- Blockchain forensics exposed a $600M Bitcoin network used by Russia’s FSB and GRU to fund spies, propaganda, and covert European activity.
- A 17-year-old recruit received crypto from Russian agents before confessing in Poland—his payments traced to intelligence-linked wallets.
- Russian handlers use crypto flow auditing to control agent expenses, with funding traced to sanctioned exchanges like Garantex and its alias Grinex.
Russian intelligence agencies have been using Bitcoin to secretly fund covert operations across Europe, according to a joint investigation by Reuters, Global Ledger, and Recoveris. The report reveals that both the Federal Security Service (FSB) and military intelligence agency GRU have turned to cryptocurrency to recruit and pay teenage operatives, finance mercenaries, and bribe politicians.
Teenage Recruits and Traced Bitcoin Transactions
The investigation outlined the case of Laken Pavan, a 17-year-old Canadian who became involved with Russian intelligence in 2024 after traveling to Donetsk to volunteer for the pro-Russian Interbrigades. Upon arrival, he was detained and coerced into spying for the FSB. Agents assigned him a handler, known only as “Slon,” and instructed him to collect intelligence while traveling through Europe.
Pavan later received a Bitcoin payment worth just over $500 while in Copenhagen. On May 22, a day after the transaction, he turned himself in to Polish authorities in Warsaw. His sentencing in December 2024 marked the end of his brief role as a Russian asset.
Blockchain analytics firms traced the $500 in Bitcoin from Slon through two intermediary wallets. Both wallets had connections to a larger address created in June 2022. Global Ledger and Recoveris found that the larger wallet had processed $600 million worth of Bitcoin and showed transactional activity consistent with Moscow business hours.
“Transactions from wallets linked to the FSB followed a structured laundering pattern, involving fund splitting, mixing with larger sums, and routing through unconnected deposit wallets,” Global Ledger stated in its report.
The wallet was also found to have sent funds to the sanctioned Russian exchange Garantex, which has been linked to a new entity called Grinex. According to TRM Labs and earlier findings by Global Ledger, Garantex may have rebranded as Grinex after being shut down by enforcement agencies earlier this year.
Covert Funding for Mercenaries and Political Influence
Further details from Recoveris show that crypto-funded espionage is not limited to a single case. The firm has recorded repeated uses of cryptocurrency by the GRU and FSB in Poland. “This method has been uncovered on multiple occasions,” said Recoveris CEO Marcin Zarakowski. He cited one example from 2023 where young Belarusians and Ukrainians were paid to install surveillance equipment and distribute political propaganda.
Zarakowski also revealed, “From the ongoing Recoveris intelligence, we can see that GRU/FSB wallets are active on a regular basis.” One wallet, identified as FSB-related, belongs to a cluster of 161 addresses with almost all activity occurring between 6 a.m. and 6 p.m. Moscow time.
In addition to recruiting operatives, Russia has used cryptocurrency to finance fighters in the Donbas region and to influence European politicians. Zarakowski added, “Handlers and higher-ranked intelligence officers can monitor crypto flow. Anything spent by agents can be audited to ensure it is being spent on operational purposes.”
As sanctions on Russia remain in place, analysts suggest the country’s intelligence services will likely continue relying on cryptocurrencies to fund their international networks discreetly.
