A look at cryptocurrency exchange Suex, which appears to be operating in Moscow and is accused of laundering ransomware payments by the US Treasury Department
Bloomberg : Tweets: @hkanji Tweets: Hussein Kanji / @hkanji : The U.S. Treasury Department alleges that Suex has played an integral role helping criminal hackers clean and cash out their loot, mostly Bitcoin paid by ransomware victims, before converting it to a traditional currency https://www.bloomberg.com/...
Context & Ripple Effects
Two weeks before this Bloomberg field reporting, the Treasury Department hit Suex with its sanctions action over at least eight ransomware variants (the September designation) — making Suex an early test of whether Treasury can reach the cash-out layer of ransomware, not just the crews themselves. The piece matters because it puts physical geography on a sanctions target: Suex appears to be operating out of Moscow despite being cut off from the US financial system.
That geography fits an established pattern in the coverage: the Ryuk operators' $150M+ in Bitcoin ransoms were already being cashed out through major offshore exchanges, so laundering venues — not encryption — are where enforcement pressure is concentrating.
First-order effects
- Suex is now effectively locked out of dollar clearing and any US-touching banking relationship, forcing its operations to survive entirely inside jurisdictions and counterparties that ignore Treasury designations.
- Ransomware crews that relied on Suex to convert victim Bitcoin into traditional currency must immediately reroute their cash-out flow to alternative exchanges, repeating the migration already seen when Ryuk proceeds moved through Binance and Huobi.
Second-order effects
- Every exchange touching ransomware flows now faces sharper counterparty due-diligence questions, because Treasury has demonstrated it will designate the intermediary rather than only the hacking crew.
- Cash-out activity consolidates toward Moscow-based venues outside US reach — the corridor that later made Garantex, per the Wall Street Journal's reporting, a major laundering channel for cybercriminals.
Third-order effects
- If the pattern holds, sanctions evolve into seizures: the same Russian-exchange problem Treasury first named with Suex ended with the Secret Service and Europol physically taking down and seizing Garantex in 2025.
- Structurally, the fight moves from code to geography — investigators traced ransomware payments to companies in Moscow's Federation Tower East, turning crypto compliance into a geopolitical fault line over whether Russia tolerates ransomware operators on its soil.
The trend: US enforcement against ransomware money laundering is climbing the stack — from designating cash-out exchanges like Suex toward seizing them outright — and each action pushes the laundering business deeper into sanctioned-jurisdiction venues.