How the Kremlin built a money laundering pipeline that operated in the open, and why the West’s financial system never saw it coming
THE MECHANISM
The previous part of this series established what Skolkovo is: a state-controlled technology complex operating under Presidential Administration oversight, with purposes that go well beyond innovation. This part follows what Skolkovo actually did: how its infrastructure was used to move money across borders, through layers of organizations that appeared entirely legitimate, and out the other side as untraceable cash.
What the blockchain reveals is not a single transaction, or a single suspicious wallet. It is a structured system, with defined entry points, routing logic, intermediate nodes, and final cash-out destinations. Someone engineered this. And the engineering is visible, permanently recorded, and impossible to dispute.
“Russian state infrastructure sent money out. Russian state infrastructure received it back. Everything in between was designed to make that connection disappear.”
WHERE THE MONEY STARTS
The trail begins at two IP addresses registered to the Skolkovo Innovation Center in Moscow: 79.174.12.175 and 79.174.12.178. From these addresses, cryptocurrency wallets were registered, administered, and used to initiate transactions that would travel through multiple countries before reaching their final destination.
The pattern across these wallets is consistent and deliberate. Each one was registered using the same MacBook device, a digital signature that ties the entire network to a single administrator. Each wallet connects to the next through carefully timed transactions, with amounts split and redistributed in patterns designed to obscure the origin of funds while maintaining full operational control.
This is not the behavior of individual donors. This is the behavior of a managed financial network, built to move specific amounts, through specific routes, on a specific schedule.
THE ROUTE
The transaction logic documented in this investigation follows a consistent pattern across multiple operations. Cryptocurrency originates from wallets registered at Skolkovo Center IP addresses. It moves to a second node; in several documented cases, an IP address in Frankfurt am Main (212.20.150.2, Hesse, Germany), which acts as a go-between, receiving funds from Skolkovo and forwarding them onward, sometimes with a delay of weeks, sometimes simultaneously with the incoming transfer.
Frankfurt’s role in this network is purely structural. It is not a destination. It is a junction. Its function is to insert distance between the originating Skolkovo wallets and the next node in the chain, creating a layer of separation that makes the connection harder to trace through standard financial monitoring systems.
Transaction Scheme 1: cryptocurrency flow from Skolkovo-registered wallets through intermediate nodes to a cash-out point in the EU zone. Source: intelligence analysis of public blockchain data.
THREE DOCUMENTED SCHEMES
The investigation documented three distinct transaction schemes, each using the same Skolkovo infrastructure but routing funds through slightly different paths. What they share is a common destination logic: funds that enter the system from state-linked Russian infrastructure exit the system as physical cash, handled by individuals with no visible connection to the Kremlin.
In the first scheme, a wallet registered at Skolkovo Center IP 79.174.12.175 initiates two simultaneous transactions. One goes directly to a public foundation wallet. The second goes to Frankfurt am Main, where it sits for approximately one month before being forwarded in full to New York (IP 198.51.44.7). The split-and-delay technique is a recognized method for defeating automated transaction monitoring systems.
In the second scheme, funds arrive from Binance 4, a specific exchange account accessed from a Moscow IP address, routed through an intermediate Russian wallet, then split into two simultaneous outgoing transfers, one of which goes to Frankfurt. The Binance account behind this flow sent approximately $2 million across 124 separate transactions, a volume no individual donor produces. A second account on the same exchange sent an additional 48 transactions from a temporary email address with no traceable registration. Two coordinated accounts. One pipeline.
In the third scheme, two wallets (one registered at Skolkovo, one at Frankfurt) make simultaneous transfers that converge at the same destination wallet, where the amounts are combined before being forwarded as a single payment to the final cash-out point: Klaipeda, Lithuania.
“Three different routes. The same origin. The same destination logic. The same Skolkovo MacBook at the start of every chain.”
THE CASH-OUT
At the end of the documented transaction chain sits a wallet that was created at Skolkovo Center and subsequently transferred to two Russian nationals, referred to in the investigation as Oleg and Yuri, aged approximately 35 to 45, who operate a cryptocurrency cash-out service in the EU zone. The wallet bears all the technical signs of Skolkovo origin: registered via the same MacBook, connected via Bluetooth to a Ledger Nano S hardware wallet, with an iPhone 11 as the secondary access device.
Oleg and Yuri’s operation is not small. According to information documented in the investigation, they convert cryptocurrency to cash for the grocery retail chain Rimi at a rate of €100,000 five times per week. The cash-out wallet was centrally created at Skolkovo and handed to them, a detail that places ultimate control of this operation, from origin to exit, within the Skolkovo infrastructure.
The operation run by Oleg and Yuri is not independent. They work with the direct support of Vagit Alekperov, former president of Lukoil, sanctioned by the US Treasury in 2022, and at least one of them has family ties to him. Alekperov also served on Skolkovo’s Board of Trustees. The man who helped build the cover is connected to the people who cash out the money.
WHY IT WORKED
The architecture documented here is not what people picture when they imagine a state intelligence operation. It does not rely on advanced encryption or untraceable anonymity tools. It relies on something far more durable: the assumption that no one is looking.
Western compliance systems are built around known risk indicators: sanctioned individuals, flagged jurisdictions, suspicious transaction patterns. What they are not built to detect is a network that routes money through an innovation center that Western companies helped build, through a Frankfurt go-between that resembles a legitimate business node, and exits through a cash conversion service that operates, on paper, entirely within the law.
The system worked not because it was invisible. It worked because it looked like everything around it. And that is precisely what makes it so difficult to stop.
“The money didn’t hide. It walked through the front door of the Western financial system, used the infrastructure the West provided, and left without being stopped.”
The next part of this series moves from Bitcoin to the privacy coins, ZCash and Monero, where the same Skolkovo infrastructure intersects with a criminal network operating across three continents, and where a single video game account connects the entire operation back to its source.
NEXT: The Sistema Files | Part 4: The Player Who Gave It All Away