Key Findings

TRM Labs has identified pro-Russian groups, including a paramilitary group sanctioned by OFAC in September – Task Force Rusich, collecting cryptocurrency donations to support Russian military operations. As of September 22, 2022, these groups have collectively raised almost $400,000 since the start of the invasion on February 24, 2022. According to Telegram postings, the groups’ funds are used to purchase supplies for Russian-affiliated militias and to support combat training at physical locations close to the Russia-Ukraine border.

Telegram and Fundraising

While some groups maintain their own websites, Telegram is the principal way in which cryptocurrency addresses are promoted for donations. Groups that received higher volumes of donations typically had some presence prior to the invasion in February and appear to have benefited from greater cross-channel promotion on Telegram. Fiat payment methods are also provided via Telegram, such as transfers through Russian bank accounts. Generally, these accounts are associated with SberBank, an OFAC-sanctioned Russian majority state-owned banking and financial services company headquartered in Moscow.

NACC Raise Funds and Receive Donations for Drones and Training

The Novorossia Aid Coordinating Center (NACC), founded around 2014 to support operations in Ukraine, announced a pivot in April 2022 to specialize in outfitting Russian forces with drones. NACC raised just over USD 21,000 since it began receiving funds in March 2022, of which approximately 89% was in Bitcoin. On June 4, 2022, NACC announced on Telegram its intention to supply and train Russian-backed forces with drones in July, and donate 15 Mavic 2 and Mavic 3 brand drones. The posts identifies the following organizations as participants in the NACC-hosted training sessions:

• 4th Brigade of the LPR (very likely the Prizrak Mechanized Brigade)
• Undisclosed Russian Artillery Unit
• Marine Corps Brigade of the Black Sea
• Reservist Units of the LPR

NACC has posted photos of training sessions around the Russian cities of Veliky Novgorod and Belgorod.

MOO Veche Campaigns for Identified Battalions

Interregional Public Organization for the Promotion of the Preservation of Domestic Traditions and Cultural Heritage (MOO Veche) is a Russian cultural heritage organization established in 2009 that launched a Telegram channel in March 2022. Since then, MOO Veche has received 103 deposits, totaling over USD 56,000 in Bitcoin, Ethereum, Litecoin, and USDT on Tron.

Based the group’s Telegram posts, specific brigades within the Donetsk People’s Republic (DPR) militia benefiting from the MOO Veche’s fundraising efforts include the International Brigade (Pyatnashka Brigade), the 1st Slavyansk Brigade, and the Kalimus Brigades, in addition to dozens of other battalions, brigades, and regiments under the People’s Militia of the DPR, as well as Russian Special Forces, Marines, and ground forces.

Administrators of the telegram channel have reported on results of fundraising campaigns since July 2022. These reports include praise for successfully delivering thermal imaging/sights, battery powerpacks, body armor, and more than 100 Mavic brand drone-style vehicles. Additional reports disseminated indicate direct first-hand use of the drones provided engaging Ukrainian forces.

Romanov Light Fundraises for Russian Special Forces

Romanov Light, a Telegram channel created in April 2020, which has raised over $174,000 in cryptocurrencies since the start of the invasion, launched a targeted fundraising campaign in June 2022 for Special Rapid Response Unit (“SOBR”), an elite Special Forces unit in the Russian military. Romanov Light withdrew just over USD 6,000 in Bitcoin to an exchange during the campaign for SOBR.

Romanov Light disseminated an itemized receipt for collection efforts for SOBR, detailing the use of nearly 500,000 rubles (just over USD8,000). Purchased materials included general combat and survival equipment, with the following product brand or types named:

• Odin Brand Tactical Flashlights
• GoPros
• Magnetic MRS-01 Remote Switch (Weapon Attachment)
• ArmyTek GM-07 (Weapon Attachment)
• DLG Brand M-Lok (Weapon Attachment)
• Granit 5A Armor Plates

Sanctioned Paramilitary Group Raises and Moves Funds

A Telegram channel for Task Force Rusich, a neo-Nazi Russian paramilitary group sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC), frequently solicits donations for items earmarked for combat-related missions. A June 28, 2022 post confirmed the purchase of the following items:

According to TRM Labs intelligence, Task Force Rusich maintains at least 14 addresses across 7 different blockchains, and benefits from message amplification within other pro-Russian Telegram channels. The group has received over $144,000 in cryptocurrency since the start of the invasion.

On June 28, 2022, Rusich disseminated a message indicating collections were closed and stopped publicly requesting cryptocurrency donations for over two months. On September 6th, Rusich disseminated a new wallet address with the below message (machine translated for clarity):

For the addresses Task Force Rusich circulated prior to the closing of the collections on June 28, 2022, approximately 89% of the withdrawn Ethereum and Bitcoin were deposited into a cryptocurrency exchange. After Task Force Rusich’s message on June 28, 2022, the addresses disseminated by the channel deposited over 99% of the funds received into a different exchange, with no further observable funds being deposited at addresses at the previous exchange.

Given the temporal relationship between the fundraising campaigns and the corresponding on-chain withdrawal activity, Task Force Rusich is probably using an exchange for particular fundraising periods and changing the deposit exchange after a given period of deposits to obfuscate cashout points.

Outlook

Sanctions and observed service disruptions to the Russian electronic banking infrastructure will likely lead to further adoption of cryptocurrency amongst Telegram channels fundraising for the invasion of Ukraine. VASPs in the Russian region, other high risk exchanges, and darknet marketplaces have been observed in the counterparty activity for these entities and will likely continue to do so given lack of enforcement mechanisms. TRM Labs will continue to monitor these campaigns to identify further tactics, techniques, and procedures pro-Russians are using to finance the war in Ukraine.

‍