Russia's FSB Pays Teen Spies in Bitcoin, $600 Million Wallet Linked

Russian intelligence services have been utilizing Bitcoin to compensate teenage and untrained spies, as revealed by an investigation conducted in partnership with blockchain analytics firms. The case of Laken Pavan, a Canadian national, highlights this practice. Pavan, who was 17 years old at the time, was recruited by the Russian Federal Security Service (FSB) in late April 2024 after traveling to Donetsk to volunteer for the pro-Russian Interbrigades. Pavan had become radicalized online over the course of 2023.

In Donetsk, FSB agents detained Pavan for several days, using threats to recruit him as a spy. He was then assigned a handler known only as ‘Slon’ (Russian for ‘elephant’). The FSB agents instructed Pavan to travel to various places in Europe, including Ukraine, to gather intelligence, which would be shared with Slon. From Donetsk, Pavan traveled to Istanbul and then to Copenhagen, where he received Bitcoin from Slon worth just over $500. On May 22, a day after receiving the Bitcoin payments, Pavan traveled to Warsaw, where he turned himself in to Polish authorities.

This marked the end of Pavan’s brief career as a Russian spy. However, blockchain analytics firms were able to trace the $500 in Bitcoin sent by Slon to two intermediary BTC wallets, which had received hundreds of thousands of dollars in BTC from a large address created in June 2022. The investigation revealed that transfers to and from the wallets occurred during Moscow business hours, and analysis showed that the largest wallet had processed BTC worth a total of $600 million. The largest wallet had also sent funds to a sanctioned Russian exchange, and it appears to be funded by a “major mining pool and custodial service.”

While the ownership of the large wallet and the two intermediary wallets could not be definitively identified, both firms lean towards the conclusion that it’s linked to the FSB. “Transactions from wallets linked to the FSB followed a structured laundering pattern, involving fund splitting, mixing with larger sums, and routing through unconnected deposit wallets,” the report explained.

This method of financing agents using cryptocurrency has been observed on multiple occasions. In 2023, a group of young Belarusians and Ukrainians based in Poland was found to be funded by the GRU in cryptocurrency. The young spies were tasked with installing cameras on a major train route from Poland to Ukraine, tagging city walls with political propaganda to increase divisions in Polish society, and publishing fake news. Since then, many other instances of GRU and FSB payments in cryptocurrency have been discovered in Poland, with some assets even being paid to commit arson.

Russia’s use of cryptocurrencies extends beyond financing spies. It also includes funding private mercenaries fighting in the Donbas region on the Russian side of the war in Ukraine, and paying off politicians in Europe to spread pro-Russian and anti-Ukraine messages. Given the extensive range of sanctions placed on Russia and Russian entities, it’s likely that the FSB and other agencies will continue using cryptocurrency for some time to come.

The advantage of using Bitcoin or cryptocurrency to pay agents or assets is that any amount of money in cryptocurrency can be moved instantly throughout the globe without any government barriers, except for the crypto-to-fiat gateway. Additionally, the Russian intelligence apparatus has plenty of use for the transparency afforded by cryptocurrencies. Handlers and higher-ranked intelligence officers can monitor crypto flow, and anything spent by agents can be audited to ensure it is being spent on operational purposes.