CASE DOSSIER sentenced

U.S. v. Anatoly Legkodymov (Bitzlato Cryptocurrency Laundering)

Docket: 1:23-cr-00021 Court: U.S. District Court for the Eastern District of New York Opened: 2023-01-17 Sector: Cryptocurrency, Financial Services

Key Facts

Status

SENTENCED

Legal disposition

Loss Amount

$700.0 million

Processed over $4.58 billion in crypto transactions, with at least $700 million directly tied to darknet contraband and ransomware proceeds.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: SENTENCED in U.S. District Court for the Eastern District of New York.
Primary Target Sector: Cryptocurrency, Financial Services.
Documented Financial Loss: $700.0 million.
1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Unauthorized intrusion originating from targeted infiltration directed against Cryptocurrency, Financial Services networks. Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.

Operational & Financial Fallout

Processed over $4.58 billion in crypto transactions, with at least $700 million directly tied to darknet contraband and ransomware proceeds. Impacted Cryptocurrency, Financial Services infrastructure and associated victim operations.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: SENTENCED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Adversary Kill Chain Flow

2 Documented Phases

Phase 1: Infiltration Perimeter Ingress

MITRE ATT&CK T1190 →

Operatives secured access to victim infrastructure within the Cryptocurrency, Financial Services sector.

Artifacts & Tooling: Network perimeter logs

Phase 2: Execution Payload Deployment

MITRE ATT&CK T1486 →

Artifacts & Tooling: Malicious payload

Real-World Blast Radius & Operational Fallout

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.

✓ Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.

✓ Maintain isolated, immutable backups of critical directory services and transaction databases.

✓ Deploy real-time endpoint detection and response (EDR) agents with automated containment policies.

Procedural & Incident Timeline

2023-01-17 arrest

Legkodymov arrested in Miami by FBI agents in coordinated international operation.

2023-12-06 plea

Defendant pleads guilty to operating an unlicensed money transmitting business.

2024-07-18 sentencing

Sentenced to time served (18 months) and ordered to forfeit all interest in Bitzlato ($23 million).

Named Defendants & Operatives

Defendant	Nationality	Status	Prison Term	Restitution	Notes
Anatoly Legkodymov	Russian Federation	sentenced	Pending	None	Majority owner of cryptocurrency exchange Bitzlato; pleaded guilty to illicit money transmission.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1090	Proxy Command and Control	"Bitzlato operated with negligible anti-money laundering controls, advertising that users could open accounts with no identity verification via Tor."	Plea Agreement ¶ 6, Page 7	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Anatoly Legkodymov (Bitzlato Cryptocurrency Laundering), No. 1:23-cr-00021 (U.S. District Court for the Eastern District of New York 2023), https://cybercaselibrary.com/cases/us-v-legkodymov-bitzlato/

Embeddable Incident Card (HTML):