Public data question prosecutor’s allegations about Nexo

The data on Russian money laundering and terrorist financing through Nexo (Nexo) published by the Bulgarian Prosecutor’s Office do not find confirmation in the publicly known sanctions lists, a check of the BRRD found. These lists contain the addresses of specific accounts in various cryptocurrencies to which and from which it is forbidden to make transfers. It is easily established that none of them have translations from or to Nexo after the announcement of the sanctions.

Russian sanctions

First of all, the prosecutor’s office reported illegal activity related to the Russian cryptocurrency exchange GARANTEX EUROPE OU, which was sanctioned on April 5, 2022, NEXO received 23 transactions immediately after the sanctions were imposed, according to the Bulgarian indictment.

Sanctions against GARANTEX EUROPE OU are visible on the US Treasury website:

https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220405

Three wallets in different cryptocurrencies have been sanctioned:

XBT /Bitcoin/: 3Lpoy53K625zVeE47ZasiG5jGkAxJ27kh1
ETH /Ethereum/: 0x7FF9cFad3877F21d41Da833E2F775dB0569eE3D9
USDT /Tether/: 3E6ZCKRrsdPc35chA9Eftp1h3DLW18NFNV

It can be seen that after the date of Garantex’s inclusion in the sanctions list, 5 April 2022, there are no transactions from and to the three portfolios specified by OFAC. Not just from Nexo, but not at all.

https://etherscan.io/address/0x7ff9cfad3877f21d41da833e2f775db0569ee3d9
https://explorer.btc.com/btc/address/3Lpoy53K625zVeE47ZasiG5jGkAxJ27kh1
https://explorer.btc.com/btc/search/3E6ZCKRrsdPc35chA9Eftp1h3DLW18NFNV

An exception is one outbound transaction from the sanctioned Ethereum address 0x7FF9cFad3877F21d41Da833E2F775dB0569eE3D9. She is from May 28, 2022 to an address 0x71191c6199d5d5178822c5cc19fab83634929a5b that contacts the Finiko group, not Nexo. This transaction is worth about $45.

Hamas Terrorist

At the press conference following the Nexo raids, prosecutors said in a stirred that transactions were also detected by a person from the Palestinian terrorist organization Hamas, Mahmoud Mohammed Mahmoud Ayesh. The signal came from the Israeli authorities.

Indeed, the Israeli authorities sanctioned addresses of the Hamas-linked person on June 30, 2021, as evidenced by the news and the
The official announcement on the website of the Israeli National Bureau for Combating the Financing of Terrorism.

Nine Ayesh-related cryptocurrency addresses are listed and made public on July 1, 2021, five of which are those of cryptocurrencies maintained by Nexo: Bitcoin, Ethereum, Dogecoin, Litecoin, and Tether. For these five addresses, no transactions are visible after the date of their announcement by Israeli law enforcement authorities:

The exception is Dogecoin the address where 15 dogs were received after the announcement of the sanctions. That’s less than $1.

It is unclear whether these 15 dogecoin came from a portfolio owned by Nexo, but to talk about financing terrorism with such an amount is greatly exaggerated.

Before these addresses were publicly announced on sanctions lists by the US and Israel, it was not known whose they were and that they were related to illegal activity. Therefore, even if there were transactions from and to them from Nexo addresses, the prosecution’s allegations that there were violations of sanctions with intent, or negligence, would easily be rebutted in court.

Yesterday, the BRRD sent a request to the press office of the Prosecutor’s Office which exactly sanctioned cryptoaddresses are mentioned in the allegations of terrorist financing and Russian money laundering. No response was received by the editorial close of the article. But there is no way Nexo can be held responsible for translations to unannounced addresses if they exist and the prosecutor’s office knows they are connected to the Russians or Hamas.

Market manipulation?

If Nexo was engaged in illegal activity, it is more related to crypto market manipulation. This is clear from a leaked email of the former partner in the company Georgi Shulev. The reliability of this document, published on Afera.bg website, was confirmed by the BRRD.

In the text sent by Shulev to part of the Nexo team, there are claims that the company is behind Zeus Capital’s website, which published a denigrating analysis of the Chainlink project. According to Shulev, his partners Kosta, Antoni and Kalin have thus carried out market manipulation and misuse of client assets. However, the prosecution was not talkative on this topic, which has long excited the crypto community.

***

Разследващата журналистика е разузнаването на гражданите. BIRD се финансира от дарения. Ние не публикуваме реклами. Не получаваме държавни субсидии. Не разчитаме на грантове. Финансирането чрез малки дарения от читатели е гаранция за нашата независимост. Включете се, за да продължим да разкриваме злоупотреби и да държим отговорни властимащите. Използваме Вашите пари за хонорари на журналистите, командировки, изграждане и поддръжка на нашите информационни системи, такси за фирмени и имотни регистри у нас и по света, придобиване на техника и специално оборудване, осигуряване на нашата безопасност и други важни работни мисии. Важно: Ако дарявате всеки месец това ще ни даде възможност да планираме и организираме нашата работа. Благодарим Ви! Нас ни има, защото Вас Ви има!

This post is also available in: Български (Bulgarian)