Cyber police investigate $235 million money laundering scheme via crypto exchanges and 1xBet platform

Mechanism of illegal fund laundering

The Cyber Police Department of the National Police of Ukraine has established a scheme for the illegal appropriation of monetary assets on an especially large scale. The perpetrators withdrew funds from bank accounts and accounts on cryptocurrency exchanges. These assets were then laundered through the illegal betting platform 1xBet by simulating top-ups of gaming accounts, placing bets, and conducting operations in online casinos.

To convert the funds, the perpetrators used the following exchanges: Bybit, Binance, OKX, BitGet, Kyrrex, and WhiteBIT. A criminal case has been opened under number 12026100070000705 under Part 3 of Article 209 of the Criminal Code of Ukraine. This article provides for liability for the laundering of proceeds obtained by criminal means, committed on an especially large scale or by an organised group.

Operations of the illegal 1xBet platform

The web resource 1xbet.com operates as an online gambling platform without a valid licence in Ukraine. Despite access being blocked, the service continues to serve users from the territory of our country, using mirrors, alternative domains, and other methods to bypass restrictions. Previously, the High Anti-Corruption Court upheld the Ministry of Justice's lawsuit and applied sanctions to Royal Pay Europe LLC, which is linked to the Russian bookmaker 1xBet.

Large-scale transactions via Kyrrex exchange

During the analysis of cryptocurrency wallets used by the 1xBet platform to accumulate and move virtual assets, the investigation revealed large-scale outgoing transactions to the Kyrrex exchange. From 19 January 2022 to 27 February 2026, approximately $235 million was transferred to Kyrrex accounts.

A review of exchange data confirmed the movement of digital assets on the TRON (TRC-20) network. Specifically, numerous withdrawals of USDT were recorded between 10 November 2025 and 18 February 2026 to external addresses. Individual transaction amounts ranged from 125,670 USDT to 10 million USDT.

Asset transfer route

The established route for fund transfers is as follows: 1xbet.com → Kyrrex → Kyrrex internal (cold) wallets → third-party centralised exchanges, including Binance, WhiteBIT, and other services. Some assets passed through intermediate unidentified addresses (transit wallets), which were used to split sums and complicate tracking of the final route. This approach indicates further consolidation, distribution, and possible concealment of the origin of funds by moving them between different platforms.

Link to the aggressor state

An analysis of available technical information and open sources revealed signs of a potential link between the web resource's activities and entities associated with the territory and jurisdiction of the aggressor state. In particular, data from the Bybit crypto exchange showed a significant number of individuals—citizens of the Russian Federation—receiving large volumes of assets. These circumstances indicate the creation of channels for uncontrolled fund movement through electronic payment systems and cryptocurrency instruments, posing a threat to financial flows benefiting structures affiliated with the aggressor state.

Measures taken

A list of exchange users from Ukraine involved in the scheme has already been established. Among the crypto wallets seized by the investigation are accounts belonging to well-known Ukrainian businessmen. Details will be released later.