
Law enforcement agencies in Spain have dismantled a large-scale criminal network that laundered millions of euros by exploiting Ukrainian women who had fled the war. As a result of the international operation, 12 members of the group were arrested, and at least 55 victims were identified.
The investigation lasted around two years and was conducted with the participation of law enforcement agencies from Spain, Ukraine and the European Union’s law enforcement agency, Europol.
During the operation, law enforcement officers carried out searches in Spain and Ukraine, seizing a large number of mobile phones, computers, SIM cards, cash and cryptocurrency. In addition, 153 bank accounts potentially linked to this criminal network were identified and frozen across 11 countries worldwide.
According to the investigation, the criminals specifically targeted Ukrainian women who were in difficult life circumstances and from regions affected by the war. The women were transported to Spain and helped to obtain temporary protection status. Subsequently, bank accounts, crypto exchange accounts and crypto wallets for Bitcoin, Ethereum or Tether were opened in their names. This allowed the perpetrators to create a network of accounts not directly linked to the organisers, so that these accounts could later be used for financial transactions to launder proceeds of crime.
Investigators emphasise that the criminal organisation effectively exploited the refugees, using their documents and bank accounts as a tool to launder millions of euros in criminal proceeds, and that the scheme was not complex and operated via online gambling platforms. The scheme worked solely because the large number of accounts made it difficult to track the movement of funds.
The criminals applied for credit cards and linked them to gambling accounts, after which they placed automated bets using special software. In this way, the money obtained through criminal means was ‘churned’ through the betting system and returned as supposedly legitimate profit.
As noted by the cyber experts and forensic specialists who reconstructed this crime: in such schemes, cryptocurrency (most often Bitcoin, Ethereum or Tether stablecoins) could be used as a tool for ‘money laundering and/or concealing its origin’. Consequently, to avoid arousing the banks’ suspicions, sums were split into smaller amounts or funds were quickly converted into cryptocurrency via exchanges and P2P exchanges. In addition to all of the above, the scheme’s participants could withdraw cash, verify accounts (KYC) and make transfers as instructed.
Despite the fact that different jurisdictions significantly complicated police coordination, all suspicious financial flows, identical transaction patterns and links between accounts were identified and documented. This included the fact that victims were forced not only to open bank accounts but also to hand over state benefits they received as refugees.