​“The names are known.” Who is behind the transfer of 10 000 BTC of the WEX crypto exchange

Large sums in bitcoin stolen from the WEX exchange (formerly BTC-e) are transferred to several trading platforms, whose owners have no comment on what is happening. Analysts and market participants are figuring out who is behind the transfers and who the beneficiary is.

On November 23, 10 000 BTC were transferred from the wallet of the closed Russian crypto exchange WEX (BTC-e). This was reported by the InDeFi Smart Bank CEO Sergey Mendeleev on his Telegram channel. He also shared the addresses to which the bitcoins stolen from WEX customers were partially transferred.

It turned out that one of the wallets belongs to the HitBTC crypto exchange. The platform received a transfer of 65 BTC (~$1 million). According to a check using the GetBlock blockchain explorer, the 65 BTC were moved from the same exchange address to another address, no longer being identified as dirty coins.

Asked about the implications of the likely money laundering process for the exchange, Mendeleev said that this question “should be asked to the investigation.”

“HitBTC is a Russian service with Russian owners, I know them, I am ready to give official testimony on this issue in the criminal case of WEX. But so far the investigator has not called me, although he has my phone number,” Sergey Mendeleev said in a comment for GetBlock Magazine.

In his opinion, one cannot draw unequivocal conclusions about internal transfers on the exchange. “I can’t know what happened to the money after it hit the exchange. The user’s account could have gone into a block immediately after the transaction, and the balance could have been frozen. However, the silence of HitBTC’s official channels, when they have been mentioned in the world media in connection with the incident for 24 hours already, surprises me, to put it mildly,” the head of InDeFi Bank commented.

How bitcoins were transferred

Suspicious bitcoin transfers drew the world’s attention. Such major English-speaking publications as Coindesk and Cointelegraph wrote about the incident. Russian media outlets and Telegram channels are also offering versions of who is behind the transfers and who the final beneficiary is.

Ki Young Ju, the co-founder of CryptoQuant, an analytics company, publicly called on HitBTC to comment on the suspicious activity at the exchange-owned address.

Hey @hitbtc. You should suspend this account for suspicious activity; here's the wallet address.https://t.co/2pdHZ2ubEY — Ki Young Ju (@ki_young_ju) November 24, 2022

A separate post was published on Chainalysis’ blog dedicated to WEX (BTC-e) wallet on-chain data. Analysts pointed out that at the end of October there were several transfers from the wallets of the exchange to the Webmoney payment service. Then, after a “test payment” on November 11, about 100 BTC were “not directly” transferred to an unnamed exchange later on November 21.

As noted by Chainalysis, of the total number of coins sent in recent days, approximately 9 950 BTC remain in personal wallets. The rest were transferred through a number of intermediaries to four deposit addresses at two major exchanges. At least one of them could serve as an intermediary for WEX (BTC-e) money laundering, Chainalysis analysts speculate.

After a year of near dormancy, BTC-e today sent $165M in Bitcoin to a group of personal wallets, exchange deposit addresses, and other services – its largest withdrawal since Apr 2018. Read on those tx’s and others from the rogue exchange in recent weeks. https://t.co/HxamLo1lrL pic.twitter.com/GSZyrm8iZu — Chainalysis (@chainalysis) November 24, 2022

Later, Mendeleev published a new post on his Telegram channel, naming the second exchange as the recipient of the stolen bitcoins. It was the MEXC platform, which was confirmed through the GetBlock explorer. The head of InDefi Bank published the address 3FAvDyK3NtuBaMgXknCKoM5RBTCp49cZ7x, to which, he said, “stolen WEX bitcoins were sent in $30 000 portions all day.”

Who is behind the transfers

When asked who initiates bitcoin transfers, Mendeleev points to WEX (BTC-e) exchange administrator Alexey Bilyuchenko, who is imprisoned in the Matrosskaya Tishina prison in Moscow. “Of course, sitting in prison it is extremely difficult to initiate anything physically directly, but to pass the command to a trusted person is of course possible, for example through a lawyer,” Mendeleev adds.

The second administrator of the exchange is Alexander Vinnik, who was detained in Greece in 2017. Vinnik is currently awaiting trial in the United States. He is accused of laundering at least four billion dollars through the BTC-e exchange, including bitcoins stolen from the Mt. Gox exchange.

In 2019, Bitcoin Insider linked the HitBTC exchange to Andrey Savchenko of Russia. The publication called HitBTC “the most fraudulent exchange after the late Mt. Gox” and suspected it of initial public offering (ICO) fraud. The platform actively offers its listing service to projects by approaching them personally.

The crypto exchange’s website claims that it is registered in Hong Kong and has an office in Chile. However, the invoices show other details of the company, namely Seychelles.

According to Digiconomist, neither the location of the headquarters nor the identity of its owners can be confirmed. The review site points to another owner of the exchange, a Danish company called Ullus Corporations K/S, which was actually liquidated in February 2015. Bitcoin Insider admitted that Ullus Corporation is the same company that later opened the German Fidor Bank, and its key person is Andrey Savchenko.

The information about the Russian owners is absolutely reliable, Mendeleev confirms. “I really hope that they will make an official statement that the money is frozen and not have to call their names publicly,” the head of InDefi Bank says.