How to launder illicit Bitcoin

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this ransomware focused episode of Risky Business Features. Today I am joined by investigative journalist Geoff White. Geoff co-hosted the Lazarus Heist podcast series for the BBC, a series all about the DPRK's cybercrime efforts. And just recently Jeff hosted Cyberhack, The Conti Files, a series that takes a fascinating look at Conti that were of course one of the most powerful and feared ransomware gangs of their time that also happened to Net, absolutely eye-watering sums of money. Hot off the heels from The Conti Files, Jeff is joining me to talk about where the money actually goes after a ransom is paid in Bitcoin or some other cryptocurrency.

0:50James Wilson: I had assumed that there was quite a bit of work that had to be done before that crypto could actually be spent Not least of which due to the traceable nature of Bitcoin and the like But honestly folks, I had no idea that this would involve high-flying professional money launderers Street-level drug gangs in the UK All other forms of crime And of course, a rather glamorous Russian woman But more importantly, it wasn't until I spoke with Jeff that I fully understood that a ransom paid to a ransomware gang benefits many, many other criminal actors across a broad spectrum of crimes from drugs through to human trafficking.

1:32James Wilson: To me, this affects the question of whether or not paying a ransom should be legal. And it does so, honestly, in ways that I hadn't considered before. But as Jeff points out, you know, it's not as simple as saying, well, let's enact a policy that says we will make it illegal to pay ransoms. That's a nice stance to try to work towards, but you've got to have a plan to get there. And we do talk about that at the end of this episode. But for now, I'm going to drop you here into the conversation where Jeff picks up from the trail the moment that the ransom lands in the Bitcoin wallet. Enjoy. God forbid that you and me, James, decided to set up a ransom operation.

2:11We suddenly get a million dollars worth of Bitcoin paid into, well, our wallets. Because, I mean, we can't really have our wallets at one of the big exchanges like Coinbase or whatever, because, you know, as soon as the victim pays, they're going to contact Coinbase and say that money we just paid is proceeds of crime. So for a start, we have to set up our own Bitcoin wallets to receive the money because we can't really use immediately big legitimate exchanges. That's risky. So we've got to get our heads around self-hosted wallets. Those wallets have to be secure because it's going to get a million dollars put in it.

2:45And then even if we get that and we master all of that, you and I now have a Bitcoin wallet, effectively a string of letters and numbers that's got a million dollars worth of Bitcoin in it. So we want to go out and celebrate. I want to buy a Lamborghini, you want to buy a yacht. Well, we go to the Lamborghini dealership and we say we'd like to pay in Bitcoin for this Lamborghini. A lot of high-end shops won't do that. They are covered by things like money laundering regulations. We want to buy an apartment with the money. Again, an estate agent is going to ask questions. In most cases, it's still not the case that you can immediately use big amounts of cryptocurrency to buy luxury purchases.

3:24So the simple answer to the question is, yes, we can get billions of dollars of, you know, payments for ransomware in cryptocurrency, but how do we spend it? And you've got to realise the whole point of crime, almost always, is to spend it, to have that lifestyle. If you can't have it, there's no point doing the crime.

3:41James Wilson: And an interesting, this might be a little bit of a tangent, but you did mention there that you can't use the Bitcoin for large luxury purchases. Am I right that there has actually been more and more adoption of Bitcoin for somewhat more legitimate things? Like I'm thinking about, I was talking to an LLM inference provider recently and they said, oh no, we do accept crypto now because Stripe set up all the infrastructure. So has that changed a little bit, but there's still sort of, I guess, a hard line of when. Yes. You see stories every now and again of a big art dealership that accepts cryptocurrency or a big, there are some luxury car sales places that have talked about taking Bitcoin.

4:19So it is creeping in around the edges. But those outlets are still big legitimate companies, and often they will put due diligence around it. So yes, you know, they will accept Bitcoin, but they will do some kind of tracing to make sure the Bitcoin hasn't come from a ransomware victim. So you're right, as time goes on, and as cryptocurrency gets more penetration, this challenge will probably get a bit easier. You will probably at some stage be able to buy property using cryptocurrency, you you know, commonly in lots of countries. But again, as that beds in and as cryptocurrency gets more common as a payment mechanism, the due diligence around accepting the payments is also going to expand.

4:57So it doesn't quite get you off the hook. But certainly at the moment, a lot of the purchases these gangs want to make aren't possible with cryptocurrency. You have to convert it. You have to get it into some kind of, what they call fiat bank account, pounds, dollars, yen, that kind of thing. So that's still the case. And look, the ransomware gangs could try and crack that challenge. But you've got to realise mastering crimes is quite hard. Mastering ransomware is quite hard. Do you now want to master money laundering and cryptocurrency laundering? Not really, but there's people out there who will do that for fees.

5:30So that's where we go next with the ransomware story, I guess.

5:33James Wilson: Yeah, interesting. And I guess it's not just the issue of you can't go to the dealership and pick up your new Lamborghini with cryptocurrency. There's also issues – so I mean, this is probably different jurisdictions, but in Australia there are issues with when you have assets in your possession that you can't really prove how you got a hold of, right? So even if this gets accepted, still a problem. Oh, yeah, the tax implications are a nightmare because suddenly you end up with, even if you get into your bank account or you get your Lamborghini or your yacht somehow, you're absolutely right. The tax person is going to come along and ask questions about that.

6:09And that's why traditionally I wrote a whole book about money laundering, how tech is influencing money laundering. And one of the things that launderers used to do and still do is to invest the money in some kind of legitimate business, restaurants, hairdressers, that kind of thing, because it gives you an outlet for the money, a way to launder it. But also it's a way of explaining to the tax authorities how this money's come about and how the money's being made. It's like, well, this is a legitimate business. So again, there's all sorts of layers you have to put in to sort of protect yourself.

6:41And you're right, the tax implications are pretty heavy. And of course, if the tax person finds out that this was proceeds of crime, immediately you're back to square one. You're going to get convicted by the police for the crime. So yeah, you've got to be quite careful. In a way, having the money is pretty stressful. I don't have a lot of sympathy for people who make millions out of ransomware, but it's a pretty stressful experience to go, okay, I've got a million in crypto in a wallet. What am I going to do? how do I avoid all the bear traps that are now ahead of me?

7:09James Wilson: Right. And so in this case, when you started to look into proceeds from Conti, you mentioned to me that the, I think it was the NCA. So they traced some of these payments coming out of Conti and a few others, I believe. And what was the sort of first thread that came loose out of this ball of yarn? Well, one of the ransomware victims, the big ransomware victims from 2021, which when Conti were very big, was a US financial firm called CNA Financial, a big sort of insurance firm, huge, vast, vast firm. They got ransomware and it was reported that they paid the ransom and it was$40 million of ransom.

7:49Now, that immediately is just a huge, huge ransom. I think the last, the biggest I heard apart from that was something like$70 million, but these are extremely rare. Payments in the millions are, you know, in ransomware world quite common. Payments in the tens of millions are really rare. So I don't know what happened with CNA Financial.

8:08James Wilson: Well, the interesting thing to bring this into the modern day as well, because, you know, I don't want people to think, oh, we're talking about 2021. This is irrelevant. It's very relevant today because we're now starting to see ransomware and even extortion gangs going directly after industries where they absolutely know that not only do they have the ability to pay those, but they will pay those. I'm thinking about the very high profile law firms recently that shelled out, again, I think tens of millions of dollars because a law firm losing control over all of those client documents, that's end of business for them.

8:39James Wilson: So it's still a big thing with these big payments, right? Precisely so. And look, it's worth noting, I think CNA Financial, I think their revenues were something like a million dollars a day. you know so so the calculation was interesting the ransomware gang said look you can keep losing this money or you can just pay it and it's all done that's that's the that's the argument they use it's not not quite as simple as that but anyway this this sort of huge dollop of money drops into the cryptosphere and again um you've got a challenge where to where you put that you know that they can't get cna financial to transfer it straight to a big legitimate exchange that's not going to work.

9:15So there's this big question of where you put that money. And what you're looking for, and this comes down to financial market type terminology, is you're looking for somebody to be on the other side of the trade. You've effectively got then as a ransomware gang, $40 million of crypto that you're looking to sell. So you need somebody who's got$40 million worth of money who's going to buy it, you know, and also is going to buy it, no questions asked. Now, they might ask for a bit of a discount, because if I know your crypto is a bit dodgy, I'm not going to pay you full price for that crypto. I'm going to pay you a discounted rate.

9:46But you still need somebody who's going to pay you tens of millions of dollars, no questions asked, and buy your crypto. That is not going to be one of these big legitimate exchanges. It's not going to be a big legitimate investor. No one's going to take that risk. Where do you go with a dollop of$40 million of hot crypto in your back pocket? And according to the National Crime Agency's investigations, as they trace this through, it leads to a network of professional money launderers. And within that network, a woman called Ekaterina Zhdanova, who's an intriguing Russian individual who becomes part of this story.

10:18James Wilson: Right. And as you mentioned in the email when we were first chatting about this, quite a glamorous individual that lives an equally glamorous lifestyle. Is that a bit of an outlier or is that almost the personality that one adopts when you are, you know, high flyer in the money laundering? It's interesting. Yeah. I mean, Ekaterina's story is really fascinating. She grew up, I think I might say in Siberia, which obviously is very, very far from the centres of power in Russia, but sort of works her way up, was extremely ambitious. You know, managed to get into university in Moscow. And I think what's fascinating about Ekaterina is from reading the interviews she's done and how she sort of paints the picture of her life, she's one of these people who succeeds by finding people who have a need and fulfilling that need.

11:06So hotels, for example. She had a bunch of hotels, boutique hotels, because she identified that people in Moscow wanted these high-end hotels. And then the people who stayed in the hotels, well, they want other things. They want theatre tickets. They want, you know, places to go for their kids. So she's fulfilled that need. And then their kids want to go to, you know, school and they need help. Katowina was just somebody who wanted to help and to take a fee from helping, which starts out quite benign with hotels. But pretty soon she finds people who need help with other things. She gets into cryptocurrency.

11:39And again, according to National Crime Agency and others, she starts helping out ransomware gangs offload those crypto payments that they've earned from their victims. So to answer the question of where do you go with$40 million of hot crypto, you've got a problem there, a need. Ekaterina apparently put up her hand and says, I can fulfill that need. And when the NCA started tracing those ransomware payments from CNA Financial, they managed to link them to accounts with Ekaterina Shdanova's name on them.

12:04James Wilson: But that's only the first step, right? She's not the person that's sitting there saying, I've got 40 million or maybe charitably discounted to 30 million in fiat currency that I'll happily ship your way. And even that presents a whole different problem. But is she broker? Is she, you know, facilitator here? Like, what is her role? I don't know how you'd describe Katarina Stanova's role. I mean, certainly according to the police, She's a money launderer. But what she does is she has reserves of cryptocurrency and she has accounts with cryptocurrency exchanges. Some of the Russian exchanges that have been sanctioned, Garantex, et cetera, are useful for this.

12:43So she's able to absorb that huge amount of cryptocurrency and effectively give back the ransomware gang probably rubles, maybe dollars, depending on where they're spending them. So for the ransomware gang, it's happy days. We've managed to offload this crypto And now we've got money that we can spend on things we want, you know, apartments, Lamborghinis, that kind of thing. Ekaterina has then the reverse problem. She's now crypto rich. But again, she's looking to kind of work out where she can move this money. Because, yes, it's moved into Garantex and she's managed to sort of wash it through Garantex.

13:16Again, it's the accusation against her. But the problem with that is that money is then sort of tainted. You know, it's come from a ransomware victim. It's gone through a sanctioned exchange. You can't then take that again to places like Kraken and Coin. They won't accept that because the taint is there. And as you pointed out, James, you know, the money is traceable. So you can see the journey of the cryptocurrency. You can see what its past was. And if its past is from a sanctioned exchange, you're just not going to be able to touch it as a legitimate entity. So Ekaterina's got this problem.

13:46I've got loads of crypto. I need to sell the crypto now to the other side of the exchange to somebody who wants to buy it. where in the world are there people who want to buy crypto? And what she hit upon, again, according to the documents put out by the NCA, is drug gangs working around the world, particularly in the UK, street-level drug gangs. This is one part of the operation. And you might think, well, why do they want crypto? Well, again, think of drug dealing is still mainly a cash business. You know, when you sell cocaine and heroin and so on on the street, you make cash because people want to pay in cash.

14:19It's still the currency of drug trading, street-level drug trading. So the drug gangs have got cash. And when you see these bundles of cash, I mean, they're so heavy. They're so bulky. They're so obvious. I mean, you try and hide those from the police. If the police search your property, they're just going to find them instantly. You know, so suspicious. Cash is a really big weight for a drug gang, literally and metaphorically. They want to get rid of it. Katerina is accused of saying to them, look, I will take your cash off you and I'll give you Bitcoin in exchange. Now, the drug gang don't care where it came from.

14:51They're crooks. What they can then do is send that crypto overseas to places like Pakistan, to South America, Colombia, to purchase more supplies of heroin and cocaine. Previously, they would have had to have taken the physical cash to a broker in the UK who receives it and then effectively wires their friend overseas and says, I've just received millions from this gang. You can release millions in that country.

15:16James Wilson: This is one thing that I sort of wondered about here because we're talking about two ecosystems that have traditionally found their own solution. I guess, you know, the street crime and other forms of criminal activity that essentially, you know, nets the fiat currency. Money laundering has been a household term for decades, right? There's so many different techniques around that. Cryptocurrency might be a little bit newer, but, you know, there was things like tumblers and other sort of things that you could switch your currency out into one of the more privacy preserving, shuffle that around there.

15:44James Wilson: So each of them have had their own way to solve this problem in isolation. I guess we're varying degrees of success. What's your sense of why they came together if they each had mutual solutions that were probably working okay previously to do the money laundering? This is the fascinating thing. And I think, speaking to the investigators of the National Crime Agency in the UK, they were surprised at this as well, of revealing this international network operating, connecting different types of criminality. I think for a start, the sort of international and seamless nature of cryptocurrency has really helped.

16:19Previously, UK drug gangs' money problems were UK problems. They would find UK solutions to them. Yes, the drugs are being sourced often from overseas. They had to have distribution networks and supply chains. But in terms of the money, they took their cash to a dodgy, usually dodgy bloke, who would take the cash and say, I've just messaged my friend in Islamabad, who is now going to release the money for you to buy your drugs. Shipping them into the UK was the sort of logistical problem. That's changed because there is now this international network of money brokers using cryptocurrency, some of whom fly completely under the radar.

16:54So suddenly you're able to connect different parts of the world. What that means is you can connect different parts of criminality. You know, Russia-centric crime, like a lot of ransomware is, can suddenly connect with UK street-level crime because the conduit is this international seamless layer of Bitcoin. And that's what Ekaterina Zdanova and colleagues at the NCA revealed a whole bunch of other people working on this. What's interesting about this is people still have this idea, and I get very frustrated with this, and commissioners who I try and get commissions from for books and podcasts that I make still have this idea of organised crime as being like a mafia model, a hierarchical model.

17:31You've got the capo di tutti capi at the top, you know, and all the lieutenants and, you know, like the godfather, you know, they're still looking. And You want the godfather, you want the sort of person at the end of it who's going to get either arrested and convicted or run off laughing to the sunset. You want that kingpin. What this story tells us is that's not the modern face of crime. I cannot tell you in this operation that we're talking about who's in charge. Are the ransomware gangs in charge? Because they're really kind of the source of the money. Well, no, because they need Ekaterina Zdanova and her network, is what the NCA revealed and accused her of.

18:07Is she in charge and her colleagues? Well, no, not really, because they can't work without the ransomware gang. The drug gangs, are they in charge? Well, no, because they're effectively users of the service. The model of crime is no longer a hierarchical mafia type model. It's interconnected gears like a watch where each of the gears is driving the other gears. There is no one really in charge. They're just a network of people with different types of criminality who are connected together in these interesting ways.

18:35James Wilson: Which, like, it truly is an ecosystem, right? By varied definition, there's no centrality to this. It is distributed and there's multiple parties, each of which have a benefit and an expense that they incur. And hopefully the benefit is higher than the expense for each individual one of them. um we've we've been talking a little bit about things in the past but bringing it into the modern day how has this changed does this still operate this way i mean i i know ekaterina was sanctioned and all the rest i'm assuming that didn't stop her you know tracks um but but how has this evolved over the last couple of years and what what is sort of the modern day you know state of the art of of laundering a ransomware payment yeah it's very interesting we can come back to the Ekaterina Jdanova story because there's an unfortunate end for her.

19:23Her story is still ongoing. But yeah, it's interesting. So what's emerging now is we've entered this interesting period with what you might call alternative finance. So things like Bitcoin and NFTs and central bank digital currencies and so on. On the one hand, there's been this sort of blossoming of a whole new financial industry, you know, and there are people making money and there are people creating really interesting products. You know, money has sort of evolved at this frenetic pace. And we've got this whole other world of money, of digital money and types of digital money. It's really fascinating.

19:57On the other hand, the downside of that is that largely exists completely outside regulation, outside law enforcement's ability. One of the things you've got is creations of new currencies that are helping countries effectively do statecraft in the modern age. So Russia's the perfect example. under extremely strict sanctions. There's a whole new type of currency launched, particularly adopted in Russia, the A5, A7 currency, which again comes into this story we've been talking about, that kind of laundering story, because it's accused of being a conduit for not just laundering criminal money, but also helping sanctioned Russian individuals get their money in and out of Russia.

20:40What's interesting is, and this gets into a bit of geopolitics macro stuff, but previously when you sanctioned a country, On one hand, sanctions are quite boring. People get really bored by sanctions. But it's a really powerful tool because if the US sanctions you and says you are a sanctioned individual, you can't spend dollars, buy dollars, you can't put any money through any dollar account anywhere in the world. Anyone who interacts with you who's in the US is also committing an effect. I mean, it's a really powerful thing. But the power comes through the dollar or the international community.

21:09It comes through the banking sector. The banks enforce effectively sanctions against you. This whole new world of money sits outside the banks. So sanctions start to look like a much less powerful tool. Because if you get these huge areas of alternative finance grow, these completely other currencies, you can't sanction them because you don't control them. It's not like pounds and dollars. Your treasury isn't in charge of them. So that's where this is sort of going in terms of that. And we're seeing this interesting collision then between sanctions type stuff, geopolitics type stuff and criminal type stuff, which includes ransomware.

21:44So it's starting to come together. So it starts to get a slightly vertiginous picture of this, but it is fascinating.

21:48James Wilson: Yeah, it is. So am I right in saying that I like this framing of cryptocurrencies as the conduit, right? Because that's essentially what it's provided, I guess, the durable benefit here. It's not the in and out. It is the way in which to move things around for conversions to happen and the next sort of downstream thing to happen. So sounds like the conduit has gotten more feature rich. And does that mean that the money laundering operations are taking advantage of all these new features that are emerging? Yes, I think so. I mean, fundamentally, the job is still the same, which is absorb the criminal proceeds, move them about a lot, wiggle them around to kind of disguise the trail and then spit them out, you know, cleaned of the criminal history.

22:31But you're right, features is an interesting way to think about it. The other thing to understand about this is that criminals obviously are looking at their bottom line, how much money they lose on money laundering. Money laundering is a very expensive part of the operation. I mean, when I started looking at it, this was a few years ago, but I think it's still the case. If you're new to the money laundering market and no one knows you and trusts you and you try to wash money, the fee for laundering can be as high as 60%.

23:01James Wilson: Wow. Because, yeah, you think, well, why would I pay 60 %? And the person on the other side who's laundering for you says, okay, you want to take it to a legitimate bank? Off you go. Yeah, you can have 40 % or you can have 0%. Choose. And 40 % of criminal money is still 40 % of money you never thought you'd get because you didn't know whether the crime would work or not. So, you know, but as you work and work and work, you can drive those percentages down, you know, to the tens of percents and so on. The crypto stories that I investigated, you're talking single digit percentages for this laundering.

23:33So it's not just that the cryptocurrency is feature rich, it's cheaper for these gangs to do. You know, they are not going to lose as much. And again, this is a mirror of traditional finance. You know, the way banks get rich is by offering exchanges and transfers for lower fees than other banks. You know, the crypto industry is sort of mirroring that.

23:53James Wilson: It's funny, the crypto industry mirrors the path of traditional banking while simultaneously trying to tell everyone they're completely different from traditional banking. But one thing that I can't quite reconcile in my mind is here is that so the crypto mechanisms for or crypto based money laundering, let's call it that, you mentioned that it was single digit percentages in terms of the cost of criminals. But we're still not at a point where it was crypto in cash out. There's still a ton of other logistical problems around that. So talk us through, if you can, I mean, help me understand why is it that if I was faced with a decision of 60 % cost to money launder through traditional fiat sort of ways of doing it, suddenly crypto comes along and offers me a 60 % percentage.

24:39James Wilson: That sounds wonderful. Easy decision for me to make. But behind the scenes of that, it's not as simple as there being two parallel machines that have entirely different cost structures, right? There's still a hell of a logistical problem to solve with getting the money moved around. So how does this work? What's interesting about the cryptocurrency's laundering picture is, one of the stories we have tried to investigate was North Korea's alleged break-in of Bybit, which is one of the world's biggest cryptocurrency exchanges. North Korea stole around$1.5 billion worth of cryptocurrency from inside Bybit.

25:12$1.5 billion is a vast amount of money. They managed to transfer that money out in something like 2 minutes 38 seconds. So it's the fastest crime ever committed by a considerable margin, you know. Well, yes, so they transferred it. They transferred it to a wallet somewhere or several wallets. But you're right, you've got this issue of now you're sitting on cryptocurrencies. Where do you take it? And what I really wanted to do was sort of almost drop a barium trace into that money. So you can't trace a billion and a half. We're just not going to do that. for this was the BBC podcast Cyberhack, the Lazarus heist that you mentioned.

25:45Can't do that really for the whole amount. But can we trace one bit of it? I really wanted to kind of, I don't know, find the person who's got the brand new TV that was sort of paid for out of the buy bit.

25:58James Wilson: You're trying to drop like the Bitcoin equivalent of the Apple AirTag in the shipment to work out where's this go? So then you bring up these graphs. And what's interesting is, as you've mentioned, cryptocurrency, all traceable. So you can see from the Bybit wallet, you can see it going to all these different other wallets. And I thought, okay, well, we'll just keep tracing one of these little waterfalls down. It then goes from 100 wallets to 1000 wallets. So immediately you're dwarfed. I don't know. And these wallets, some of them will have been spun up by the money launderers who are helping, you know, launder the Bybit money.

26:34But some of them could just be individuals' wallets, there's a whole bunch of people out in the world who want crypto, who can't get it through legitimate means. A big example is China. China pretty much outlawed crypto for consumers, but Chinese people desperately want crypto. So what do they do? They go to the black market, the grey market. So if somebody comes along to them and says, look, I've got this crypto, don't ask where it came from, but I'll sell it to you for a discount. Folks in China, some of them are going to say, okay, I'll buy that because I can't go to big legitimate exchanges to buy.

27:07So immediately you've got a market and some of those wallets that the crypto from Bybit went into would have been people on Telegram, more likely WeChat, saying, I want to buy some crypto. Here's my wallet. And again, they're buying it at a discount. But the money sort of seeps into these wallets and it becomes incredibly difficult to trace where it goes to, because what you've done is effectively federated the money laundering in crypto on a huge level. Now, previously, that would have been really, really difficult if you'd stolen a million dollars in cash, and then you were trying to like give a dollar to each person.

27:41It would just be an absolute nightmare. But with computers, you can do that. With crypto, you can do that. So the money laundering in crypto brings scale. Now, obviously, you've got a challenge then of reconciling all that money back. You know, you've sold a dollar of crypto here and a dollar of crypto there. You've got to somehow pull that all back and then pay back the people who stole the money originally. There's a reconciling of money needs to be done, but farming out on a really micro level all these transactions is doable. And the Bybit example with those graphs shows you you can see the micro laundering happening in front of your eyes.

28:15It's amazing but also frustrating as a journalist.

28:18James Wilson: What I was trying to work out is all the problems that face a money launderer that is going to charge you 60 cents in the dollar are still present for someone that's laundering crypto. So I couldn't work out how they'd managed to get their margins from 60 down to single digits percents. And it's certainly not from just, you know, business practice or competition, right? Actually, there are some reasons why charging 60%, if that is what you're charging for traditional money laundering, happens. For a start, you've got to bake in the chances of getting caught, which are higher for traditional money laundering, I would argue, than for crypto money laundering.

28:55Yes, we're talking about cases where this woman, Ekaterina Zdanova, for example, spoiler alert, does get arrested in the end. But a lot of crypto, it's not being investigated, it's not being chased, you're not going to get caught. So immediately part of that discount from a traditional launderer charging tens of percents to single digit percents is the calculation of how likely am I to go to jail for this. You know, if I'm likely to go to jail, I charge more, if I'm less likely, I charge less. Also, you're dealing with physical cash. So you've got to store it, move it, put it on trucks. that costs money you know there's a logistical end to this the other thing with traditional laundering is at some stage you've got to have some way of getting that into some kind of financial institution um again you can set up a front operation like a restaurant or a hairdresser whatever but that costs money you know that's where that that 60 charge comes from it's like i i have to run a whole industry here of money laundering fronts to sort of launder this money, I'm getting reimbursed for that.

29:53Often you'll have to have some kind of corrupt employee in a bank somewhere to help you out. Well, they'll need paying off. So there's lots of, in traditional money laundering, there's lots of costs you have to pay. And, you know, that's how the market's evolved. I would argue that in crypto, some of those costs go away. You know, you're not working through traditional banks, so you don't have to pay off corrupt employees. You're not shipping bank notes on trucks, so you don't have to pay for trucks. There's lots of costs you can kind of strip out when you do things digitally. You know, the same way a traditional bank, you know, they close down a branch, immediately you've saved loads of money, you know, because people do online banking.

30:27It's a bit the same in the sort of crypto laundering world, you know, getting rid of that traditional real world infrastructure really helps drive down your costs and decrease your overheads.

30:36James Wilson: Yeah, okay, that does help to make sense. So in the traditional money laundering sense, we were trying to keep it to a relatively small number of people to reduce the chance of being caught or them being caught, etc., which means you've got a problem of there's a small number of people dealing with very large sums of money. Those very large sums of money increase the chance of getting caught and are just physically a burden. Along comes crypto and you've suddenly got a whole new way to federate this at a massive scale and almost create a layer of abstraction that operates in the dark. But that's what's interesting about going back to that Ekaterina Shdanova story and this is what they called the TGR smart network was actually the network around her that the national crime agency started to reveal was they sort of straddled those two worlds so on the one hand yes you've got the seamless digital world of you know cryptocurrency and ransomware payments but in the end they're also connected then to the cash heavy street drug dealing thing so in a way with that story we keep toggling back and forth between those two worlds because there were in that story wads and wads of cash being moved around the UK in the boots of people's cars, you know, to soak up this cash.

31:46And there was getting it on trucks and onto ferries and shipping it across Europe. There was all of that stuff. So it's weird. We almost have this sort of mirror image in that of like a very traditional money laundering operation dealing with heavy cash, but interfacing it and smooshing it into very high tech crypto stuff. And the lines kept moving back and forth between those two worlds. It's really fascinating.

32:10James Wilson: All right. So you mentioned before that there was an end for Ekaterina. Talk us through what happened there. Yeah, well, as I say, the National Crime Agency and other agencies, I mean, the US Treasury has also sanctioned her for her role in this, started looking into that. And what they discovered was, you know, they traced the ransomware payments and suddenly they're into street level drug dealing and cartel drug dealing, you know, with the payments back to South America. And then they start to realise that money from sanctioned Russian individuals is going into this network as well, because people in Russia want to get their money out, they can't, they're sanctioned.

32:44Where do I go? How do I get school fees paid in the UK? How do I buy a house in the UK? Ekaterina Zdanova and her network apparently are helping out with that. So it then gets into sanctioned Russian individuals. Then they started realising that the Kremlin is obviously trying to launch operations around the world, physical operations, you know, intimidating journalists and bugging people's houses, and in some cases, you know, attacking people around the world. It's what the Kremlin's accused of doing. All that needs funding. All those overseas networks of, you know, spies and operatives need funding.

33:18How does Russia and the Kremlin get the money out to other countries to pay its operatives? Apparently, the network that Ekaterina Zdanova was part of was doing that as well. So suddenly there's this whole nest of different things that goes from ransomware to drug dealing, to sanctioned individuals, to state level spying operations. Huge case. Katerina Janneva is presumably unaware of the accusations against her. She takes a flight from Dubai, I think it was, to Nice Airport. Very, very unwise because she lands in France, she's taken off the plane and immediately arrested by the French authorities who currently have her.

33:56How could she not know?

33:58James Wilson: How could she not know? I think there's two answers to that. And I am second guessing this because I haven't spoken directly to a Katarina. I think, firstly, the way you do these kind of crimes when you work in that field of sort of money laundering, the way you wake up in the morning and justify what you do is I am a legitimate business person. You sort of put aside, you know, in your head all of the links that you know or suspect. And your job is basically, well, I move money from here to here like financiers do. I know it sounds delusional. Well, it basically is. So the idea of having to hide and not take flights.

34:33No, I'm a legitimate business person. I'm going to take a flight. And the other thing to add to that is the longer you successfully evade being arrested, the longer it works and no one does arrest you, the more criminals convince themselves that they're kind of getting away with it. They haven't arrested me yet, so I'm clearly okay. And also Ekaterina does have to fly around the world. She is a business person. She is making connections. You know, she doesn't want to just sit in Russia. So for all these reasons, yeah, she arrives at Nice Airport and is now in custody. Has been charged with multiple offences in France.

35:06Her trial keeps getting delayed. I did then manage to contact Ekaterina on Telegram. And Ekaterina agreed to do an interview and then I kind of messed things up.

35:20James Wilson: Oh no. I'm not proud of this, but I just, I think you have to sometimes own up when you got things wrong. She asked for a list of questions, which as a journalist, I don't give an exhausted list of questions because when the interview like this, we go into different territory. You don't want to sort of restrict you. But I said, it's fine. I'll give you a guide list of questions. I'll tell you the rough things I'm going to go into. And I was, I was honest. And I said, I'm going to be asking you about the accusations against you and what the National Crime Agency found. And I think she looked to the list and just thought, no, this is, this is, I'm not doing this.

35:52This is going to be too, too, too accusatory. And so she is no longer replying to my messages. I live in hope. I still hope that I can go to Paris and interview her because look, if there's a, if there, if there's a story about this, if she can refute these allegations and she's got some counter narrative, I'm all ears. But for the moment, she's sitting under house arrest in Paris and is looking at at probably some very long jail time if these accusations are proved.

36:19James Wilson: But there is still a bit of a paradox there or something unresolved, which is if I suspend disbelief of why didn't she know and sort of buy that idea that, and I think it's very plausible, right? Of course, there's a huge amount of self-delusion and, you know, telling of one's own narrative involved here. But you've got to imagine that someone at some stage told her, you are on various sanctions list. You are a person of interest. There's a reason why you can't do business in certain ways, you know, but at the same time, I'd like to hope there is a, I'd like to think there is a hope here that you will get to talk to her because if you can actually delude yourself into the belief that you are so legitimate you can fight a niece, then no amount of an investigative journalist asking hard questions should bother her.

37:03Yes. Surely. And it is worth saying there's an interesting aspect around this and I'm not sure where to land on this, but there's a gendered aspect to this story as well, in that Katarina Zdanova, she's a very glamorous individual and I think that's why, you know, a lot of the reporting around concentrated on her. She also was, you know, there's a lot of information about her, you know, released by the National Crime Agency. There are a whole bunch of men in this network as well, some very powerful and well-connected men back in Russia. None of them have been arrested and accidentally got onto a plane and it's not the first time where I've been investigating a story and a woman at the heart of the story ends up arrested and sometimes convicted when the male co-conspirators just vanished and haven't been.

37:48There were men arrested, by the way, as part of this operation. Money launders, people driving that drug money around the UK. Loads of them were picked up and nicked. But the top level sort of people running this international ring, it's a Katarina, the woman who's under arrest. The men are still accused and out there. and we'll see what happens there.

38:09James Wilson: Okay, so zooming out now as we wrap up, Jeff, it's a fascinating story and it's as applicable today as it was when these events were happening because ransomware is still a problem. It has evolved and to the point we made, there's still these massive ransoms being paid now by some very niche targeted campaigns. But as I was going through this, I was trying not to get caught up in just the, oh, wow of this and actually bring it back to, okay, but what's the point here? What's the so what? What do we need to learn from this? And, you know, one of the things that struck me is it was the first time I had considered that the calculus of whether you should or whether you should even be allowed to pay a ransom is not just about whether or not you should give financial benefit to that ransomware actor.

38:51James Wilson: But I'm curious from your perspective, like how does this inform your own opinions on the question of should ransoms be paid? Should it be regulated? Should there be restrictions around this? It's a really difficult question, a thorny question, and a question the UK is struggling with at the moment. You know, the government is consulting still on the issue of should there be restrictions on ransomware payments? Should ransomware payments be banned? The horrible thing about this is it would be so amazing if the UK could be, you know, the first place on earth, I think, to say, we don't pay. The UK, we do not pay.

39:27We don't come here. We don't pay. because once that message beds in, it is the case that the ransomware gangs will start, you know, there will still be state-driven sort of ransomware attacks, like encryption attacks, but that money-motivated ransomware, if you can get the message over, eventually they will just stop knocking because you don't stop paying. They will put huge amounts of pressure on you in the interim. But if you can fast forward to that moment where the UK was just a non-paying country, or any country, that would just be amazing. The problem is the pain you inflict as you do that.

40:01So day one, you ban ransomware payments. You say no one in Britain will pay and we're going to prosecute people who do. You put in a really heavy regime to make sure not one single ransomware payment is made by any UK entity. Right. OK. And then day two, they ransomware a hospital. And then day three, they ransomware a supermarket. and then day four they ransomware the bus network. You know, you have to hold the line and endure all that pain to get to that point in the future. That's the horrible thing. I hate the idea of criminals being paid. These ransomware gangs are horrible people and I've investigated a lot of them.

40:39Unfortunately, you can't simply outlaw ransomware payments, but you can, and I believe you must, iterate towards that. I mean, one of the issues, the ideas that the UK government's thinking of is a database of ransomware payments. So at least you know how many are being paid. I think it's gnarly, but it's not a bad way to go because you suddenly start getting a picture on, okay, how much is being paid here, what's being paid. You can get an intelligence picture. You can start to bring things together. Anything we can do to move down the path towards being a non-pay country is good. And there's going to be some pain in getting there.

41:13That's what we have to do. I'm realistic about the fact we can't outlaw them today. But a roadmap as to how we get to a non-paying country status, I think is really worth doing. Because, I mean, people are just horrible. They're venal. They're horrible people who are just holding the rest of up to ransom. They're bullies. I mean, this is what people don't realise about crime. They are bullying people. And I hate that.

41:36James Wilson: Yeah. Bullying horrible people. But interestingly, what this has exposed for me is that it's a whole network of quite vile individuals. you know it's it's a different equation in my mind to say will i pay the ransom or not should i pay the ransom or not when you understand fully that that ransom is not just getting in the pockets of someone that goes and buys their lamborghini it is facilitating street crime drug crime all other sorts of crime around there people trafficking was part of this network they were they were putting the money into buying properties that they would then use to house trafficked people forced labor you know that there's a heavy end to all of this the idea that ransomware is this digital thing you're absolutely right james you know this the ransomware payments go into feeding criminality that deprives people of their liberty and keeps them in slavery that's where a lot of that stuff ends up you know yeah but uh you know to your point around we can't ban it today um but there is hope for various things we can do to move towards that point i I think I remember seeing recently some statistics showing that actually the ransomware, I guess, target space is compressing somewhat, right?

42:40James Wilson: We're seeing less in the very small, medium enterprise and a little bit less in the very, very high echelon. And it's sort of getting compressed into this middle of market, which on the show, I think we sort of speculated was due to just the sheer pressure of law enforcement being placed on ransomware gangs, where you make too much noise, you ransom the wrong people, and you get that sort of attention. Is that helping here? Or is that just a bit of an outlet? Like, I'm just curious as to, do you read, do you see that same signal and what do you make of it? It's really interesting. And I think you're right.

43:16Traditionally, cybercrime, particularly ransomware, wants to occupy that middle zone. You've got to hit a target that's big enough to pay some decent money. Otherwise, no point. But you hit a too big a target, you're in trouble, which is the whole colonial pipeline dark side story.

43:29James Wilson: Yeah. You know, big oil supplier in the US got hit, paid the ransom, but then the US government managed to get it back and the dark side gang got in all sorts of trouble because they were attacking critical infrastructure. You don't want to go there. So you want to stay in this very, very middle tier. And what you'll see is movement around in that tier, you know, sometimes hitting slightly bigger targets, smaller targets. But fundamentally, you're going to stay in that tier. You do make a good point. What's interesting is, can we squeeze even that middle tier? Is there a point where, if you like, the seam, to use a mining analogy, the seam of victims of their fertile territory, not too big, not too small, that Goldilocks zone, that seam, if you can squeeze that seam, does that seam get to the point where it's just not worth mining it anymore?

44:16That's an interesting question. But it's really difficult because ransomware evolves and morphs and one gang gets shut down, another gang comes up. It's, you know, consistent, sustained sort of pressure on ransomware might minimise that seam, but there's always a chance that, you know, a new gang will set up somewhere, a new piece of infrastructure will set up somewhere. And, God, I mean, it's 2026. I think the first time I covered ransomware was 2010, was it? It's 15 years ago. Like, this is a juggernaut of cybercars. sometimes have these moments of thinking i've been in this business too long so you know it ransomware you are talking about a generational problem of crime now you're not talking about a new thing that's popped up and you can try and crack down on you're talking about significant vested interest very experienced individuals very developed business models you know it'll take a generational response to finish off what's now become a generational crime it's no longer a new crime anymore ransomware is is now an old and traditional crime like burglary or car crime or whatever

45:15James Wilson: Yeah, it's amazing that it has matured to that status. Well, Jeff, thank you so much for dropping by to chat through this. It's certainly broadened my perspective and understanding of just the entire ecosystem and what's really at stake here when those ransomware payments are made, as well as entertaining me with some very colorful individuals. But mate, great to see you. Thank you so much for your time. Thanks so much for having me, James. Good to speak.