UK police said Russian intelligence services used a cash‑to‑crypto network to move money into a spy ring tied to Jan Marsalek, the former Wirecard executive who vanished in 2020.
The National Crime Agency (NCA) said this link surfaced almost a year after it shut down two Russian laundromats that moved billions of dollars across several countries.
One of the networks tried to fund six Bulgarian nationals who were later convicted in London on espionage charges. Investigators said these six individuals spied on journalists and politicians and also worked on assassination plans before the network was disrupted.
Tracking crypto flows tied to Russian intelligence
The NCA said one laundering system called Smart, run by Russian businesswoman Ekaterina Zhdanova, was used by people connected to Russian intelligence to try to support the spy ring linked to Marsalek.
Ekaterina, who has spent more than a year in pre‑trial detention in France for a separate criminal case, was described as a key figure in the money‑moving structure.
Prosecutors said Marsalek, who they said worked with Russian intelligence services, paid up to £45,000 ($58,768) to support the activities carried out by the Bulgarian group. They said he was not charged in the espionage case.
He disappeared in 2020 during the collapse of Wirecard. A London judge sentenced the six Bulgarians to prison terms of up to 10 years.
Authorities around the world are dealing with huge amounts of crypto tied to organized crime. The US said last month that it seized $15 billion in Bitcoin after uncovering what it called a “sprawling cyber fraud empire” in Cambodia.
A study released last year estimated that scams of the same kind stole more than $75 billion from victims between January 2020 and February 2024.
Investigators said the Smart network and another network called TGR were able to support almost any crime. They said both networks used Tether’s stablecoin because of its large liquidity pools.
The investigators said the systems handled money for a wide list of clients, including the sanctioned UK arm of Russia Today and the Kinahan crime syndicate.
The NCA said the networks acted like underground clearing houses. They took cash in one country and made the same value available in another. Sal Melki, the NCA’s deputy director for economic crime, said:
“Through this laundering scheme, we can now draw a line between the money involved in the local drugs trade to global organized crime, geopolitics and state sponsored activity.”
Investigators connect laundering networks with rising security tensions
US officials sanctioned Ekaterina in 2023 and said she moved more than $100 million for an oligarch to the United Arab Emirates. The NCA said it has arrested 45 suspected launderers in the past 12 months and seized £5.1 million in cash.
Sal, speaking about the networks, said they “operate at all levels of international money laundering, from collecting the street cash from drug deals, through to purchasing banks and enabling global sanctions breaches.”
While investigators were connecting crypto flows to espionage, the UK also reported a new security threat at sea. A Russian spy ship named Yantar moved near UK waters and aimed lasers at British pilots.
Defense Secretary John Healey warned that the action was “deeply dangerous” and said the UK may use military options if the vessel moves further south.
John told reporters in Downing Street that Yantar entered wider UK waters north of Scotland in recent weeks. The ship is built to gather intelligence and map undersea cables.
He said a Royal Navy frigate and maritime patrol aircraft will track it and Britain stands “ready.” He also said the lasers appeared meant to distract British surveillance pilots.
UK officials said the vessel was inside UK waters from Nov. 5 to Nov. 11. Earlier this year, the same ship came within 45 miles (72 kilometers) of the coast, which led the UK to deploy an attack submarine to deter it.
Want your project in front of crypto’s top minds? Feature it in our next industry report, where data meets impact.
