Crypto
Missing Cryptoqueen Ruja Ignatova’s links to Bulgaria underworld
BBC Eye Investigations, Panorama team and The Missing Cryptoqueen podcast,BBC World Service and BBC News
ShutterstockNow we have gone on her trail to try to discover her fate. BBC Eye Investigations and Panorama have looked at her close ties to a suspected Bulgarian organised crime boss and allegations she was brutally murdered. Did Ms Ignatova enjoy the stolen billions or was she killed by the very people paid to protect her?
Oxford University graduate Ruja Ignatova was born in Bulgaria and raised in Germany, pursuing a successful career in finance before launching the cryptocurrency OneCoin in 2014.
Ms Ignatova convinced millions of people around the world to invest in OneCoin, promising to eclipse the kind of huge returns seen by early Bitcoin investors.
But in reality, Ms Ignatova – known to many as Dr Ruja – had created a cleverly-disguised investment fraud, without the digital record that underlies legitimate cryptocurrencies like Bitcoin.
As investigators from Germany and the US closed in on Ms Ignatova in October 2017, she took an early morning Ryanair flight from Sofia to Athens, never to be seen again.
For the past year, BBC World Service’s Eye Investigations and Panorama have been trying to find out more about what happened to her, and whether she is even alive.
Key to this was establishing who her inner circle was.
Richard Reinhardt, who began the investigation into OneCoin for the US Internal Revenue Service alongside the FBI, told the BBC about a key character investigators have never publicly named before.
The Missing Cryptoqueen: Dead or Alive?
CEO of fake cryptocurrency OneCoin, Ruja Ignatova, is the FBI’s most wanted woman. She stole billions, then vanished. New evidence reveals what may have happened. Is she missing or was she murdered?
Watch now on BBC iPlayer (UK only) or on BBC One at 20:00 on Monday 3 June (22:40 in Wales). Outside of the UK, watch on YouTube
Or listen to The Missing Cryptoqueen on BBC Sounds
The BBC understands it is the man who had been given the role of keeping Ms Ignatova safe – Hristoforos Nikos Amanatidis, commonly known as Taki.
“We were told, allegedly a big-time drug guy was in charge of her physical security,” Mr Reinhardt told us in his first interview since retiring in late 2023.
“Taki came up more than once, it wasn’t like it was a one-off. That was a recurring theme.”
This chimed with the information we already had – US government lawyers had said in 2019 that Ms Ignatova’s head of security was a major organised crime figure in Bulgaria but hadn’t named him.
“We do have evidence that a very significant, if not the most prolific, drug trafficker of all time in Bulgaria, was closely linked to OneCoin – served as [Ruja Ignatova’s] personal security guard,” an assistant attorney said.
This was the same “head of security” a different US government lawyer said was “involved in the disappearance” of Ms Ignatova in court a day earlier.
According to Mr Reinhardt, Ms Ignatova was a far more sophisticated criminal than most people realise.
“This is like a white-collar criminal combined with a drug trafficker or mafia guy on steroids.”
This theory appears to be supported by leaked Europol documents, seen by the BBC, which show that – before Ms Ignatova disappeared in 2017 – Bulgarian police had established connections between her and Taki.
In the documents, police suspect Taki of using OneCoin’s financial network to launder the proceeds of drug trafficking.
In his native Bulgaria, Taki has an almost mythical status – an El Chapo or Pablo Escobar. He is widely suspected of being the head of a Bulgarian organised crime organisation and a prolific drug smuggler. He and his associates have been investigated there for armed robbery, drug smuggling and murder, but he has never been successfully prosecuted for anything.
Interpol“When we talk about Taki, he’s the head of the mafia in Bulgaria. He’s extremely powerful,” says a former Bulgarian deputy minister, Ivan Hristanov, who in 2022 investigated allegations Taki ran a criminal network with the help of corrupt officials – and believes that was the case.
“Taki is the ghost. You’ll never see him. You only hear about him. He’s talking to you through other people. If you don’t listen, you just disappear from earth.”
“The only person who can protect her [Ignatova] from all those investigations, including from foreign agencies – it was Taki.”
The BBC wrote to the Bulgarian government about the allegations regarding corrupt officials. It did not respond. The prosecutor’s office in the capital Sofia says it “does not cover up crimes and persons who have possibly committed crimes”.
Taki is now believed to live in Dubai, where Ms Ignatova bought a luxury penthouse and where her bank accounts received tens of millions of dollars from the OneCoin fraud.
While it’s not known how Taki and Ms Ignatova met, or whether he was involved with OneCoin from the start, multiple sources say they had a close personal relationship and that he was the godfather to her daughter.
One Bulgarian source close to Ms Ignatova told the BBC she may have paid Taki up to €100,000 a month for protection
There appear to be other financial ties between Ms Ignatova and Taki.
The Europol documents mention a complex deal to sell a plot of land, on Bulgaria’s Black Sea coast, that links one of Ms Ignatova’s companies to Taki’s wife.
The secret police documents were passed to the BBC by Frank Schneider, a former spy and adviser to Ms Ignatova who has since disappeared.
He told us that his old boss was working with “crooks” and “gangsters”.
When we interviewed Mr Schneider at his home in France, he was under house arrest, awaiting extradition to the US in connection to the OneCoin scam. He was not, however, prepared to reveal names.
“I’m not going to tell you who, because I have a family… This is real serious organised crime.”
But in the end, Ms Ignatova’s protector may have turned aggressor.
In 2022, Bulgarian investigative journalist Dimitar Stoyanov and his colleagues at the investigative news outlet bird.bg were handed a police report that had been found at the home of a murdered Bulgarian police officer.
In the document, a police informant details overhearing Taki’s brother-in-law drunkenly saying Ms Ignatova had been murdered on Taki’s orders in late 2018, and her body dismembered and dumped off a yacht in the Ionian Sea. Mr Stoyanov says this account is “very, very possible”.
The authenticity of the police document was confirmed by Bulgarian officials, and multiple criminal associates of Taki believe the theory he had her murdered to be true, Mr Stoyanov says.
However, the BBC has been unable to independently verify the claim.
The associates’ rationale being that the wanted Ms Ignatova became a liability to Taki, who wished to eliminate his links to the OneCoin fraud.
Those associates include Krasimir Kamenov, known as Kuro, wanted by Interpol on murder charges.
Mr Stoyanov says Kuro told him he had heard Taki discussing his criminal business in front of Ms Ignatova, and when Kuro had challenged Taki on whether he should be doing that, Taki had answered: “Don’t worry, she’s as good as dead.”
Kuro had also claimed to have talked to the CIA about Taki, including about the allegation that Taki had ordered Ms Ignatova’s murder. Sources close to Kuro confirmed to the BBC that this meeting took place in late 2022.
In May 2023, Kuro was assassinated in his Cape Town home, along with his wife and two others who worked for him. South African police are still searching for the killers, but Bulgarian former deputy minister Hristanov believes Kuro’s murder is linked to Taki.
“Certain people had to be removed because they knew too much about Taki.
“It was kind of a public execution that looked more like a statement. Be careful who you deal with,” he told us.
Since publishing allegations of Ms Ignatova’s murder, journalist Dimitar Stoyanov says he and his colleagues have faced death threats, forcing him to temporarily leave Bulgaria for the fourth time in his career.
Mr Stoyanov doesn’t claim to know a motive for any alleged murder, but property records show, and eyewitnesses have told him, that since her disappearance, a number of her Bulgarian properties are now being used by people connected to Taki.
Taki has never been arrested over claims he had Ms Ignatova murdered. Her body has never been found and investigators say they don’t have enough evidence to prosecute him.
But former IRS investigator Richard Reinhardt thinks Ms Ignatova is likely to be dead. Although he has not seen any evidence linking her death to Taki, he says it fits with how drugs cartels operate.
“There’s no honour among thieves… knowing how violent cartels are, if [Taki] thought she was a threat to him… he would probably take her out instead of getting caught.”
The BBC wrote to Taki’s lawyers about the allegations in this investigation – they didn’t respond.
In 2022, Ms Ignatova was placed on the FBI’s Ten Most Wanted list – where she remains today.
The BBC team behind The Missing Cryptoqueen podcast has received various sightings and tip-offs about Ms Ignatova’s whereabouts after her alleged murder took place – including details of an unsuccessful police operation in Greece to catch her in 2022.
It could be that rumours of her death are just another brilliant manoeuvre to throw everyone off the scent.
If that is the case, as the years go by, it is likely to become increasingly difficult for her to stay on the run.
“At some point it becomes like Elvis Presley might be still alive… It’s not really very likely,” says Mr Hristanov.
According to Mr Reinhardt, the FBI “don’t just keep people in [the] Top Ten list for fun”. But they would only remove someone if there was “definitive proof” they were dead. And given the circumstances, with Ruja Ignatova there may never be.
And that means, for now at least, the missing Cryptoqueen remains a hunted woman.
Key Takeaways
- Zcash targets July 21, 2026 for Ironwood mainnet activation after sealing the Orchard pool.
- ZEC trades at $462.33 on July 4, up 13.3% in seven days and over 1,000% in a year.
- Node operators must migrate to Zebra or updated clients before Ironwood’s mainnet launch.
The upgrade traces back to a discovery on May 29. Security researcher Taylor Hornby, working under contract for Shielded Labs, found a soundness flaw inside the Orchard shielded pool’s elliptic curve code. The bug lived in a piece of the halo2_gadgets crate handling point multiplication. A prover could swap in the wrong base point and still get the circuit to accept an invalid proof.
That flaw mattered because Orchard hides sender, receiver and amount by design. A counterfeit note created inside the pool would look identical to a real one. The bug had sat in the code since Orchard went live in May 2022 as part of the NU5 upgrade.
Rapid Patch, No Confirmed Losses
Zcash’s core engineers, including Daira-Emma Hopwood, Kris Nuttycombe and Jack Grigg, confirmed the issue within hours of Hornby’s report. A soft fork disabled new Orchard actions around June 1 to contain exposure. A hard fork, NU6.2, followed on June 3 with a corrected verifying key, restoring full Orchard functionality.
Orchard transactions paused for roughly a day during the rollout. Transparent and Sapling transfers kept running the whole time. Zcash Open Development Lab and Shielded Labs both say they found no evidence that the bug was ever exploited, and the network’s turnstile accounting, which tracks value entering and leaving each pool, showed no signs of unauthorized minting.
There’s a catch developers can’t patch away. Orchard’s privacy means nobody can prove a negative. No cryptographic method exists to confirm counterfeiting never happened, only that it probably didn’t.
Ironwood Closes the Gap
Announced June 6, Ironwood is the fix for that remaining uncertainty. It ships as NU6.3 and was built by ZODL alongside Tachyon, Valar Group, the Zcash Foundation and Shielded Labs.
The upgrade opens a new Ironwood shielded pool built on the patched Orchard circuit, now backed by ongoing formal verification and added independent audits. At the same time, the old Orchard pool gets sealed. Wallets will block new deposits into it, internal transfers between users inside the pool get disabled, and funds can only leave through the turnstile toward Ironwood or a transparent address.
That sealing is the actual fix. Once the legacy pool stops taking new value and stops circulating internally, any theoretical counterfeit notes get boxed in. Anyone running a full node can then add up balances across the active pools and confirm the total supply lines up with what the protocol allows, without waiting on developer assurances or a full migration.
Ironwood also carries ZIP 2005, a set of note format changes meant to support recovery in a future quantum computing scenario. It doesn’t make Zcash quantum-secure today, but it lays the groundwork for a smoother transition later.
Timeline and What Users Need to Do
Testnet activation for Ironwood landed around July 3 and 4. Zebra, the Rust client maintained by the Zcash Foundation, and Valar Group’s independent implementation are both running release candidates against it.
Mainnet activation is targeted for around July 21, tied to a zcashd end-of-support block. Developers say hashrate signaling looks ready, and existing testnet time gives wallets enough runway, so a delay isn’t currently on the table.
Node operators on older zcashd builds will need to move to Zebra or an updated client before that date. Wallets are expected to prompt users to migrate shielded funds out of the old Orchard pool with minimal friction, often a single approval.
Market Response
ZEC’s price tells its own story of the past six weeks. The token fell more than 50% from around $630 down to the $250 to $300 range once the vulnerability became public, then rebounded sharply once the patch and Ironwood plan landed.
As of July 4, ZEC trades at $462.33, up 13.3% over the past seven days, even after a flat 24-hour session. Zooming out, the coin is up more than 1,000% over the past year, a stretch that includes both a run to a 52-week high near $744 in November 2025 and the Orchard scare in late May.
Investor Chamath Palihapitiya has publicly flagged Ironwood’s supply verification model as a meaningful step for the coin, adding outside attention to what started as a bug fix.
For now, the work left is coordination. Formal verification results are due before mainnet, and wallet, exchange, and infrastructure providers still need to ship updated support in the next two and a half weeks.
US President Donald Trump has made $US1.4 billion ($2b) from cryptocurrency in the past 12 months.
$US635 million came from celebration coins royalties and $US236m came from cryptocurrency “token sales”, while the rest of his income came from assorted cryptocurrency wallets.
His celebration coin income is linked to meme coins he launched before returning to office, namely $TRUMP.
But what are meme coins and has anyone other than the Trump family profited?
Meme coins
Cryptocurrencies are a type of digital asset, not unlike a stock, which can be used as an exchangeable form of money online.
Much like paper currencies since the gold standard was ended, crypto has value because investors collectively agree it does, in part due to its security and scarcity.
Meme coins on the other hand are a bit harder to pin down.
“Meme coins are cryptocurrencies that leverage popular memes or internet trends to create a community-driven, often playful approach to digital currency,” according to crypto broker Blockchain.com.
Meme coins have no inherent value and, unlike Bitcoin, have varying limits of scarcity, rendering the price of any coin vulnerable to the rise and fall in popularity of whatever meme or trend inspired the item.
As an example Hailey Welch, an American woman, launched her own brand of meme coin after she rose to internet fame in June 2024.
The $HAWK coin released in December 2024 reached a market capitalisation of $500m before it crashed to $25m by late January.
Investors have since sued $HAWK.
The $TRUMP coin
The $TRUMP coin is valued at $US1.65 as of July 1, 2026. (Supplied: GetTrumpMemes.com)
Mr Trump’s own meme coin $TRUMP launched days before his second inauguration, also in January 2025.
At its peak it sold for almost $US75 a coin, but by the end of February its value had plummeted to about $US20 and as of July 1, 2026 its value sits at $US1.65.
This is where the bulk of Mr Trump’s $US635m in royalties and $US236m in token sales are believed to have come from.
In April 2026, Democratic Senator for California Adam Schiff said he and other senators would be investigating a Mar-a-Lago conference which invited the top 297 $TRUMP token holders to attend and offered VIP access to Mr Trump.
In a statement he said CIC Digital and Fight Fight Fight LLC, which controlled 80 per cent of $TRUMP supply, received trading revenue from all $TRUMP activity.
“The announcement of the conference ‘set off a quick but brief run-up in the price of the $TRUMP meme coin, which reached $3.08 before tumbling back down,’” the senators highlighted.
“President Trump financially benefits from the market value and activity of the $TRUMP cryptocurrency.“
Mr Schiff and his fellow senators asserted “not all” investors of $TRUMP and the similarly branded first ladies meme coin, $MELANIA, benefited from their investment.
“According to recent reports, $TRUMP, and the First Lady’s meme coin, $MELANIA, “erased an estimated $4.3 billion in retail wealth,” they said.
“Insiders, however, reportedly made a fortune: 45 ‘early-deployment wallets’ earned $1.2 billion off the meme coins, meaning that for every dollar insiders earned, retail investors lost $20.”
World Liberty Financial, another Trump family-linked business which distributed Mr Trump’s royalty and token sale revenue, provided him with an additional $65m in income.
Eric Trump and Donald Trump Jr are involved in its management and it was co-founded by Zach Witkoff, the son of Mr Trump’s special envoy to the Middle East Steve Witkoff.
Donald Trump Jr and Eric Trump with Zach Witkoff. (Reuters: Eduardo Munoz)
Mr Trump’s $236m in token sale revenue is a marked leap in profits collected compared to Mr Trump’s 2025 disclosure which only reported $US57m from token sales.
World Liberty Financial launched another cryptocurrency in May, 2025 called USD1.
USD1 rose to US$1.016 after launch and is now valued at $U0.99.
It was also used to pay bonuses to UFC fighters performing at the White House in June.
On July 1, after his disclosure came out, Mr Trump said his wealth was the result of the US stock market’s success.
“”You know why I’m profiting? Because the stock market’s going up, everybody’s profiting,” Mr Trump said, according to Reuters.
Key Takeaways
- OKX launched a 20 USDT airdrop for earthquake victims, easing the financial burden on affected residents.
- Eligible La Guaira residents receive automatic credits, providing immediate crisis relief without hurdles.
- Following Binance’s $3M pledge, OKX’s move amplifies the role of crypto in global disaster relief efforts.
OKX Opens Airdrop for Venezuelan Earthquake Victims
OKX, one of the largest cryptocurrency exchanges by volume, has taken action to help Venezuelan users affected by the twin earthquakes that left over 2,000 dead and hundreds of buildings collapsed.
On social media, using its Latam account, OKX referred to the twin earthquakes that hit Venezuela on June 24, 2026, and how the cryptocurrency community has responded to this event in one of the Latam countries with growing crypto adoption.
“We know that these days have been difficult. But we have also seen something extraordinary: the solidarity of Venezuela and the entire international community, which fills us with hope,” it declared.
To help Venezuelan users in regions hit by the natural disaster, OKX announced it will distribute 20 USDT to each user with proof of address (POA) verifying they reside in La Guaira, the state most affected by the twin earthquakes.
While OKX did not disclose the total funds available for this initiative, it pointed out that support was limited and would be distributed on a “first-come, first-served” basis.
The funds will be automatically credited to the accounts that fulfill the POA requirement. “No registration, claim code, or qualifying transaction is required; the 20 USDT reward is automatically credited once eligibility is confirmed,” the exchange explained.
“We know that the road ahead will require effort, help, and support from everyone for a long time. But you will not walk it alone. We are one region, and we will be with you on this journey. We stand with you, Venezuela.” OKX concluded.
OKX’s relief efforts follow a similar campaign by Binance. The most popular exchange in Venezuela pledged $3 million to users residing in La Guaira, Distrito Capital, Miranda, Aragua, Carabobo, Falcón, and Yaracuy, offering a similar path for users to reclaim 20 USDT via redeemable vouchers.
-
Arkansas3 minutes agoWhy Unheralded CJ Brown Could Be Arkansas’ Answer at WR1
-
Colorado13 minutes agoMost Expensive Colorado Buffaloes Road Tickets This Fall
-
Connecticut18 minutes agoBushnell Carousel offers free rides as Hartford celebrates America’s 250th
-
Delaware25 minutes agoHeavy rain, lightning may dampen July 4th fireworks shows in Delaware
-
Florida27 minutes agoMotorcyclist killed in crash in Fort Lauderdale
-
Georgia33 minutes agoGeorgia football predicted to be dethroned in SEC championship
-
Idaho38 minutes agoFireworks blamed for 2 Ammon brush fires that threatened homes – East Idaho News
-
Hawaii40 minutes agoLa Hoihoi Ea highlights Native Hawaiian perspective amid 4th of July celebrations
