Prosecutors Detail Russians' Crypto Phishing Scheme in Forfeiture Suit

The alleged hackers also manipulated NEO's Gas market with a $5 million crypto infusion.

AccessTimeIconSep 17, 2020 at 4:11 p.m. UTC
Updated Sep 14, 2021 at 9:57 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

The two Russians who were sanctioned earlier this week by the U.S. Treasury Department on accusations of being crypto thieves allegedly got their millions through market manipulation and phishing. 

Prosecutors detailed Danil Potekhin and Dimitrii Karasavidi’s alleged heists, victims and target exchanges in a 30-page forfeiture complaint filed Wednesday against the pair’s previously seized crypto funds.

  • Karasavidi and Potekhin allegedly “deployed” a series of bogus Poloniex, Gemini and Binance lookalike sites that duped unwitting users into sharing their login credentials, giving the hackers control of wallets. 
  • They then “drained” $20 million worth of bitcoin (BTC), ether (ETH) and NEO from victims’ accounts, according to the complaint. Prosecutors said the lion’s share ended up in Karasavidi’s Bitfinex account.
  • Other funds were frozen by Poloniex and quickly seized by authorities, who filed the lawsuit to take control of 15,602 ETH, 199.8 BTC, $6.1 million in cash and 1,199 NEO, a total worth $14.2 million at press time.
  • That ETH haul was actually the product of a separate hacker scheme: market manipulation, authorities say. 

In late October 2017, hackers pumped $5 million of one victim’s crypto into NEO’s Gas market, skyrocketing the usually sleepy token’s value 13,000% before ordering their personal gas-holding Poloniex accounts to cash out into ETH. The victim “lost virtually all of his $5 million in cryptocurrency,” prosecutors alleged.

  • Prosecutors also claimed the hackers attempted to cover up the stolen crypto’s origin by “layering” funds – a classic money-laundering technique. 
  • Treasury officials said they used “blockchain tracing analysis” to follow the ETH from the Poloniex manipulation and the Poloniex, Binance and Gemini phishing schemes into Karasavidi’s Bitfinex account.
  • They further claimed to have identified Potekhin as the owner of multiple misspelled Poloniex domain names linked to the phishing scheme.
  • Similar tactics were used against Binance and Gemini customers, the regulator said in the lawsuit.

Karasavidi and Potekhin face a mounting lineup of legal troubles. This week, they’ve been added to the Treasury Department’s OFAC blacklist and also face federal wire fraud, hacking and money laundering charges.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is an award-winning media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. In November 2023, CoinDesk was acquired by Bullish, a cryptocurrency exchange, which in turn is owned by, a firm with interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets including bitcoin and EOS. CoinDesk operates as an independent subsidiary, and an editorial committee, chaired by a former editor-in-chief of The Wall Street Journal, is being formed to support journalistic integrity.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.