency savings. Her account in the Chatex app she used to buy and store crypto looked weird: The balance of her XRP holdings was concealed.

Chatex support replied to her query, saying that they would provide information later. “I thought, it can’t be good,” she said.

Bad news soon arrived.

The day before, the U.S. had announced sanctions against Chatex, saying the crypto exchange had “facilitated transactions for multiple ransomware variants” and worked with the over-the-counter trading (OTC) firm Suex. Two months earlier, Suex had become the first crypto service to be sanctioned by the U.S. government.

As a result, Chatex says it had to suspend withdrawals for its 370,000 registered users. “Now I know I should have withdrawn my money immediately, not wait until it gets frozen,” Abreu said.

At the time, Chatex’s customers encountered a unique situation. But crypto users worldwide may soon face similar predicaments as U.S. regulators, with their global reach, try to rein in the illegal use of cryptocurrency. The prospects for these users to recover their money are unclear, even if they are innocent of any wrongdoing.

Suex and Chatex shared a co-founder and investor, Egor Petukhovsky, who has denied any wrongdoing and resigned from his Chatex leadership position as damage control for the company he’s been promoting the past several years.

It didn’t help. On Nov. 9, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Chatex for “providing material support to Suex and the threat posed by criminal ransomware actors.”

Chatex subsequently froze all withdrawals from its crypto treasury consisting of non-custodial wallets the firm operated itself and custodial ones hosted by the institutional crypto custodian firm BitGo.

At the time of publication, BitGo had not answered CoinDesk’s questions.

While crypto is global, regulations are inconsistent around the world, with some regions just catching up with stricter know-your-customer and anti-money laundering (KYC/AML) trends. Companies that fail to prevent criminals from using their platforms may not face traditional criminal investigations in their home countries. But they may still be vulnerable to U.S. Treasury Department sanctions – a sudden punishment from abroad.

Chatex says that it had over 370,000 registered users. Among them is Alexander, a 35-year-old crypto trader who asked that his surname not be used. (“They don’t like crypto traders here in Russia,” he explained.) Chatex had multiple traders selling and buying crypto peer-to-peer, and a user-friendly interface and API, he said. Chatex also added new coins faster than most exchanges, so “you could change anything for anything,” Alexander added.

But Alexander also noted that, while OFAC blacklisted only 30 blockchain addresses, all of Chatex’s crypto was blocked, including Alexander’s coins.

Chatex co-founder Vladislav Bulochnikov told CoinDesk that a lawyer advised the company that because of the sanctions, the exchange should not touch any of its funds.

Specific license

U.S. authorities described Suex and Chatex as money-laundering vehicles that processed crypto extorted from American companies by some of the world’s most notorious ransomware gangs.

“Unprincipled virtual currency exchanges like Chatex are critical to the profitability of ransomware activities, especially by laundering and cashing out the proceeds for criminals,” the OFAC press release said.

For Abreu, Chatex was just a handy mobile app to buy and store her crypto savings. She would buy $30 to $50 worth of crypto every once in a while just to earn a bit to buy her two children New Year’s gifts. After the sanctions were imposed, Chatex locked $3,000 worth of her crypto, which she wants back, she told CoinDesk in a phone interview.

Abreu, a lawyer who has lived in the U.S. for the past 10 years, decided to contact U.S. agencies about the situation and eventually landed at OFAC’s doorstep. An OFAC officer who contacted her by phone was “shocked” that Chatex even had legitimate users, Abreu said.

But he recommended that she apply for the so-called specific license for the release of blocked funds – a special procedure designed for innocent parties to get their funds back from sanctioned accounts.

An acquaintance told her there was a Telegram group of Chatex users discussing what to do after their money ended up in a virtual limbo created by the way U.S. sanctions, the crypto custody market and evolving cryptocurrency regulations work.

The day after Abreu learned about the license and shared this information with other users in the Telegram group, Chatex itself started sharing the link for the application, Abreu said. In the ensuing days, some people applied for a license, although it’s hard to determine a total.

However, several days after she completed the form on the OFAC website, the agency wrote that it couldn’t locate the blocked funds. The OFAC representative instructed Abreu to attach a Chatex confirmation that she had stored her crypto on the platform, she said.

An OFAC media representative declined to comment for this story, pointing to two short online posts it published about blocked cryptocurrency accounts, one this year and the other in 2018.

An FAQ published Oct. 15 says that a U.S. crypto service “may choose to block each virtual currency wallet or opt to consolidate wallets that contain blocked virtual currency,” but that the service must ensure the return of the crypto to the owner following OFAC approval.

Trapped coins

According to the analytics firm Crystal Blockchain, wallets associated with Chatex hold over 5.3 BTC, 75 ETH, 218,000 USDT, 27,000 USDC and multiple other tokens. An XRP wallet mentioned by OFAC contains 46,489 XRP and is marked as BitGo’s custodial wallet in the XRPscan public blockchain explorer.

As for the BTC wallets, most of the addresses listed by OFAC are now empty, except one containing one bitcoin and another one with 0.007 BTC. The remaining bitcoins, which are not on the OFAC list, are blocked by BitGo anyway, said Chatex co-founder Vlad Bulochnikov.

On the other hand, 12 of the 30 crypto wallets attributed to Chatex on the OFAC list do not belong to the firm, Bulochnikov said. Those addresses interacted with Chatex though, he told CoinDesk. “To some of them, users withdrew to, and from others, they received funds [to their accounts with Chatex],” he said.

Bulochnikov declined to point at specific addresses that he said were erroneously attributed to Chatex.

Although blockchain analysis and attribution of addresses to real-world entities can be tricky, OFAC approaches the task carefully, said Ari Redbord, head of legal and government affairs at the blockchain sleuthing firm TRM Labs and a U.S. Treasury alum. “I can tell you from my experience at Treasury that OFAC designations involve tremendous intelligence gathering, investigation and deliberation,” Redbord said.

Tom Robinson, co-founder of another crypto analytics firm, Elliptic, agrees: “My understanding is that OFAC typically requires pretty robust evidence before linking addresses to sanctioned actors,” Robinson told CoinDesk.

After the sanctions were imposed, Chatex’s team offered users a detailed explanation of why their funds had been frozen, on its main page. According to Chatex, BitGo blocked some of the funds and Chatex itself froze the other part because these funds might face sanctions.

Lawyers from the U.S. firm Ferrari and Associates, which specializes in cases involving U.S. economic sanctions, have advised Chatex not to touch any funds while the company is sorting things out with OFAC, Bulochnikov said.

BitGo currently custodies bitcoin, XRP and some other cryptocurrencies of Chatex’s users, Chatex said in its announcement, and all unspent transaction outputs are frozen “at the moment of sanctions’ appearance.” On the other hand, Chatex has direct control over wallets storing ether, TRON and tokens based on these two blockchains with many of these not included on the sanctions list.

However, “the movement of these funds will lead to their subsequent blocking on any other exchange,” Chatex said in the announcement. The company added that it’s trying to get a license from OFAC for the entirety of Chatex’s funds to be released, but also encouraged users to apply for individual licenses.

“But, more importantly, back then this procedure was applicable only to fiat structures. For instance, you have to fill in the recipient bank and the sending bank. Now we should adapt this procedure to our situation in order to be available to work with crypto,” the announcement said.

In a later update, published in Chatex’ Telegram channel on Dec. 8, the team said it was going to apply for a license to get its crypto released the following week.

Erich Ferrari, principal attorney of Ferrari and Associates, confirmed to CoinDesk that the firm was working with Chatex. He declined to comment on Chatex’s case in detail but said that “OFAC frequently uses its licensing authority to allow for certain transactions that would otherwise be prohibited by the sanctions.”

“It does this to minimize economic damage to innocent parties (e.g., in issuing wind down licenses), as well as when it furthers U.S. economic, foreign policy and national security objectives to do so,” Ferrari added.

Grim prospects

The sanctions hit Chatex hard. Hours after the announcement, all U.S. and European companies upon which Chatex has been relying stopped working with it and cut any communications, Bulochnikov said.

This list included BitGo, which immediately froze Chatex’s BTC, XRP and other wallets; blockchain analytics provider Crystal Blockchain, which Chatex used for compliance; London-based KYC provider Sum and Substance; web services company CloudFlare; and even Google. The Chatex team lost access to their business email accounts and cloud services, Bulochnikov said.

No longer able to operate, Chatex laid off almost the entire workforce the day after the sanctions, Bulochnikov said. He added that, in theory, Chatex could use its recovery option for the BitGo wallets; however, the mechanics of the recovery procedure would require Chatex to move all its bitcoin at the same time, including the blacklisted coins, which the company cannot do.

Benjamin Hutten, counsel at the law firm Buckley LLP, says Chatex users won’t have an easy time retrieving their crypto from the frozen wallets, particularly because of Chatex’s ties to Suex, which OFAC believes is involved in ransomware money laundering.

“And as OFAC’s actions against Chatex are part of a government-wide crackdown on ransomware, any application to release funds will be scrutinized very closely,” Hutten told CoinDesk, adding that “most Chatex users are unlikely to see the release of their assets in the near future, if at all.”

“It seems very unlikely that OFAC would simply allow Chatex to return funds to users,” Hutten added, because “OFAC typically imposes multiple conditions and limitations on any license it grants, and it is hard to see how it would trust Chatex to determine whether a user could meet the conditions and limitations that OFAC would impose on any release of funds.”

Regarding individual applications, OFAC might want to know why and for what purposes people used Chatex, Hutten said. “OFAC would have to be certain that the use of Chatex was for legitimate purposes, which is likely to be a tall task given its finding that more than half of the transactions that the exchange facilitated involved illicit or high-risk activities – including ransomware payments,” he said.

Abreu is pessimistic that she will be able to claw back her crypto from the OFAC freezer. So far, both OFAC and BitGo have told users they could not locate their funds. Abreu believes that’s because individual users have been neither sanctioned by OFAC, nor blocked by BitGo.

However, Abreu is determined to make Chatex pay, even if OFAC does not help the users, through the Russian and European justice system. She told CoinDesk that over the past two weeks she has reported the situation to the national prosecutor’s offices in Russia and in Estonia, where Chatex is registered.

“We must not get affected by these sanctions,” she said.