Bank of Russia blacklists 2,600 crypto wallets linked to suspected scams

The Bank of Russia has added 2,600 crypto wallets linked to suspected illegal financial activity to a system used by banks and law enforcement after more than 1 billion rubles flowed into the addresses during the first half of 2026.

The Bank of Russia said the wallets belonged to companies, projects, individual entrepreneurs and other entities showing signs of illegal activity in the financial market. Banks and law enforcement agencies use the information system for digital compliance, client risk assessments and financial investigations.

During the same six-month period, the regulator identified 2,891 entities with signs of illegal financial activity, down nearly 31% from the first half of 2025. The figure remained close to the level recorded during the second half of last year.

Bank of Russia adds 2,600 crypto wallets to monitoring system

The 2,600 crypto wallets were added to a database that can help financial institutions assess transactions connected to entities flagged by the regulator. More than 1 billion rubles in crypto, based on its ruble equivalent, had been attracted through the identified addresses, according to the central bank.

The regulator sends information on suspected illegal financial activity to law enforcement agencies, Russia’s Federal Antimonopoly Service and other authorized bodies. Banks took restrictive measures against more than 500 payment details used for illegal financial activity during the first half of 2026.

Regulatory action during the period led to more than 330 administrative cases based on material supplied by the central bank, including information collected during previous reporting periods. Authorities took more than 450 other enforcement measures and restricted access to over 11,800 online resources belonging to suspected illegal financial market participants and pyramid schemes.

Crypto remained a common payment method among schemes tracked by the regulator. More than 74% of identified pyramid schemes used cryptocurrencies to attract funds, while the rest relied on foreign payment services or cash. Organizers used more than 940 websites, 120 Telegram channels and over 2,500 social media pages to bring users into their projects during the first six months of the year.

The figure was lower than in 2025, when the Bank of Russia identified more than 4,600 crypto wallets used by organizers of pyramid schemes to receive initial investment payments. Crypto was accepted by 84% of pyramid projects identified last year, up from 77% in 2024.

As crypto.news previously reported, the regulator has linked digital assets to fraudulent investment schemes for several years. In 2024, the central bank warned that scammers were using memecoins, tap-to-earn games and other popular crypto trends to attract victims. Its first-half 2024 data showed more than 3,490 entities with characteristics of pyramid schemes, 43% more than a year earlier.

Crypto remains a common tool in investment scams

Pseudo-investment projects identified this year frequently offered exposure to cryptocurrencies or promised income from crypto mining, according to the Bank of Russia. Some schemes promoted investments in data centers supposedly supplying computing capacity to miners, while others offered digital tokens said to track gold prices.

The regulator identified 929 entities with signs of financial pyramid activity and another 379 suspected of illegally attracting investments during the first half. Combined, the number of pyramid and other pseudo-investment projects fell 44% from the same period in 2025. Most operated online without physical offices and contacted potential clients through social networks, messaging services or phone calls.

Illegal lending moved in the opposite direction. The number of identified illegal lenders doubled from the first half of 2025, reaching 999, compared with 467 a year earlier. The Bank of Russia linked part of the increase to tighter requirements for legal lenders, which limited access to borrowing for customers with high debt burdens.

Among the products promoted outside the formal financial system were so-called crypto loans. Such services offered borrowers loans denominated in Tether’s USDT stablecoin or rubles converted at a specified exchange rate. The regulator said it continued to receive hundreds of complaints about the model while websites associated with such projects were blocked and replaced with duplicate resources.

Russia has been moving to bring more cryptocurrency activity under licensed financial institutions while keeping domestic crypto payments restricted. A law approved this summer created rules for exchanges, brokers, custodians and other intermediaries, with the Bank of Russia responsible for supervising the market. The framework permits regulated crypto activity and certain cross-border uses while maintaining the ban on using cryptocurrency as a domestic payment method.

Ahead of the new framework, the central bank published draft operating rules for cryptocurrency exchanges and digital asset depositories, including capital requirements and official registers for licensed market participants. The rules were prepared ahead of the country’s regulated crypto market rollout scheduled for September.

Russian authorities have been taking enforcement action against crypto businesses suspected of operating outside permitted channels. Back in August, more than 20 people were detained after authorities raided nine crypto exchanges in Moscow. Investigators alleged that the services converted proceeds from scams into cryptocurrency before transferring the assets to handlers in Ukraine.

Scammers turn to fake Kanye West ticket sales

Separate fraud campaigns detected this month have used crypto payments to target Russians seeking tickets for Kanye West concerts.

Cybersecurity company F6 said its Digital Risk Protection analysts found at least 10 websites registered since Aug. 17 across the .ru, .com, .site and .shop domains. The pages used names connected with West, including variations containing “ye,” “yerussia” and “ye-tickets,” while presenting themselves as official ticket or tour websites.

Some of the sites allowed visitors to select apparently available seats before requesting payment in cryptocurrency. Prices ranged from $60 for upper-level seating to $2,100 for a VIP box, according to F6. Other pages requested transfers to a phone number, with advertised ticket prices ranging from 28,000 rubles to 6.2 million rubles.

Several fake pages advertised tickets for concerts in Moscow even though the two announced performances were scheduled for St. Petersburg. Other sites redirected users who clicked the purchase button to illegal online casinos.

F6 found at least seven Telegram bots connected with the ticket campaign. Only one was active when researchers checked on Aug. 21, offering users a mini-app for selecting seats and entering contact details before requesting payment through a phone-number transfer. The company said requiring crypto or phone transfers when no other payment options are available is a sign of possible fraud because recovering money sent through such methods can be difficult.

The campaign follows other attempts to use interest in cryptocurrency to impersonate established Russian financial institutions. The anti-fraud project Moshelovka previously reported schemes that claimed to give Russians access to cryptocurrency trading through the Moscow Exchange.

The real exchange has been expanding its crypto-linked products within Russia’s regulated market. Moscow Exchange introduced indexes tracking Solana, XRP, Tron and BNB in May, adding them to its existing Bitcoin and Ethereum benchmarks. The products were designed for professional investors, while direct cryptocurrency trading remained outside the exchange’s existing offering. Moscow Exchange planned to expand the benchmark list to 10 crypto assets and had discussed futures linked to its crypto indexes.