Russian Intelligence Agencies Use Bitcoin for European Operations

Russian intelligence agencies, the Federal Security Service (FSB) and the military intelligence agency GRU, have been utilizing Bitcoin to covertly fund a variety of operations across Europe. These operations include recruiting and paying teenage operatives, financing mercenaries, and bribing politicians. The use of cryptocurrency allows these agencies to operate with a higher degree of anonymity and evade traditional financial monitoring systems.

One notable case involves a 17-year-old Canadian named Laken Pavan, who was recruited by Russian intelligence in 2024. Pavan traveled to Donetsk to volunteer for the pro-Russian Interbrigades and was subsequently detained and coerced into spying for the FSB. He was assigned a handler known as “Slon” and instructed to collect intelligence while traveling through Europe. Pavan received a Bitcoin payment worth just over $500 while in Copenhagen and turned himself in to Polish authorities the following day. His sentencing in December 2024 marked the end of his brief involvement with Russian intelligence.

Blockchain analytics firms traced the $500 in Bitcoin from Slon through two intermediary wallets, both of which had connections to a larger address created in June 2022. This larger wallet had processed $600 million worth of Bitcoin and showed transactional activity consistent with Moscow business hours. The transactions from wallets linked to the FSB followed a structured laundering pattern, involving fund splitting, mixing with larger sums, and routing through unconnected deposit wallets.

The wallet was also found to have sent funds to the sanctioned Russian exchange Garantex, which has been linked to a new entity called Grinex. Garantex may have rebranded as Grinex after being shut down by enforcement agencies earlier this year. This indicates that Russian intelligence agencies are adapting their methods to continue operating despite international sanctions and regulatory actions.

The use of cryptocurrency for espionage is not limited to a single case. Recoveris, a blockchain analytics firm, has recorded repeated uses of cryptocurrency by the GRU and FSB in Poland. In one example from 2023, young Belarusians and Ukrainians were paid to install surveillance equipment and distribute political propaganda. The firm's CEO, Marcin Zarakowski, noted that GRU/FSB wallets are active on a regular basis, with one wallet identified as FSB-related belonging to a cluster of 161 addresses with almost all activity occurring between 6 a.m. and 6 p.m. Moscow time.

In addition to recruiting operatives, Russia has used cryptocurrency to finance fighters in the Donbas region and to influence European politicians. Handlers and higher-ranked intelligence officers can monitor crypto flow, ensuring that anything spent by agents is being used for operational purposes. As sanctions on Russia remain in place, analysts suggest that the country’s intelligence services will likely continue relying on cryptocurrencies to fund their international networks discreetly.