Recommended Free Tools
In September 2024, U.S. prosecutors charged Russian nationals Sergey Ivanov and Timur Shakhmametov in a case involving alleged payment and cryptocurrency laundering services, a carding market, and stolen-card proceeds. The charges describe different alleged roles: Ivanov was linked to payment and exchange services and support for the Rescator carding site; Shakhmametov was accused of operating Joker’s Stash. The charges are allegations, not findings of guilt.
Who was charged, and what did prosecutors allege?
| Defendant | Services or sites prosecutors linked to the defendant | Charges described in the September 2024 announcement |
|---|---|---|
| Sergey Ivanov, also known online as “Taleon” | UAPS, PinPays and PM2BTC; payment-processing support for Rescator; laundering proceeds associated with Joker’s Stash | One count of conspiracy to commit and aid and abet bank fraud, based on alleged support for Rescator, and one count of conspiracy to commit money laundering, based on alleged laundering of Joker’s Stash proceeds. |
| Timur Shakhmametov, also known as “JokerStash” and “Vega” | Joker’s Stash, which prosecutors described as a carding website | Conspiracy counts involving bank fraud, access-device fraud and money laundering, tied to the alleged operation of Joker’s Stash and laundering its proceeds. |
The charges and alleged connections in the table are described by the U.S. Department of Justice (DOJ) announcement of September 26, 2024. An indictment is an accusation. Ivanov and Shakhmametov are presumed innocent unless and until proven guilty.
How were the named services different?
The names refer to different kinds of sites and services, not one interchangeable platform. DOJ alleged that Ivanov created or operated UAPS, PinPays and PM2BTC as Russian payment and exchange services that provided money-transfer and laundering services directly to criminals. Separately, prosecutors described Cryptex as an exchange alleged to have offered account registration without know-your-customer (KYC) requirements. The Eastern District of Virginia’s account of the case identifies the services and related enforcement actions.
Joker’s Stash and Rescator were described as carding websites. DOJ defines carding as the unlawful acquisition and trade of stolen credit- and debit-card information for fraudulent purposes. Prosecutors alleged that Shakhmametov operated Joker’s Stash, while Ivanov provided payment-processing support to Rescator. Those allegations do not mean the two defendants operated the same site or had identical roles.
How much activity did DOJ attribute to the services?
Addresses associated with Ivanov’s alleged services
DOJ said cryptocurrency addresses associated with Ivanov’s alleged laundering services handled approximately $1.15 billion in transactions from July 12, 2013, through August 10, 2024. The department said about 32% of traced bitcoin sent to those addresses came from other addresses associated with criminal activity. It also reported more than $158 million in alleged fraud proceeds, more than $8.8 million in alleged ransomware proceeds and approximately $4.7 million allegedly originating from darknet drug markets. These are government-reported blockchain-analysis figures, not a court finding that every transaction was criminal.
Cryptex
For addresses associated with Cryptex, DOJ reported more than 37,500 bitcoin transactions involving approximately 62,586 bitcoin, valued at about $1.4 billion at the time those transactions were made. The department said approximately 31% of bitcoin sent to Cryptex—about $441 million—allegedly originated from addresses associated with criminal conduct. DOJ further attributed $297 million to fraud proceeds and more than $115 million to ransomware payments. The dollar values for the bitcoin totals are historical valuations, not current market values.
The DOJ announcements attribute parts of the Cryptex analysis to a blockchain-analytics company that provides services to law enforcement, but do not name the company in the text reviewed. These figures are investigative estimates and allegations; they do not by themselves establish that all funds passing through a service were criminal proceeds or that a defendant knew the origin of every transaction.
Joker’s Stash
DOJ said Joker’s Stash allegedly offered data from approximately 40 million payment cards annually and hundreds of millions of cards overall. The department reported estimates of profits ranging from $280 million to more than $1 billion. Those are DOJ-attributed estimates, not an established accounting of the site’s revenue or Shakhmametov’s personal proceeds.
Rank #3
What enforcement actions accompanied the 2024 charges?
According to DOJ’s September 26, 2024 announcement, the U.S. Secret Service obtained court authorization to seize domains associated with UAPS and PM2BTC. Separately, the Secret Service executed a seizure order against two domains used to support Cryptex. Dutch partners seized servers hosting PM2BTC and Cryptex and cryptocurrency valued at more than $7 million from those servers. The announcements describe the seizures at the time; they do not establish the assets’ current disposition.
The State Department offered rewards of up to $11 million for information leading to the arrest and/or conviction of Ivanov and others involved in his alleged laundering services, and Shakhmametov and others involved in Joker’s Stash. That figure and offer are reported in the September 2024 DOJ announcement; it should not be read as confirmation that the offer or its terms remain current.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How does the separate Blender.io and Sinbad.io case fit in?
A different prosecution announced on January 10, 2025 concerned Russian nationals Roman Ostapenko, Alexander Oleynik and Anton Tarasov, who were indicted in connection with the alleged operation of cryptocurrency mixers Blender.io and Sinbad.io. DOJ described a mixer as a service that, for a fee, allowed users to send cryptocurrency to recipients in a way designed to conceal its source. The department said Blender.io operated approximately from 2018 to 2022, Sinbad began operating a few months after Blender shut down, and law enforcement took down Sinbad on November 27, 2023.
At the time of that January 10, 2025 release, Ostapenko and Oleynik had been arrested on December 1, 2024, while Tarasov remained at large. Those details describe the status stated in the release, not necessarily the defendants’ present status. This was a separate indictment from the September 2024 case involving Ivanov and Shakhmametov.
U.S. Attorney Ryan K. Buchanan said: “Blender.io and Sinbad.io were allegedly used by criminals across the world to launder funds stolen from victims of ransomware, virtual currency thefts, and other crimes.” Principal Deputy Assistant Attorney General Brent S. Wible said: “According to the indictment, the defendants operated cryptocurrency ‘mixers’ that served as safe havens for laundering criminally derived funds, including the proceeds of ransomware and wire fraud.” Both statements appear in the Northern District of Georgia’s January 10, 2025 announcement and retain the release’s allegation framing.
What do these charges establish—and what remains unresolved?
The announcements establish that prosecutors filed charges and described alleged roles, investigative findings and enforcement actions. They do not establish guilt, and transaction totals associated with addresses are not equivalent to proof that every transaction was criminal. The DOJ releases reviewed describe the indictments and enforcement announcements; they do not provide complete subsequent court histories. They therefore do not settle current custody, plea, trial, conviction, dismissal or appeal status for all named defendants.
For procedural updates, consult the relevant court records in the Eastern District of Virginia for the September 2024 case and the Northern District of Georgia for the Blender.io/Sinbad.io case rather than treating an announcement-date status as current.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
