How We Found the Network
A routine analysis of a Russian opposition foundation’s public crypto wallets led somewhere no one expected: to a state-run financial network that had been operating in plain sight
WHERE IT STARTED
The investigation began not with a tip, not with a leak, and not with a source. It began with a set of public wallet addresses that the foundation itself published online, and a decision to read them carefully.
Public cryptocurrency wallets are a particular kind of document. They cannot be hidden, cannot be retroactively altered, and cannot be explained away. Every transaction, every address, every timestamp is permanently recorded in an open ledger that anyone in the world can read, for free, at any time.
When analysts began examining the public crypto wallets of a prominent Russian opposition foundation, they expected to find what these analyses usually find: small transfers from private donors, occasional transactions, the standard picture of grassroots funding. Instead, they found a network.
What the data revealed looked nothing like a random flow of donations. It had structure. It was organized, technically coordinated, and connected to infrastructure that had nothing to do with independent donors. A significant portion of the funds traced back to the Skolkovo Innovation Center in Moscow, a technology complex created by presidential decree, operating under direct oversight of the Presidential Administration of the Russian Federation.
“The blockchain has no political opinions. It does not take sides. It records what happened. And what happened turned out to be very different from what it looked like on the surface.”
WHY BLOCKCHAIN IS DIFFERENT
There is a persistent myth about cryptocurrency and anonymity. It goes like this: crypto is untraceable, it is a tool for those who need to move money without leaving a trail. Those who built this scheme were counting on that myth being true.
It is not true. The Bitcoin blockchain is an open ledger. Every transaction in its entire history (every transfer, every timestamp, every wallet address) is recorded in a decentralized network. Anyone can read it for free at any moment. The challenge for investigators is not finding the data. The data is right there. The challenge is reading it.
That is what this investigation did. Using public blockchain data, IP address records, device identifiers, and behavioral patterns, analysts reconstructed the financial network behind the money flows. What emerged was not a picture of grassroots opposition funding. It was a picture of a system: designed, managed, and controlled.
WHAT THE WALLETS SHOWED
The foundation published the addresses of its Bitcoin, ZCash, and Monero donation wallets directly on its fundraising website, a transparency measure so donors could verify their money was arriving. A reasonable decision. One that, as it turned out, made this entire investigation possible.
The foundation’s public donation page at donate.fbk.info: Bitcoin, Monero, ZCash, and Ethereum wallet addresses published openly for any donor to verify. Source: donate.fbk.info
A full analysis of the incoming and outgoing transaction history across those wallets identified several stable clusters of IP addresses responsible for the majority of the foundation’s significant financial operations. These were not private individuals sending small amounts from home computers. They were organized, technically sophisticated operations, and one of their primary locations pointed directly at a state-backed technology campus on the outskirts of Moscow.
KEY FINDINGS
→ Approximately $2 million reached the foundation’s Bitcoin wallet from a single Moscow exchange account, across 124 separate transactions
→ IP addresses registered to Skolkovo appear on both sides of the foundation’s transaction ledger, as senders and as recipients
→ A $512,000 ZCash donation (the only transaction ever made to that wallet) was traced back to Skolkovo infrastructure
→ A $325,920 Monero donation was traced to a closed group operating in the Central African Republic, connected to the same London IP hub used by the foundation
→ A $65 million Bitcoin reserve fund, connected to the same London infrastructure, made a direct transaction to the foundation’s public wallet
THIS IS NOT A COINCIDENCE
The same IP addresses appear across different wallet types, across different time periods, across different directions of money flow. The same devices. The same patterns. The same coordinating infrastructure, appearing on both sides of the transactions.
That pattern does not emerge from random donations. It is the signature of a managed network. Someone designed it. Someone ran it. And they did so not from an offshore server or an anonymous data center, but from a technology campus in Moscow, with Western partners’ names on the founding documents. Sending funds to the foundation and receiving them back. That is not how donations work. That is how a controlled financial loop works.
“The data does not explain motives. It simply shows what happened. And what happened was this: Russian state infrastructure sent money. Russian state infrastructure received it back. Everything in between was arranged so that connection would disappear.”
Who ran this network, how they were connected to Russian intelligence, and what the money was ultimately for: that is what the rest of this series documents. The place to start is Skolkovo: what it officially is, what it actually does, and why this state-backed technology park ended up at the center of a global cryptocurrency network.
All analysis in this series is based on publicly available blockchain data from the foundation’s official donation wallets at donate.fbk.info.
NEXT: The Sistema Files | Part 2 – Inside the Kremlin’s Trojan Horse