Crypto

German Law Enforcement Seizes Russian No KYC Exchanges – Chainalysis

Published

2 years ago

September 25, 2024

German Law Enforcement Seizes Russian No KYC Exchanges – Chainalysis

On September 19, 2024, the German Federal Criminal Police (BKA) seized the infrastructure of 47 Russian-language no-KYC (Know Your Customer) cryptocurrency exchanges. Dubbed “Operation Final Exchange,” the takedown stands out not only for its breadth, but also for the light it has shined on the central role instant-swap style no-KYC exchanges play in facilitating on-chain cybercrime.

As their name suggests, no-KYC exchanges have no known process for collecting customer information before allowing any level of deposit or withdrawal. They do not require a name, phone number, or email address, and make no attempt to verify this information prior to permitting transactions. As such, these services allow a range of cybercriminals to abuse their services without KYC controls to identify or disrupt illicit activity. The BKA’s Operation Final Exchange landing page calls out ransomware affiliates, botnet operators, and darknet vendors as users of the 47 targeted exchanges. Beyond that, these services offered fiat on- and off-ramping for sanctioned Russian banks, creating an avenue for sanctions evasion.

Below, we’ll dive into these exchanges’ on-chain activity, explore their nexus to sanctioned Russian banks, and discuss the disruption’s implications.

Who are these 47 No KYC Exchanges?

Our data reveals interesting patterns about the services targeted by the BKA, with robust direct and indirect exposure to various illicit services. At least seventeen of the exchanges saw a month of more than 50% of direct inflows from illicit sources. At least twelve saw a month where more than 30% of direct inflows were from darknet marketplaces (DNMs). At least six saw at least one month where stolen funds comprised more than 30% of total direct inflows. At least five had at least one month where more than 30% of indirect inflows were from sanctioned entities.

This exposure demonstrates that for many of these services, laundering illicit funds was a substantial part of their businesses. Indeed, as depicted in the below Chainalysis Crypto Investigations graph, the top ten services targeted by the BKA transacted with a broad array of illicit services, including, but not limited to, sanctioned entities, ransomware actors, DNMs, and darkweb escrow and breached data brokers.

The chart below shows the quarterly inflows to the top ten exchanges taken down by the BKA. These services received value from a variety of sources, including periods of significant inflows from drug-related DNMs, online pharmacies, malicious cybercriminals such as ransomware gangs, and funds stolen in heists and scams.

There is also a notable increase over time in the proportion of inflows from legitimate sources, notably centralized exchanges. While this change to the composition of inflows might in other circumstances suggest that the services were in the process of cleaning up their platforms, the reality is likely more complicated. In this case, the increased inflows from otherwise legitimate sources most likely represent the growing use of these services for sanctions evasion on the part of Russian nationals, who are likely trying to leverage these no KYC exchanges to evade sanctions on Russian banks.

How do these services work?

These services operate as instant-swap style services, in which users, without providing any personal information or going through any verification process, can swap from one currency to another. The offerings include crypto-to-crypto and fiat-to-crypto swaps, allowing users to instantly exchange popular cryptocurrencies and stablecoins, or to connect their bank account to on-/off-ramp fiat to crypto instantly.

As with other categories of the illicit crypto ecosystem, we have observed that no KYC exchanges, particularly those targeted by the BKA, often have overlapping or similar on-chain infrastructure, and in some instances even share off-chain networks, such as website shells, employees and administrators, physical locations, and ownership structures, to name a few. More often than not, these websites have no affiliated company incorporation, registration, phone numbers, physical addresses, or any indicator of jurisdictional operation. Unlike other high-risk and illicit services, most of these services do not have a social media presence, instead offering users the ability to interface with a bot on their homepages. Despite using servers based in Germany, these services cater primarily to a Russian clientele, as suggested by their default language settings in Russian and information on banking services for fiat transactions provided by sanctioned Russian banks, such as Sberbank.

Connectivity to sanctioned Russian banks

Many of the 47 no KYC exchanges were Russian-language platforms offering fiat-to-crypto and crypto-to-crypto instant exchange services. As we covered in our recent analysis of Russia’s new cryptocurrency legislation, Russian-language instant exchangers can be exploited to quickly move fiat currency from sanctioned Russian banks to specified crypto wallets, enabling entities to evade sanctions. Given the dramatically increased sanctions pressure on Russian banks following the full-scale invasion of Ukraine in February 2022, instant exchangers have emerged as a convenient way to on- or off-ramp funds for sanctioned banks. Of the 47 no KYC exchanges targeted in Operation Final Exchange, all that we have identified on-chain accepted on- and off-ramping with sanctioned Russian banks.

Breadth of disruption likely to generate actionable inroads

Most of the exchanges targeted by BKA have been active since 2021 or before, and the top three in terms of transactions processed – Xchange.cash, 60cek.org, and Bankcomat.com – have been active since 2016 or before, according to the Operation Final Exchange landing page. The longevity of these services suggests a substantial portion of customers affected will need to establish alternative financial facilitation and laundering pathways.

The disruption’s impact is likely to extend far beyond the no KYC exchanges targeted. As the BKA stated, it is now in possession of these exchanges’ development, production, and backup servers, as well as transactional details, registration data, and IP addresses. This data will likely be instrumental in generating follow-on leads for the BKA and key international law enforcement partners in the months to come. We continue to track this phenomenon closely and will flag new no KYC exchanges that emerge as key players in this space.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.

Related Topics:Germany No KYC Exchange Russia Sanctions

Click to comment

Crypto

Bitcoin Futures Hit $42.6B Across 11 Exchanges — Here Is What Open Interest Signals for June

Published

7 hours ago

May 31, 2026

Press Room

Bitcoin Futures Hit .6B Across 11 Exchanges — Here Is What Open Interest Signals for June

Key Takeaways

Futures Open Interest Across Exchanges

Total exchange BTC futures open interest stands at roughly $42.6 billion, down sharply from the $90 billion-plus peak reached in early October 2025 when bitcoin traded a hair above $126,000.

Binance leads all venues with 141,100 BTC ($10.40 billion) in futures open interest, accounting for 19.14% of the market, coinglass.com logs show. CME Group holds second position at 102,330 BTC ($7.55 billion), or 13.88% of the total, signaling that institutional participation through regulated futures remains significant even as spot prices have pulled back.

Bitcoin futures open interest as of this weekend on May 31, 2026, via Coinglass.

Gate holds 65,620 BTC ($4.84 billion, 8.9%), Bybit carries 63,860 BTC ($4.71 billion, 8.66%), and MEXC shows 75,980 BTC ($5.60 billion, 10.3%). OKX sits at 44,310 BTC ($3.27 billion, 6%), while the decentralized perps exchange Hyperliquid holds 29,730 BTC ($2.19 billion, 4.03%).

24-hour OI changes worth noting:

Bybit dropped 0.69% over 24 hours, the most of any top exchange
BingX fell 44.18% in 24-hour OI, a significant flush
Gate gained 2.08%, and OKX added 0.63%

The OI-to-24-hour volume ratio for Kucoin reads 9.57, the highest on the tape today, which points to relatively thin volume against its open position stack.

Bitcoin funding rates all exchanges on Sunday morning. — Bitcoin funding rates on all exchanges via Cryptoquant on May 31, 2026.

Bitcoin Options Open Interest

Total BTC options open interest sits near $40 billion, per Coinglass data, a steep pullback from the $65 billion-plus highs logged in late November 2025.

Calls dominate at 59.25% of total options OI, representing 248,395 BTC. Puts account for 40.75%, or 170,837 BTC. A 59/41 split favors upside positioning but is not an extreme imbalance. Twenty-four-hour volume is similarly skewed, with calls at 53.27% (9,120 BTC) against puts at 46.73% (8,000 BTC).

Top Open Interest Contracts on Deribit

The single largest open interest position on Deribit is a bet that bitcoin hits $120,000 by December 2026, with 7,089.4 BTC tied to that contract. Some predictions are aligned with this perspective. The second largest is a protective position sized for a drop to $60,000 by that same date, carrying 6,509.4 BTC, which tells you that not everyone is positioned for a year-end rally.

Two other notable positions sit closer in. Traders hold 5,769.4 BTC on a contract that pays out if bitcoin reaches $80,000 by July 31, 2026, and another 5,657.5 BTC on a contract targeting $90,000 by June 26. Both suggest a cluster of bullish bets aimed at levels well above the current spot before summer ends.

CME Options: Puts Still Running Heavy

Cryptoquant data on CME options OI stacked by position shows puts consistently outpacing calls since late November 2025, even as BTC’s price has begun recovering from its February 2026 lows near $65,000. That put-heavy posture among CME participants, who tend to be institutional hedgers and asset managers, reflects caution at current price levels rather than conviction in a near-term breakout.

CME’s stacked-by-expiration logs show near-term (1 to 2 months) contracts dominating the current structure, with very limited longer-dated OI compared to the October and November 2025 buildup period.

Max Pain: Deribit, Binance, OKX

Deribit max pain for the June 26, 2026, expiry sits near $77,500 to $78,000, with notional value for that date approaching $9 billion. The furthest-dated expiry shown, March 2027, shows max pain collapsing to roughly $70,000, which would represent a roughly 4.9% move lower from the current price.

Binance max pain for June 26 hits around $85,000, well above spot, with notional value for that date reaching approximately $757 million. The curve climbs from $74,000 near-term to a peak near $85,000 before easing back toward $77,500 for later expirations.

OKX max pain tells a different story. The curve runs relatively flat near $74,000 through June 12 before climbing to approximately $78,000 by late June 26. It then holds between $75,500 and $78,000 through late 2026, before jumping sharply to near $80,500 by March 2027, the highest of the three exchanges for far-dated max pain.

Max pain theory holds that option sellers, who represent the majority of options market makers, benefit most when the underlying asset expires at the price where the maximum number of contracts finish worthless. With BTC spot at $73,600, the majority of max pain levels across all three exchanges sit above the current price for the June 26 expiry, which some traders read as gravity pulling the price higher going into that settlement.

What Traders Are Watching

The June 26 expiry is the largest single settlement date by notional value across Deribit, Binance, and OKX. Deribit alone shows roughly $8.5 billion in notional value tied to that date. How the price behaves in the days leading up to that expiry could determine whether the bulk of open call positions expire in the money or turn to dust.

CME futures OI remains near $7.55 billion despite the broad decline in total market OI since late 2025, suggesting institutional desks have not walked away from bitcoin exposure. The put-heavy positioning on CME may reflect hedged long strategies rather than outright bearish bets.

Youtuber Warns Bitcoin Bottom Is Not In as Stablecoin Dominance Hits Risk-off Level

Bitcoin traded near $73,840 on May 31, 2026, stuck in a narrow band between $73,412 and $74,110 as technical indicators…

Youtuber Warns Bitcoin Bottom Is Not In as Stablecoin Dominance Hits Risk-off Level

Bitcoin traded near $73,840 on May 31, 2026, stuck in a narrow band between $73,412 and $74,110 as technical indicators…

Youtuber Warns Bitcoin Bottom Is Not In as Stablecoin Dominance Hits Risk-off Level

Bitcoin traded near $73,840 on May 31, 2026, stuck in a narrow band between $73,412 and $74,110 as technical indicators…

Crypto

Americanfortress Links Stealth Addresses to Arbitrum as DeFi Firms Watch Compliance

Published

18 hours ago

May 31, 2026

Press Room

Americanfortress Links Stealth Addresses to Arbitrum as DeFi Firms Watch Compliance

Key Takeaways

Solving the Privacy Challenge for Institutional DeFi

Americanfortress has launched the beta version of its compliant privacy infrastructure on Arbitrum, introducing tools designed to support institutional and high- volume decentralized finance ( DeFi) activity on the Layer 2 network. The system enables users to send assets using human-readable names while automatically generating stealth addresses that shield recipient information onchain.

The company said the design preserves auditability between counterparties without relying on mixers or custodial transaction-obfuscation services. Arbitrum secures more than $15 billion in total value locked and hosts major DeFi trading ecosystems, including GMX. As institutional activity increases, firms have raised concerns about transaction visibility and wallet transparency in public blockchain environments.

“Financial infrastructure cannot scale institutionally if every transaction exposes counterparties, balances and trading behavior in real time,” said Michal Pospieszalski, CEO and CTO of Americanfortress. “Arbitrum has become one of the most important execution environments in crypto markets, and this implementation delivers a privacy layer designed for serious financial activity without relying on mixers or compromising compliance requirements.”

The beta introduces send-to-name functionality, allowing users to transact via Fortressnames rather than exposing wallet addresses. Americanfortress said the system is compatible with existing blockchain infrastructure and reduces visibility that can contribute to front-running and trade surveillance.

The launch follows new cryptographic research from the company outlining a patent-pending post-quantum security architecture for hierarchical deterministic wallets. Americanfortress said its broader stack integrates privacy-preserving transactions, naming infrastructure, and quantum-resistant wallet security into a unified framework for digital asset custody and settlement.

As part of the rollout, the firm is launching a “Receive on Arbitrum Privately” campaign encouraging users to test private receiving features through the beta wallet. The first 500 eligible participants will receive a lifetime FortressName. The campaign will target Arbitrum-native DeFi communities, including perpetual traders, liquidity providers and active onchain market participants.

“Privacy and usability are increasingly important as more sophisticated financial activity moves onchain,” said Chase Allred, senior partnerships manager at Offchain, the service provider for Arbitrum. “Infrastructure that improves operational security while remaining compatible with compliant blockchain ecosystems represents an important area of development for the wider industry.”

Americanfortress said the system is designed to support emerging automated financial workflows, including AI-driven agents transacting autonomously onchain. The company expects privacy-preserving execution environments to become increasingly necessary as algorithmic capital allocation and machine-driven trading expand across decentralized networks.

Crypto

What is a ‘wrench attack,’ and why are they on the rise globally?

Published

1 day ago

May 30, 2026

Press Room

What is a ‘wrench attack,’ and why are they on the rise globally?

(NewsNation) – A type of criminal activity known as “wrench attacks,” in which robbers physically coerce people into handing over their cryptocurrency holdings, is on the rise, according to crypto security firm CertiK.

Nik Seetharaman, the CEO of cyberdefense company Wraith Watch, recently told Nexstar’s NewsNation that he believes the increase in wrench attacks can be partly attributed to people flaunting their wealth online, which he noted makes it easier for criminals to identify and track down people with a lot of money.

“In the crypto community especially, you have this culture of, you know, flaunting your assets and … posting pictures of yourself in (places like) Ibiza and Bali,” Seetharaman explained.

He also pointed to improvements in digital security that make it so criminals “have no option but to basically hold you at gunpoint and say, ‘Enter your password into this phone right now or bad things are going to happen to you or your family.’”

NewsNation local affiliate KTLA reported that experts also say the decentralized nature of cryptocurrencies and the ability to transfer large sums in irreversible transactions make large account holders vulnerable to bad actors.

How big an issue are wrench attacks?

The name “wrench attacks” was popularized by an online comic that mocked how easily high-tech security can be undone by hitting someone with a wrench until they give up passwords, according to The Associated Press.

CertiK released a report in May detailing global instances of wrench attacks, which showed that between January and April 2026, it identified 43 incidents resulting in victims losing more than $101 million in cryptocurrency.

The firm said those incidents represent a 41% increase over the same period last year, and if the rate continues, “2026 will close with approximately 130 incidents and several hundred million dollars in losses.”

In 2025, CertiK tracked only 81 attacks that resulted in victims losing approximately $52 million, further indicating that wrench attacks are a growing issue.

Wealthy California crypto holders targeted in recent attacks

In November 2025, a San Francisco man was robbed of $13 million in digital currency after thieves posing as pizza delivery drivers forced their way into his home, bound him with duct tape, beat him with a firearm and threatened to cut off his fingers, KTLA reported, citing The San Francisco Chronicle.

Three attempted wrench attacks in Sunnyvale, San Jose and Los Angeles that occurred in the days and weeks following the San Francisco home invasion appear to be linked.

Potential wrench attack in Nancy Guthrie case?

NewsNation contributor and former FBI Special Agent Jennifer Coffindaffer believes Nancy Guthrie, the mother of “Today” host Savannah Guthrie, who has been missing for more than 100 days, could have been the victim of a wrench attack.

Coffindaffer wrote on X Tuesday that she has been “speaking about a Wrench Attack that took place literally about 90 minutes North of Nancy’s house the day before Nancy was attacked since early March.”

Guthrie was last seen at her home on Jan. 31 in Pima County, near Tucson, Arizona. She is believed to have been abducted, and investigators are scrutinizing messages that have been sent to media outlets, possibly from kidnappers, at least one of which made a bitcoin ransom demand.

Separately, TMZ received a series of communications from a person claiming to know who the kidnapper is, and that individual has demanded a $100,000 cryptocurrency payment.

NewsNation local affiliate KTLA, NewsNation’s Sean Noone and The Associated Press contributed to this report.