The Russian Central Bank has included 2,600 cryptocurrency wallet addresses associated with suspected illegal financial activities in the risk monitoring system used by banks and law enforcement agencies. The agency stated that in the first half of 2026, approximately 1 billion rubles' worth of cryptocurrency assets flowed into these addresses.
This system is mainly used for customer risk assessment, compliance reviews, and financial investigations. The Central Bank of Russia stated that the wallets identified involved various entities such as companies, projects, and individual operators, all of which were found to have signs of illegal financial market activities.
2,891 suspicious entities identified in the first half of the year
The Central Bank of Russia disclosed that in the first half of 2026, a total of 2,891 entities were identified as showing signs of illegal financial activities, which is a decrease of nearly 31% compared to the same period in 2025, but it is close to the level of the second half of last year.
During the same period, banks imposed restrictions on more than 500 payment transactions used for illegal financial activities. Regulatory authorities initiated over 330 administrative cases based on materials provided by the central bank and took more than 450 other law enforcement measures. They also restricted access to over 11,800 related websites and online resources.
Cryptocurrency remains a common payment method
In the identified Ponzi schemes, over 74% used cryptocurrencies to attract funds, while the remainder mainly relied on overseas payment services or cash. Project organizers utilized more than 940 websites, over 2,500 social media pages, and 120 Telegram channels in the first six months of this year to channel investors.
The Russian Central Bank also stated that among the fake investment projects discovered this year, many highlighted cryptocurrency assets as a selling point or claimed to offer returns through crypto mining. Some projects promoted investments in data centers, providing computing power for miners; others issued digital tokens that were supposed to be pegged to a certain price.
By type, in the first half of the year, a total of 929 entities were identified as having characteristics of Ponzi schemes, and another 379 entities were suspected of illegally absorbing investments. The combined number of these two groups decreased by 44% compared to the same period in 2025. However, illegal lending activities have significantly increased, with the number of related entities rising from 467 in the same period last year to 999.
Russia promotes the licensed cryptocurrency market
While intensifying its crackdown, Russia is also working to establish a regulated framework for the crypto market. A law passed this summer has set rules for exchanges, brokers, custodian institutions, and other intermediaries, with the Russian Central Bank responsible for supervision.
This framework allows some regulated crypto businesses and specific cross-border uses to continue, but it still maintains the restriction that cryptocurrencies cannot be used as domestic payment tools. To support the regulated market launched in September, the Russian Central Bank previously issued draft operating rules for exchanges and digital asset custodian institutions, including capital requirements and registration arrangements for licensed institutions.
Phony concert ticket websites demand encrypted payments
In addition to regulatory notifications, cybersecurity company F6 also revealed that recently, at least 10 websites impersonating Kanye West's concert ticketing services have been engaging in fraud targeting Russian users. These websites were registered after August 17th, and their domain names include .ru, .com, .site, and .shop.
On some pages, optional seats are displayed first before requiring users to pay in cryptocurrency. F6 states that ticket prices range from $60 to $2,100; on other pages, users are asked to transfer funds to a mobile phone number, with ticket prices indicated to range from 28,000 rubles to 6.2 million rubles.
F6 also discovered at least 7 Telegram bots related to this ticket scam. When researchers checked, only 1 of them was still running. The company warns that if a platform only accepts cryptocurrency or mobile phone number transfers and has no other payment methods, it is usually a high-risk sign, as such funds are more difficult to recover after being transferred out.
