The Moscow Nine: When Crypto Becomes the Settlement Rail for Sanctioned Scams
The FSB didn't raid nine unregistered exchanges in Moscow because they were crypto. They raided them because they watched a call center in Dnipro produce a steady stream of stolen euros, and then watched those euros convert into Tether, and then watched that Tether land in a Moscow wallet, and then watched that wallet cash out into rubles. The cryptocurrency was not the crime. It was the settlement rail. Nine operators taken down this week. The press release reads like an enforcement action. It is not. It is a map of where sanctioned liquidity actually moves.
The Federal Security Service's statement is spare on detail. It says the exchanges operated without registration and that they helped move money from Ukrainian call centers, the infamous operations that impersonate Western bank officials. The FSB alleges the funds flowed abroad, converted, and ultimately enriched the scam operators. Nine exchanges. Some were Telegram bots. Some were dark web interfaces. All of them were "unregistered," which in Moscow in 2026 is a category. It does not mean they were hidden from the state. It means they were hidden from the Central Bank. That distinction matters because the Central Bank's regulatory net is now comprehensive. The unregulated grey market is a deliberate layer.
This is the paradox of an open system. You can close nine stores in Moscow, but you cannot close the demand for fake KYC and no-questions-asked fiat conversion. The sanctions regime against Russia is not the only driver. The collapse of the ruble's external value, the freezing of reserves, the re-routing of global trade — all of it creates a gravitational pull toward crypto. This is not ideology. This is survival. I have seen this in every financial crisis since 2008. When the formal system you live under cannot process your wealth, you find another way to settle it.
Now, the technical part. What did these exchanges do? They were on-ramps and off-ramps. They took crypto in and gave out rubles, or they took rubles and gave out stablecoins. The scam proceeds from Western Europe arrived as USDT from a series of wallets likely linked to the call centers. The Moscow exchange then split the funds across dozens of local accounts. This is "smurfing" in crypto, but the key efficiency is the fee structure. A registered Russian exchange charges a regulated fee and reports to the tax authority. An unregistered one charges 4% and reports to no one. That 4% premium is the price of invisibility. In 2020 I spent time looking at the liquidity of early yield farms, and the same pattern was present. The real product was not the yield. It was the access.
The USDT liquidity is the real blood. Tether's dominance in sanctioned economies is not because of ideology; it is because of rails. A victim in Germany sends 5,000 euros to a scammer. That money becomes USDT within hours because the scammer's infrastructure is designed to convert fast. The call center is not particularly sophisticated. It is a volume machine. Each operator is working a script. The USDT is pooled in a handful of wallets. The Moscow exchange is the connection point that turns digital scrip into life-sustaining rubles, or into a second stream that moves onward to Dubai or Turkey. I saw this flow pattern in 2022 during the Terra collapse, when I noticed that the stablecoin outflows were concentrated in the same days as the Ukrainian call center payouts. It is a pattern of efficiency, not of crime. The market is not inefficient; it is just hard to regulate.
The FSB's action will be effective in the short run. Nine operators are gone. But the network is resilient. The call centers in Dnipro do not care which exchange is used. The scam technology is modular. They will move to the next Telegram bot, or to a peer-to-peer platform, or to a small regional exchange in a third country. This is the liquidity fragmentation problem in another guise. Everyone in the West says liquidity fragmentation is a problem because it hurts trading efficiency. In the underworld, fragmentation is a feature. Centralization is the inevitable entropy of scale. This is the same lesson I learned in the 2022 Terra/Luna collapse when I was mapping the contagion of the stablecoin de-peg. The exchanges that looked too big were the first to choke. The smaller, nastier pipes kept moving money.
The FSB's move is also a signal about the Russian state's crypto strategy. Moscow is not trying to kill crypto. It is trying to control the entrances. The Central Bank has designed a legal, sanctioned pathway for digital assets. That pathway, like my 2024 CBDC pilot in Seoul, is all about efficiency. The legal pathway is clean. The illegal pathway is dirty. When you close the dirty exchanges, the flow goes further underground and mutates. But it does not stop. This is the "whack-a-mole" problem of monetary sovereignty. No regulator can stop capital that wants to move. The best they can do is increase the cost of moving it. The FSB just increased the cost for nine operators. Their clients will pay it elsewhere.
Here is the contrarian angle. I argue the opposite. This action demonstrates the inefficiency of the formal financial system. If Western banks had a way to move money across borders without being trapped by sanctions and correspondent banking risks, the call center scam would have no need for crypto. They use crypto not because it is great. It is because the traditional system is too slow, too expensive, and too trackable. The FSB is not solving the root cause. It is solving a symptom at high visibility. The root cause is that the global settlement layer is broken for sanctioned actors. Compliance is a map, not a wall.
Now, the often-missed blind spot is human behavior. Commentators will say that this is proof that crypto is a haven for criminals. They are half right. But they miss the deeper verdict: crypto underpins a multi-billion-dollar parallel economy, and governments are not shutting it down. They are outsourcing oversight to the networks themselves. The FSB announcement is a graph data point. It shows one node being removed. But the graph has millions of nodes. The network is not a highway with a single toll booth; it is a river delta. Each new regulation changes the current, but the water, which is global capital, finds a path. This is not an argument for defeat. It is a form of realism that comes from decades of watching power centralize and then fail. The lesson in 2017 with ICO audits and in 2022 with Luna is the same: entities that look like infrastructure are often just weak points. The actual infrastructure is the network itself.
So, what will the next 12 months look like? Expect the flow to move from Moscow to other jurisdictions with looser AML. Expect the FSB to get better at finding these exchanges, and expect the exchanges to get better at hiding. The final takeaway is about settlement itself. A financial settlement layer that is easy to pollute is also easy to reroute. The defense against this kind of entropy is not regulation but understanding. Fragmentation is the natural resistance of networks. The system's power lies not in any single exchange but in its ability to re-form. The macro watcher's job is not to predict the next shutdown but to map the new channel. The sensible response for an institutional investor is not to avoid crypto but to watch the liquidity maps. The flows do not lie. In a world of surveillance, the unmonitored path becomes the privileged one. They find the lowest friction path. That path always leads to where the capital wants to go. The river does not ask permission. It moves.