Russia blacklists 2,600 crypto wallets as pyramid schemes shift to USDT loans

The Bank of Russia added 2,600 crypto wallets to a shared database used by banks and law enforcement after more than 1 billion rubles flowed into addresses linked to suspected illegal financial activity during the first half of 2026.

The wallets belonged to companies, projects and individual entrepreneurs showing signs of illegal activity in the financial market, the regulator said. Banks and law enforcement agencies use the information system for compliance checks and financial investigations.

During the same six-month period, the regulator identified 2,891 entities with signs of illegal financial activity, down nearly 31% from the first half of 2025. The figure remained close to the level recorded during the second half of last year.

More than 74% of identified pyramid schemes used cryptocurrencies to attract funds, down from 84% of projects identified in 2025. The rest relied on foreign payment services or cash. Organizers used more than 940 websites, 120 Telegram channels and over 2,500 social media pages to bring users into their projects during the first six months of the year.

The regulator identified 929 entities with signs of financial pyramid activity and another 379 suspected of illegally attracting investments during the first half. Combined, the number of pyramid and other pseudo-investment projects fell 44% from the same period in 2025. Most operated online without physical offices and contacted potential clients through social networks, messaging services or phone calls.

Pseudo-investment projects identified this year frequently offered exposure to cryptocurrencies or promised income from crypto mining, the Bank of Russia said. Some schemes promoted investments in data centers supposedly supplying computing capacity to miners, while others offered digital tokens said to track gold prices.

Illegal lending moved in the opposite direction. The number of identified illegal lenders doubled from the first half of 2025, reaching 999, compared with 467 a year earlier. The Bank of Russia linked part of the increase to tighter requirements for legal lenders, which limited access to borrowing for customers with high debt burdens.

Among the products promoted outside the formal financial system were so-called crypto loans. Such services offered borrowers loans denominated in Tether's USDT stablecoin or rubles converted at a specified exchange rate. The regulator said it continued to receive hundreds of complaints about the model while websites associated with such projects were blocked and replaced with duplicate resources.

The Bank of Russia sends information on suspected illegal financial activity to law enforcement agencies, the Federal Antimonopoly Service and other authorized bodies. Banks took restrictive measures against more than 500 payment details used for illegal financial activity during the first half of 2026.

Regulatory action during the period led to more than 330 administrative cases based on material supplied by the central bank, including information collected during previous reporting periods. Authorities took more than 450 other enforcement measures and restricted access to over 11,800 online resources belonging to suspected illegal financial market participants and pyramid schemes.

Russia has been moving to bring more cryptocurrency activity under licensed financial institutions while keeping domestic crypto payments restricted. A law approved this summer created rules for exchanges, brokers, custodians and other intermediaries, with the Bank of Russia responsible for supervising the market. The framework permits regulated crypto activity and certain cross-border uses while maintaining the ban on using cryptocurrency as a domestic payment method.

Ahead of the new framework, the central bank published draft operating rules for cryptocurrency exchanges and digital asset depositories, including capital requirements and official registers for licensed market participants. The rules were prepared ahead of the country's regulated crypto market rollout scheduled for September.

Russian authorities have been taking enforcement action against crypto businesses suspected of operating outside permitted channels. In August, more than 20 people were detained after authorities raided nine crypto exchanges in Moscow. Investigators alleged that the services converted proceeds from scams into cryptocurrency before transferring the assets to handlers in Ukraine.

Separate fraud campaigns detected this month have used crypto payments to target Russians seeking tickets for Kanye West concerts.

Cybersecurity company F6 said its Digital Risk Protection analysts found at least 10 websites registered since Aug. 17 across the .ru, .com, .site and .shop domains. The pages used names connected with West, including variations containing "ye," "yerussia" and "ye-tickets," while presenting themselves as official ticket or tour websites.

Some of the sites allowed visitors to select apparently available seats before requesting payment in cryptocurrency. Prices ranged from $60 for upper-level seating to $2,100 for a VIP box, according to F6. Other pages requested transfers to a phone number, with advertised ticket prices ranging from 28,000 rubles to 6.2 million rubles.

Several fake pages advertised tickets for concerts in Moscow even though the two announced performances were scheduled for St. Petersburg. Other sites redirected users who clicked the purchase button to illegal online casinos.

F6 found at least seven Telegram bots connected with the ticket campaign. Only one was active when researchers checked on Aug. 21, offering users a mini-app for selecting seats and entering contact details before requesting payment through a phone-number transfer. The company said requiring crypto or phone transfers when no other payment options are available is a sign of possible fraud because recovering money sent through such methods can be difficult.

The campaign follows other attempts to use interest in cryptocurrency to impersonate established Russian financial institutions. The anti-fraud project Moshelovka previously reported schemes that claimed to give Russians access to cryptocurrency trading through the Moscow Exchange.

The real exchange has been expanding its crypto-linked products within Russia's regulated market. Moscow Exchange introduced indexes tracking Solana, XRP, Tron and BNB in May, adding them to its existing Bitcoin and Ethereum benchmarks. The products were designed for professional investors, while direct cryptocurrency trading remained outside the exchange's existing offering. Moscow Exchange planned to expand the benchmark list to 10 crypto assets and had discussed futures linked to its crypto indexes.