Russia didn’t hide its dirty money in dark corners. It ran its entire secret crypto network through London and Frankfurt, two of the world’s most regulated financial centers
THE WRONG ASSUMPTION
The previous part of this series documented Vladislav Surkov, the man at the top of the command chain, whose IP address resolves to the Main Directorate of Special Programs of the President of the Russian Federation. But the network he oversaw did not stay inside Moscow. The money had to go somewhere. And where it went is what makes this investigation so significant.
When people imagine dirty state money, they picture the usual places: Caribbean islands, Swiss numbered accounts, shell companies in Panama or the British Virgin Islands. Places built for hiding. Places that look like hiding.
This network used none of those. The two main Western points the money passed through were London and Frankfurt, the financial capital of the United Kingdom and the banking center of the European Union. Two cities with some of the most sophisticated financial regulators in the world. Two cities that saw none of it.
“The money didn’t need to hide. It walked straight through the front door of the world’s most reputable financial centers, and no one asked any questions.”
LONDON: THE BEATING HEART
Three IP addresses in London were responsible for 80 to 85 percent of all significant financial operations connected to the network documented in this series:
→ 134.213.199.147 – provider Rackspace
→ 45.156.88.252 – provider Eonix London
→ 45.156.88.226 – provider Eonix London, King’s Cross (primary entry point, 80-85% of logins)
London Scheme 2: funds flow from a Skolkovo-registered wallet through the foundation’s public wallet into the London hub at King’s Cross, then split to multiple destination wallets. Every path in this diagram runs through the same London infrastructure. Source: intelligence analysis of public blockchain data.
These three addresses were not used for one operation or one wallet. They appear across the entire network, connecting the foundation’s public wallets, the Monero group operating in the Central African Republic, and a Bitcoin reserve fund that peaked at $85 million. Three completely separate financial operations, all running through the same London addresses. All of it administered from within one of the world’s most tightly regulated cities.
The Monero wallet used for operations in the Central African Republic logged in from the same King’s Cross IP address as the foundation’s own wallets. The Bitcoin reserve fund, which peaked at $85 million, also operated from the same London hub. Same hardware. Same router. Same physical location in one of the most watched financial cities on earth.
There is one more detail that belongs here. The administrator of the foundation’s public Bitcoin wallet connected to the network without a VPN on exactly two occasions on September 25, 2023 and October 8, 2024. Both times, the IP address resolved to 178.238.11.6, Tower Hamlets, London. The dates of those two unprotected logins coincide with the release of new iPhone models. The most likely explanation: the wallet administrator was switching to a new phone and briefly forgot to activate the VPN before connecting.
THE $85 MILLION RESERVE
One of the most significant findings in this investigation is a Bitcoin reserve fund holding 683 BTC, with a peak value of approximately $85 million. The fund is stored on a Ledger Nano S cold wallet and administered exclusively from the same three London IP addresses documented above.
The reserve fund operates on a simple pattern. Over the last 15 months of documented activity, 61 consecutive transactions were made, each simultaneously splitting into two wallets. The first receives the principal storage amount. The second receives a smaller operational amount, equivalent to $100,000 to $200,000. On July 7, 2023, one of these smaller disbursements went directly to the foundation’s public wallet.
A Russian state reserve fund that peaked at $85 million, administered from King’s Cross, London. Sitting in plain sight inside the regulatory perimeter of the Financial Conduct Authority.
London Scheme 3: the Bitcoin reserve fund, which peaked at $85 million, administered from the same London IP addresses, making periodic disbursements, including a direct transaction to the foundation’s public wallet. Source: intelligence analysis of public blockchain data.
FRANKFURT: THE BRIDGE
While London served as the network’s primary Western hub, Frankfurt played a different but equally essential role. A single IP address, 212.20.150.2, Hesse, Germany, functioned as the bridge between Skolkovo and the rest of the network. Funds arrived from Moscow, sat at the Frankfurt node, then moved on. Sometimes to London, sometimes directly to New York, sometimes back to other points in the chain.
Frankfurt’s job was simple: put distance between Moscow and the next stop. A system scanning for direct Skolkovo-to-London transfers would find nothing, because that transfer never happened directly. It went through Frankfurt first. Through the banking capital of the European Union.
“Moscow to Frankfurt to London to New York. Every step of this money trail passed through some of the most advanced financial regulatory environments in the world. None of them stopped it.”
WHY THE WEST FAILED TO SEE IT
The answer is not incompetence. Western financial regulators are good at what they do. The problem is what they were built to do, and the Russian network was not it.
Regulators look for sanctioned individuals, flagged entities, and known high-risk jurisdictions. The London and Frankfurt nodes were none of these. They were commercial IP addresses belonging to legitimate providers in major Western cities. The wallets they administered were connected to what appeared to be a civil society organization. The rules covering NGO finances in the UK and EU are far weaker than those applied to banks.
Russia did not exploit a loophole. It exploited an assumption: the assumption that the financial infrastructure of open, democratic societies is the wrong place for state money laundering. That assumption turned out to be precisely wrong. The openness of Western financial systems was not a barrier. It was the cover.
“Russia chose London and Frankfurt not despite their reputations, but because of them. A transaction routed through King’s Cross looks nothing like dirty money. That was the point.”
The final part of this series steps back from the details to the full picture: what this investigation, taken as a whole, reveals about how Russia moves its money through the Western financial system, and what it means for the Western institutions that have been unknowingly hosting it.
NEXT: The Sistema Files | Part 8 – One Investigation. One Pattern. One Blueprint.