The Vinnik case: how to steal nine billion dollars

The disappeared bitcoins

This story began seven years ago: in March 2011, the Japanese company Tibanne Co., Ltd., owned by the French entrepreneur Mark Kapeles, bought the crypto-exchange Mt.Gox – one of the first Internet sites that traded bitcoin.

In June of the same year Mt.Gox underwent a hacker attack: an unknown burglar flooded the exchange system with false contracts to sell bitcoins “at any price”, knocking down the quotation of the crypto currency to one cent. After that, I bought the cue bottles at this price for a large sum.

A month later, on July 17, 2011, the first Russian-language crypto-exchange BTC-e was opened on the Internet.

Mt.Gox after the hacker attack significantly strengthened security measures, introducing, in particular, two-factor identification of customers. Thanks to this exchange, it was possible to restore the confidence of traders, and by spring of 2013, half of all transactions on buying and selling bitcoins passed through it, and the volume of trading in dollars exceeded 80 percent of the world turnover of crypto-currencies.

Then there were problems – constant delays with the withdrawal of dollars into the personal accounts of the clients of the exchange. Traders began feverishly buying up the bitcoins on Mt.Gox and transferring them to other crypto-exchanges to convert them to dollars and bring real money into their wallets. For crypto traders from Russia and the countries of the former USSR, the main channel for this was BTC-e.

Due to the massive flight of traders as early as July 2013, Mt.Gox lost the lead in trading volumes to its main competitor, Bitstamp. And by the end of the year, the market share of Mt.Gox fell to a modest ten percent.

Eventually, on February 7, 2014, Mt.Gox stopped working. Three weeks later, the crypto-exchange office filed an official bankruptcy petition, recognizing the loss of almost 850,000 bitcoins. Of these, 100 thousand belonged to Mt.Gox herself, the rest to her clients.

In late March of the same year, CEO of Mt.Gox Mark Karpeles accidentally discovered 200 thousand bitcoins on one of the frozen accounts. The remaining 650 thousand “cues” simply disappeared.

As Karpiles later stated in the Tokyo court, “technical problems in the platform opened up access for the illegal seizure of our clients’ money by intruders.”

“Give me clean money!”

Many clients of Mt.Gox were confident that Bitcoins were stolen by Mark Carpels himself. However, there were those who believed in the version of the unknown attackers. In particular, the Swedish programmer Kim Nilsson decided at all costs to find the perpetrators of the loss of money.

The possibility of a hacker attack existed, because bitcoin is based on the technology of the block, or the distributed registry, in which records of all transactions with crypto currency are stored on a variety of computers.

Analyzing the register of transactions on Mt.Gox, Nilsson found that the stock market was hacked back in the fall of 2011, that is, soon after the BTC-e was opened. Hackers took the keys to client wallets, as well as the addresses of bank deposits of the exchange itself and passwords to them.

For two years, hackers were stealing money from Mt.Gox, and as a result, by mid-2013, the exchange lost all its bitcoins – that is, eight months before the official announcement of bankruptcy.

It was then that delays in withdrawing funds began, as Mt.Gox was already operating on the principle of a financial pyramid: the exchange used deposits from new customers to pay off old ones.

Having established this, Nilsson continued to seek the answer to the main question – who stole the money of Mt.Gox clients. By early 2016, he had a suspect.

Tracking the transaction history, Nilsson realized that of the 650,000 bitcoins that had disappeared from the exchange, 630,000 were in purses controlled by one person hiding under the WME nickname.

Nilsson began combing online forums about bitcoin in search of a user with such a nickname. He was lucky – in the archives of one of the forums he came across an old message in which WME complained that the BTC-e had delayed transferring money to him. “Give me my NET MONEY!” – Requested WME.

Later, he even threatened the exchange with prosecution by publishing a letter from his personal lawyer.

And he made a fatal mistake, without covering his name and surname: Alexander Vinnik.

Nilsson immediately reported the finding to a special agent of the US Internal Revenue Service, Gary Alford, who specializes in tax crimes in the cryptomir.


By 2017, BTC-e has become the largest Russian-language platform for the purchase and sale of crypto-currencies. After six years of successful development, its daily turnover approached $ 70 million.

But on July 25, 2017 at 13:49 Moscow time, the stock exchange site ceased to function. After seven minutes on the official twitter-channel BTC-e published a post about carrying out unplanned works.

A couple of hours later, Reuters reported that in Russia, at the request of the US Justice Department, Russian Alexander Vinnik was arrested. The Americans called him the leader of a criminal organization engaged in money laundering through the crypto-exchange BTC-e.

Vinnik was charged with laundering money obtained by criminal means for the amount of “four to nine billion dollars.” It is in such amounts (depending on the current exchange rate) that 630 thousand bitcoins that were lost as a result of the crash of Mt.Gox are estimated.

In the theft of Bitcoins Mt.Gox Vinnik was not blamed. But experts are sure that he knows who and how he stole bitcoins for billions of dollars.

“I have no doubt that he, at least, knows where to send the laundered money,” – said Kim Nilsson to Fortune magazine.

Catherine Hawn, a former federal prosecutor, also confirmed to the publication that “Vinnik’s bitcoins obviously connect him with criminals.”

American investigators also suspect that Vinnik was among the co-founders of BTC-e and that this crypto-exchange was created specifically for the laundering of stolen bitcoins.

Only politics

Acquaintance with the underside of the crypto-currency world makes Alexander Vinnik the desired prey for law enforcement agencies of any country. It is not surprising that, along with the US, France sent the request for its extradition to the Greek authorities, arguing that the French citizens suffered from Vinnik’s actions.

Vinnik himself completely denies the accusations of the Americans and the French. But in May he sent to the Russian Prosecutor General’s Office a confession of fraudulent actions, as a result of which “an unspecified group of Russian citizens in the period from 2011 to 2017 caused material damage of 750 million rubles.” This allowed Russia to also demand the extradition of Vinnik.

Under Greek law, the final decision on the extradition of the offender is taken by the Minister of Justice. As an argument in favor of Russia, he will have a turnout with the guilt of Alexander Vinnik, sent to the Attorney General.

The American argument is the results of Nilsson’s investigation, based, in fact, on three points: the electronic wallets on Mt.Gox, owned by the person with the WME nickname, the entries on the user’s online forum with the same nickname where the lawyer Alexander Vinnik’s letter was published, and the phrase “return my clean money,” allegedly indicative of money laundering through BTC-e.

But the request of France, despite the weakness of the argumentation, is considered a priority because Greece and France are part of the EU zone. Although there can be no doubt that in the end the French will give Vinnik to the Americans.

Vinnik’s lawyer Timofei Musatov, told RIA Novosti that everything that is happening is a “joint special operation” between France and the United States in order to “get a head” of Alexander.

“Now we are talking only about how convincingly the political position of Russia will be transferred, so that the Minister of Justice, who was recently appointed to his post, decided in favor of Moscow,” Musatov said.

Leave a Reply

Your email address will not be published. Required fields are marked *