US says it will sanction two Russians for a phishing campaign that netted nearly $17M in cryptocurrency theft
Ari Natter / Bloomberg :
Context & Ripple Effects
Sanctioning Russian cyber actors has become a recurring US playbook: Treasury first targeted Russian individuals and firms over NotPetya-linked cyberattacks in 2018, then hit nine GRU members over election interference later that year. Today's action applies the same instrument to pure financial crime — two Russians accused of phishing campaigns that netted nearly $17M in stolen cryptocurrency.
What makes the move notable is the pairing of sanctions with the DOJ's parallel criminal track: prosecutors have since indicted Russians for the Mt. Gox bitcoin theft and BTC-e exchange and charged operators of $1B+ money laundering services used by cybercriminals. Washington now attacks the same actors from both the financial-freeze and indictment angles.
First-order effects
- The two named Russians are cut off from the US financial system, with any assets or transactions touching US jurisdiction exposed to freezing — the immediate effect of every designation in this series.
Second-order effects
- Crypto laundering intermediaries face the same squeeze seen when the US sanctioned two Chinese nationals for washing coins for North Korea's Lazarus Group — exchanges and mixing services serving Russian-speaking crews become the next enforcement targets.
Third-order effects
- If the sanctions-plus-indictment pattern holds, state-linked hacking groups are pushed toward harder-to-trace cash-out infrastructure, escalating the cat-and-mouse between US designations and the laundering networks documented in successive DOJ cases.
The trend: US enforcement is converging on Russian cybercrime by combining Treasury sanctions with DOJ prosecutions aimed at the cryptocurrency cash-out layer.