$2.7 billion in shadow dollars: How the WhiteBIT crypto exchange turned into a global "laundry"

What started as the theft of almost one million dollars from the Kyrgyz-registered cryptocurrency exchange Four Dragons has escalated far beyond an internal fraud case. Initially appearing to be an ordinary embezzlement by a former employee, the incident has set off a chain reaction that, according to Four Dragons, may endanger the survival of the major global platform WhiteBIT.

Representatives of the cryptocurrency exchange believe that “what’s at stake is not just the future of one exchange and several involved parties, but the prospects for the entire cryptocurrency industry in Kyrgyzstan, which is striving to become the new center of digital finance in Central Asia.” In turn, WhiteBIT rejects all allegations and provided explanations in an official press release. 

It should be noted that the State Financial Supervision suspended the license of the CJSC Four Dragons to carry out the activities of a virtual asset exchange operator.

The editorial spoke with one of the lawyers and Anton Mordorovich, who introduced himself as an investor in Four Dragons. He told about how the law enforcement agencies of Kyrgyzstan are helping to prove the withdrawal of one million dollars from the company.

Anton Mordorovich. Screenshot from an interview

"As a result of this entire case, both I and the entire team at Four Dragons are convinced that law enforcement agencies in several countries have all the evidence of systematic laundering of over 2.7 billion ’dirty’ dollars worldwide through the crypto platform WhiteBIT. Thus, criminal cases have been initiated in Austria, the UAE, Uzbekistan, and Kyrgyzstan, and the initiation of criminal cases is being considered in EU countries. According to our data, this involves the Honorary Consul of Ukraine in Spain, Volodymyr Nosov, his business partner with a criminal record, the Honorary Consul of Romania in Ukraine, Mykola Udyanskyi (there is suspicion that he may have Russian citizenship), as well as a Moldovan and Ukrainian citizen Serhiy Hutsu.

We believe that very soon this overinflated ’billionaire’ and all his accomplices will end up behind bars, and the WhiteBIT platform could become bankrupt not only de facto but also de jure," Mordorovich believes.

Regarding the mentioned individuals, the editorial does not possess information about their involvement in organized crime and connections between them, although they are mentioned in foreign media as businessmen and in connection with their professional activities, including scandals.

Новости
по теме:Брянская область охвачена коррупцией: губернатор Богомаз рискует потерять пост из-за массовых арестов

"The Million-Dollar Theft": How it all began

According to the materials of the case initiated in Kyrgyzstan, back at the beginning of 2024, around 1 million USD in USDT was stolen from Four Dragons. The money was sent to a single address, then broken into 16 parts and channeled through five cryptocurrency exchange points to the WhiteBIT exchange, where everything was converted and further transferred down the chain of wallets to the KuCoin exchange, and from there to Gate.io and other various exchanges. The suspects are Russian citizens: a 47-year-old former employee of Four Dragons and his, as those who contacted us say, female companion. They were caught fairly quickly: within a couple of months, law enforcement agencies picked up their trail thanks to blockchain analysis and seized equipment.

The Pervomaiskyi District Court reported that a preliminary hearing was conducted regarding the two suspects.

"Upon arrest, they found phones, computers, and cold wallets. As a result of examinations, which were conducted by the Israeli company Cellebrite with the assistance of Interpol (the same equipment was used to unlock the phone of someone who attempted an assassination on Trump), the investigation obtained irrefutable evidence of their involvement in the crime," Mordorovich clarifies.

Personal opinion of the Lawyer: Cyber Bonnie and Clyde will serve decades

The attorney for the aggrieved party, Nurlan Mambetaliyev, commented on the case, adding that this is solely his personal stance and not an official court ruling.

"The outcome of these modern Cyber-Bonnie and Clyde’s adventures is obvious: an open court session with the possibility of up to 20 years of imprisonment based on the combination of articles. Personally, I believe that they may then be extradited to the USA or the EU for using fake passports. New investigations, new terms, and so on in circles. They’ll come out, if they ever come out, as destitute elderly people with broken lives, full of unfulfilled hopes, plans, and bitter regrets. Parents will die, relatives will forget. But this is, of course, only my private opinion, not the court’s official stance," explains the lawyer.

Mambetaliyev does not hide that Four Dragons is ready to retract claims if the stolen money is returned. However, the accused refuse to give detailed testimonies and continue to maintain their innocence.

WhiteBIT - suspicions of money laundering and fake reserves

Many transactions were led specifically to WhiteBIT; however, instead of help from the exchange to the victims, according to Mordorovich, they encountered "endless excuses, anonymous letters, and an infinite flow of threats, which was quite strange given the exchange’s supposedly billion-dollar trading volumes in the rankings" (evidence of threats was agreed to be provided by the editorial upon request. - Note Kaktus.media).

Новости
по теме:Трамп предлагает США взять на себя управление энергетическими объектами Украины

According to Mordorovich, recently, internal correspondence of crypto-exchange auditors surfaced online, where a former Senior Manager of the leading global company Deloitte, and now director and co-founder of his own auditing company https://hacken.io/, Dmitriy Budorin wrote to his company employees that the actual reserves of WhiteBIT are thousands of times less than stated, that the audit conducted by his company is "drawn," the numbers are simply pulled from thin air, and the billions of dollars of "daily turnover" are just a fiction to attract simpletons from all over the world (the editorial does not have access to the exchange’s audit. - Note Kaktus.media).

"Soon, the leading global cryptocurrency information resource CoinGecko, for the first time in its existence, without any warning, removed WhiteBIT and all of its products from its tracker.

Screenshot from the website

The Gate.io exchange delisted the WBT token, and rumors are spreading more insistently in the network that Volodymyr Nosov, Mykola Udyanskyi, and Serhiy Hutsu themselves may soon be wanted by Interpol with a red notice (statement by WhiteBIT at the end of the material. - Note Kaktus.media).

Almost the entire top management of the exchange has already fled from the public eye, limiting themselves to a vague press release, where they, without much specificity, accuse the victims of a "hit order." However, we are confident that once the dust settles, it will become clear to everyone around: the scale of money laundering of "dirty" funds there is simply colossal. In our opinion, this is the main laundering office in the EU today. If an investigation begins in the EU, WhiteBIT won’t have a single chance to get away with just fines.

Personally, I believe that the gang members will be very lucky to receive "business trips" of 15-20 years based on court results. But, most likely, they won’t be as lucky if in Kyrgyzstan it has already been established that as a result of the syndicate’s episodes, ordinary American citizens were harmed, they will definitely be requested for extradition to the USA. There, both they and their auditor with colleagues will receive life sentences, possibly more than one. They handle such matters very harshly there. Recent cases like that of Bernard Madoff or Puff Diddy are examples," asserts Mordorovich.

Why is this important for the Entire Kyrgyzstan market?

The scandal with Four Dragons has already shaken the cryptocurrency community in the region. The fact that Kyrgyzstan, striving to become the new crypto valley of Central Asia, has faced such a large-scale theft for the first time is only part of the problem.

For those interested in the world of cryptocurrency, it is even more surprising that conclusions from the investigation, already submitted to the court, public statements by the victims, and leaks of internal data from the WhiteBIT exchange indicate that a large European exchange from the world top-5, operating under the regulation of the Bank of Lithuania and under the control of the Financial Crime Investigation Service (FCIS), has truly been involved in schemes for laundering funds and was "laundering" unimaginably large amounts of "dirty" money for many years right under everyone’s noses.

It turns out that our law enforcement officers not only managed to uncover the activities of the largest organized crime syndicate by the number of members and the amount of laundered funds in its history but they also did so in record time, achieving what their foreign colleagues failed to notice over the years of this criminal cyber syndicate’s existence! Unfortunately, the Ministry of Internal Affairs has not disclosed any details on how its employees managed to achieve such phenomenal success in such incredibly short timeframes, but there are already assumptions that foreign specialized experts greatly assisted in this investigation (the Ministry of Internal Affairs has not commented on this story in official communications. - Note Kaktus.media).

"I am bitter that people find it difficult to sincerely rejoice for their fellow citizens, to believe that among them live and work true professionals of their craft, in love with their work. And that for full-fledged investigation in the blockchain it is enough to have quality, specialized software and hardware, as well as the sincere desire of investigators, operatives, prosecutors, and judges to learn something new in their work and quickly solve crimes in high-tech fields, mastering and using these very high technologies in their work. Ranging from chatbots, to free online lessons on YouTube, as strange as it may sound to some. There would be the will. We are very fortunate that the employees leading the investigation in our case had it.

Unfortunately, the wave of cybercrime is growing dramatically every year around the world, and law enforcement agencies have many other tasks. Due to staffing limitations, it is not always easy for them to react swiftly. As a commercial company with expertise in cyber-investigations, we are now ready to participate in such cases on the side of the victims. We are able to conduct more flexible investigations, swiftly engaging foreign partners and gathering evidence in the shortest time possible. We have already entered into a partnership agreement with one of the global leaders in this field and are negotiating partnerships with other serious players in this market," continued Mordorovich.

Tether, freezes and the thorny path to restore funds

Four Dragons reported that literally ten minutes after the theft they turned to Tether Limited (the company behind the issuance of stablecoins, registered in Hong Kong. - Note Kaktus.media), demanding an urgent freeze of the stolen USDT. At that moment, nothing was blocked as there was no court decision.

But when it appeared, Tether acted swiftly: part of the suspects’ assets were frozen in less than ten hours after sending the document package (and this on the night of December 31 to January 1).

"It’s impressive that a giant like Tether wasn’t afraid to side with Kyrgyz Republic, genuinely demonstrating in practice that we are unstoppable together," says lawyer Mambetaliev. "This means that if we establish legal mechanisms and organize more technological mutual assistance between countries, it’s possible to save stolen assets almost in real-time."

"You see, the most unpleasant aspect of this story is that we truly and promptly notified the exchange through all possible communication channels, even sent a message to the personal number of the exchange owner. We received confirmations from everywhere that there was no reason for concern, the situation was under control, the information was taken into work. I still vividly remember those terrible hours and days of waiting, but ultimately all our subsequent requests, appeals for cooperation, and even the judicial decision went unanswered.

The exchange, as if testing us for endurance, dragged on for nine months and ultimately returned only about 5% of our funds. The rest went God knows where, and the platform, on formal grounds, refused to provide the criminals’ data, who were essentially laundering the stolen goods, referring to the fact... that they didn’t have it! They provided links to the websites of some exchangers on the internet, which supposedly conducted these transactions through their automatic exchange system. But they did not provide surnames, addresses, or phone numbers of the owners of these "exchange services." Who do we sue? The website? The wallets? It’s sad.

Moreover, so far, none of the official representatives of the exchange has seen fit to clearly explain how it happened that despite our timely multiple notifications and that of law enforcement, which, by the way, the platform doesn’t deny, massive amounts of stolen funds were not frozen back when they were still within WhiteBIT’s control following our numerous warnings. They didn’t even apologize to us," explained Mordorovich.

What four steps will save the cryptocurrency market in Kyrgyz Republic?

Anton Mordorovich, drawing from experience, proposes four steps that will help make Kyrgyzstan’s cryptocurrency market not only rapidly growing but also the most secure worldwide:

• Urgent Blocking. Develop mechanisms allowing state bodies to block suspicious funds in just one to two hours upon confirmed signals.
• Agreements with Stablecoin Issuers (Tether, Circle, etc.), ensuring that accredited representatives of the Ministry of Internal Affairs and commercial investigative structures in Kyrgyzstan can promptly request a freeze.
• Expansion of International Cooperation (joining the European Convention on Mutual Assistance in Criminal Matters of 1959, the Council of Europe Convention, agreements with the USA, Seychelles, Malta, Lithuania, etc.), where the largest crypto exchanges are registered. This will allow for instant coordination of investigative actions, rather than waiting for responses for many months.
• Possibility of Confiscation. Legally establish that wallets involved in the systematic laundering of criminal proceeds are confiscated in favor of the state.
• "Just one or two precedents of quick freezing and confiscation will be enough for fraudsters to think a hundred times before coming to Kyrgyzstan with their dirty schemes. The state will benefit, businesses will gain protection, and the cryptocurrency market will become more transparent - meaning that the influx of investments will only grow," emphasizes Mordorovich.

"There’s simply no other way"

According to representatives of Four Dragons, it is already clear to the defendants (the former employee and his accomplice) that the judicial machine is moving against them. However, according to lawyer Mambetaliyev, "they stubbornly do not cooperate with the investigation, hoping either for a miracle or hidden help from accomplices."

"But the investigation has everything: wallet analytics, the results of technical examinations by Cellebrite and Oxygen, official documents from Tether, the results of polygraph tests (lie detectors) passed by the defendants, psychologists’ conclusions, correspondence with law enforcement agencies and authorities of other countries, even an international audit report showing the drastically increased personal expenses of the accused right the next day after the theft.

And if the defendants (and their accomplices as well) think that they can emerge as heroes with a million in their pockets, - it is absolute delusion," comments the lawyer.

What to do if you face crypto fraud?

The case of Four Dragons shows just how important it is to react immediately to cybercrime in the cryptocurrency space.

• Contact Law Enforcement Agencies immediately. The experience of Four Dragons shows that it truly works.
• Additionally - reach out to specialized investigative companies (like Four Dragons) that can conduct parallel and deeper checks, not limited by routine procedures.
• Inform Foreign Jurisdictions, if you see that the funds have reached a foreign platform. Write to tech support and don’t forget to take screenshots of the correspondence.
• Don’t Waste Time. Remember, every minute of delay gives criminals an advantage, allowing them to "clean" the funds through yet another "black" exchange, dragging the process of return over months.

"Kyrgyzstan has every chance to become the first country in the world where crypto fraud is nipped in the bud. But for that, we must act quickly and coherently: not fear loud scandals, not give in to the pressure of shady grounds with murky owners, and most importantly establish international contacts. And if this requires a judicial precedent, then let it be. The sooner we create it, the clearer the future of Kyrgyzstan’s cryptocurrency market will be.

We are right, justice is on our side, and we will see it through to the end," Mordorovich summarizes. "And let the buyers of stolen goods dare not to sue me and our company for this interview. And let them not limit themselves to Kyrgyzstan, but file in every single country where they have licenses and users, especially in Lithuania. A court is always a test of truth, and we have evidence for every statement in my interview, so I have no doubt that eventually not only the pawns but also those who were truly at the helm of the scheme to launder billions will end up in jail. I believe they are the disease, and we are the cure. The cryptocurrency business in Kyrgyzstan and the world has long outgrown shady schemes and deserves transparent rules of the game, and we will do everything so that these rules will work".

Position of WhiteBIT

On its official website, on January 7, the cryptocurrency exchange published an official statement, which, in particular, mentions that "recently, WhiteBIT became the target of a coordinated information attack aimed at discrediting our company and creating panic among our users. This campaign spreads misinformation, manipulations, and unfounded accusations with the sole purpose – to incite FUD (Fear, Uncertainty, and Doubt) in the crypto community.

"The information currently circulating online is fabricated," stated the cryptocurrency exchange.

The company added that "WhiteBIT is a cryptocurrency exchange that operates transparently and strictly adheres to international rules and standards."

"Our platform provides a mandatory KYC (Know Your Customer) process, and all transactions undergo strict AML (Anti-Money Laundering) checks. In addition, we actively cooperate with law enforcement agencies around the world, assisting in the investigation of illegal activities. By law, we are obligated to protect the assets and confidential information of our users. The data that we collect from users are necessary to ensure user protection in cases of unlawful actions by state bodies," stated the company.

WhiteBIT mentioned the case with Four Dragons, reporting that "it was the only exchange that promptly responded to a request from Four Dragons and initiated actions to track stolen funds": "We managed to freeze stolen assets amounting to 46,450 USD and mark suspicious wallet addresses to prevent further transactions. Subsequently, these funds were returned to the rightful owners on November 24, 2024".

WhiteBIT added that "WhiteBIT is only responsible for the funds held on the platform". "We did everything possible to assist the investigation," said the company.

The cryptocurrency exchange believes that it has faced an information attack.