Ten Raids in a Single Friday: What the Federation East Operation Means for Russia's Crypto Exchange Market

On 31 July, Russian law enforcement carried out a series of searches at exchange offices inside the Moscow-City complex. The stated trigger was an investigation into the theft of 144 million rubles — roughly $1.8 million — from a private individual. The wider context matters more: the raid landed exactly ten days after the State Duma passed legislation that will, within a year, eliminate the very business model these offices have run on.

What Actually Happened on 31 July

According to Izvestia and REN TV, officers conducted ten searches at offices belonging to a network housed in the Federation East tower of the Moscow-City business district. All exchange points suspended operations for the duration.

The trigger was a criminal fraud case. The injured party is identified only as Vladimir R.: unknown callers presenting themselves as officers of the Federal Security Service persuaded him to transfer a large sum. He lost 144 million rubles as a result.

Investigators believe the stolen funds may have passed through one of the crypto exchange desks at the site. They are currently tracing transactions and examining whether staff at those offices were involved in the operations.

The Scale of the Detentions

Several dozen employees of the network were detained. A Moscow court has already imposed pre-trial restrictions on eight people named in the case. The procedural status of the remainder has not been disclosed — a detail worth noting, since some of those detained may be classified as witnesses.

A caveat that news write-ups usually omit is due here. None of those named has been convicted as of publication. A search and a pre-trial restriction are procedural steps, not findings of guilt. The exchange businesses under scrutiny remain, formally, lawfully operating companies.

How Investigators See the Scheme

The chain investigators are working through is fairly typical and breaks into three links.

The first is social engineering: the victim is persuaded to part with the money voluntarily. The second is moving funds through a sequence of accounts to sever the direct link between sender and final recipient. The third is conversion into an asset that does not travel through the Russian banking system.

It is at that third stage that exchange desks enter the picture. Investigators do not need to establish that funds passed through — bank statements handle that. What they need to establish is knowledge: whether the operators were aware they were accepting proceeds of crime.

Anatomy of the "FSB Call"

A figure of 144 million rubles looks implausible until you examine how these calls actually work.

The scheme almost never fits into a single conversation. Victims are worked for days, sometimes weeks, through a combination of authority, isolation and urgency. The caller identifies himself as an officer of a security agency, reports a supposedly opened case or an attempted theft from the victim's account, and insists on confidentiality — no discussing the matter with relatives or with bank staff.

A second "participant" then joins: a "central bank official" or an "investigator" who corroborates the story. Isolation from family is the load-bearing element, because it removes the one barrier that reliably works against these schemes.

Sums of this magnitude usually mean the victim was driven to sell property or liquidate savings entirely. That accounts both for the size of the loss and for why this case is not being handled by district-level officers.

One more point about victim profiles. The common assumption that only elderly or technically unsophisticated people fall for this is not supported by the data. The script does not target ignorance — it targets the stress response. The victim is placed in a situation where any delay is framed as damage and seeking advice is framed as breaking the law. Under that pressure, critical thinking shuts down regardless of education or income.

The only reliable defence remains the same and sounds trivial: hang up and call the organisation back yourself, using a number from its official website. Genuine law enforcement officers do not ask you to transfer money and do not forbid you from discussing the call with people close to you.

Why the Exchange Desk Is the Chokepoint

Cryptocurrency is transparent. Every transaction on a public blockchain stays there permanently and is available for analysis. The investigative difficulty is not tracking movement — it is tying an address to a specific person.

This is where the exchange desk becomes critical. It is the place where an anonymous on-chain address meets a physical human being: someone walks in with cash or sends a card transfer. At that fiat-to-crypto seam a trail appears that can actually be used in proceedings — security cameras, a bank statement, a building access log.

Which is why exchange operators end up at the centre of cases like this even when they did not originate the scheme. They are the only link in the chain with a street address.

What the State Can Already Trace

The notion that cryptocurrency conceals the movement of funds is at least several years out of date.

Since 2021, Rosfinmonitoring has been developing an analytics platform called Transparent Blockchain, built for exactly this class of task: address clustering, mapping relationships between wallets, tying on-chain activity to known services. Commercial systems run in parallel, used both by banks and by the exchange businesses themselves to screen incoming transfers.

The technical workflow looks like this. An analyst takes the address that received the funds and walks the transaction graph backwards to the point where fiat entered. If a service with known deposit addresses appears anywhere along that path, the chain gains an anchor. From there the work is no longer blockchain analysis — it is a formal request to an organisation.

This is precisely why exchange desks increasingly run their own scoring. Accepting a tainted transfer means ending up with a frozen asset and questions from investigators. Refusing is simply cheaper than litigating.

Why Cash Is a Separate Problem

The regulators' core objection to the Moscow-City venues has never really been about cryptocurrency. It is about cash.

A bank transfer leaves a trail with an identified sender. Cash leaves no such trail at all: a person walking into an office is visible only through cameras and the building's access system. When daily cash turnover runs into tens of millions of rubles, the venue is effectively performing a function that, inside the banking system, requires a dedicated licence and supervision.

That side of the business — not currency conversion as such — is what exposes these operations to charges of unlicensed banking and illicit handling of payment instruments. It is also the first thing the new regulatory regime will constrain.

What the Network's Staff Could Be Charged With

The legal framing here is more complicated than it appears. The set of articles investigators typically consider in cases like this:

• Articles 174 and 174.1 of the Criminal Code — laundering of funds acquired through criminal means;
• Article 187 — illicit handling of payment instruments, where accounts and cards registered to nominees were used;
• Article 172 — unlicensed banking activity;
• Article 159 — fraud, if complicity in the original scheme can be established.

The decisive question for the defence is intent. A clerk who exchanged cash at the posted rate and an employee who knew where the money came from occupy fundamentally different positions. Separating those roles across several dozen detainees is what will occupy investigators for the coming months.

The Contested Point: Is This Banking Activity?

Article 172 deserves particular attention. Unlicensed banking activity presupposes carrying out operations that require a licence without holding one.

Until now, cryptocurrency exchange in Russia has required no licence. Formally, an exchange desk was neither a credit institution nor a professional securities market participant. Applying Article 172 to pure crypto conversion therefore remains contested — in practice, prosecutions lean on the surrounding activity: cash handling, physical collection and transit through nominee company accounts.

From 1 September 2026 that ambiguity disappears. And it does not disappear in favour of grey-zone operators.

Federation Tower: How This Started

The concentration of crypto exchange businesses in Moscow-City is neither accidental nor new. The complex offered exactly what this kind of operation needs: round-the-clock access, security, anonymity within a flow of thousands of visitors, short distances between offices, and the ability to rent space quickly without putting up a sign. They clustered here densely and for the better part of a decade.

Scrutiny of this environment long predates the current raid.

Suex and Garantex: The Two Episodes That Set the Tone

In 2021, the US Treasury's Office of Foreign Assets Control sanctioned the Moscow company Suex — an over-the-counter crypto broker, functionally the same kind of exchange desk. It was the first time in history that OFAC had designated a cryptocurrency service.

April 2022 brought sanctions against the Garantex exchange, imposed simultaneously with those on the Hydra darknet marketplace. OFAC's statement said plainly that the exchange was operated out of Federation Tower in Moscow-City and knowingly disregarded its anti-money-laundering obligations.

The Bell described Garantex as a phenomenon of the Russian market. After international payment systems withdrew from Russia, it was one of the few venues where an account could be topped up with physical rubles. Even after visits from law enforcement, the office in the tower would reopen. The story ended in 2025 with an international operation and sanctions against the co-founders.

The 2024 Raid

In March 2024, searches were already carried out at crypto exchange and trading offices on the 52nd floor of Federation Tower, including the firm Beribit. Preliminary reporting linked those checks to an investigation into the financing of the Crocus City Hall attack.

Almost no official information was published at the time, and most of the businesses resumed operations within a few days. That repeatability is exactly what makes the current raid different from its predecessors: the legal conditions have changed radically in two years.

An Exchange Desk Behind a Travel Agency Sign

Another episode reported by the Interior Ministry: the shutdown of a cryptocurrency exchange point in Moscow-City operating under the cover of a travel company.

The logic of disguising the business as something else is straightforward. Renting an office for cash exchange invites questions from the landlord and the building management, whereas a travel agency or a consultancy raises none. Such cover is useless against an investigation but works reasonably well against everyday curiosity.

What the 21 July Law Changed

Here the substance of the story begins. On 21 July 2026 the State Duma passed, in second and third readings, the law "On Digital Currencies and Digital Rights" — 340 votes in favour, five abstentions. The Federation Council approved it.

The law establishes comprehensive regulation of cryptocurrency circulation for the first time: from retail purchases through licensed intermediaries to exchange trading, clearing and digital depositories. The Bank of Russia becomes the regulator and supervisory authority. The government, in coordination with the central bank and the FSB, gains the power to impose a special regime on digital currency circulation.

Cryptocurrency is recognised as property. Using it for domestic payments remains prohibited, with carve-outs for participants in foreign trade and for licensed exchange operators, which will be able to pay in digital currency for securities, digital rights and other digital currencies.

The main provisions take effect on 1 September 2026, with certain rules phased in during 2027.

The Entry Threshold: 15 Million Rubles and the Central Bank Register

For the raid story, the specific requirements are what matter.

Only a Russian business entity with own funds of at least 15 million rubles — roughly $190,000 — and entered in the Bank of Russia register will be permitted to operate as a crypto exchange. Custody and record-keeping for digital currencies are assigned to digital depositories, whose register the central bank will also maintain. Participants face strict information-security requirements.

This rewrites the economics of the market entirely. An exchange point in a rented room with two clerks and a terminal simply does not clear the capital bar. Operations built around retail cash flow will either consolidate into large licensed structures or leave.

The Transition Period: How Long Grey Venues Have Left

Operating without register entry is permitted until 1 July 2027. Formally, that means the Federation East network — if it resumes trading — has roughly another year in its current form.

In practice the window is narrower. Banks can see where regulation is heading and are tightening their treatment of counterparties connected to currency conversion in advance. Leases in prestige business centres are becoming more expensive and harder to obtain for such tenants. Most importantly, sitting outside the future central bank register is itself becoming an additional argument for investigators in cases like this one.

How the Banking Sector Is Reacting

Anticipatory tightening by banks is an underrated factor. Credit institutions are not waiting for the rules to take effect; they are adjusting internal policy in advance, because the cost of getting it wrong is higher for them than for the customer.

In practice this shows up in several ways. Scrutiny of corporate accounts showing signs of exchange activity is tightening. Requests for source-of-funds documentation are rising where incoming personal transfers follow a characteristic pattern. Restrictions under Federal Law 115-FZ, the anti-money-laundering statute, are applied more readily — not because the bank has established a violation, but because halting a transaction is cheaper than explaining it later.

For legitimate users this means more friction: an ordinary transaction may now require documentary proof of where the money came from. For exchange operators it means shrinking access to banking infrastructure, which in turn pushes more turnover into cash and closes the loop.

How to Tell a Risky Venue From a Legitimate One

For an ordinary user, the practical lesson is that counterparties should be checked before a deal, not after.

Signs of elevated risk:

• no registered legal entity or company details; business conducted "by arrangement";
• cash accepted and paid out with no documentation and no identification;
• transfers to personal cards rather than a corporate account;
• refusal to confirm the rate and commission in writing;
• a promise to process the operation "with no questions about where the money came from";
• operating under signage unrelated to financial services.

That last point is especially telling. After 1 September 2026, a lawful exchange operator will have to meet central bank requirements, and concealing the nature of the business becomes a direct indicator of trouble.

What to Do if Your Funds Are Frozen Over Someone Else's Chain

A situation legitimate users do encounter: coins or rubles get frozen because they previously passed through an address connected to an investigation.

The sequence here does not change. Preserve all correspondence and transaction confirmations. Assemble documents proving the origin of your own funds — statements, contracts, tax filings. Do not attempt to push the asset further along the chain; that worsens the picture and adds questions. Consult a lawyer who specialises in these matters before giving any explanations.

Exchange operators in these situations typically take the position of a bystander: they have neither the authority nor the incentive to argue with investigators on a customer's behalf.

What Happens Next to the Market

The current raid differs from those of 2024 not in scale but in timing. Earlier searches in Moscow-City took place in a legal vacuum: exchange points did not formally exist as a category, so claims had to be routed through adjacent offences.

Now the category exists, and with it a clear dividing line — in the register or outside it. Operators that fail to meet the capital and disclosure requirements during the remaining transition period will find themselves not in a grey zone but plainly beyond it.

Two scenarios look most likely. The first is consolidation: a handful of large players with capital, licences and functioning compliance absorb the retail flow. The second is migration into formats with no physical presence — peer-to-peer platforms, over-the-counter deals arranged through messaging apps, offshore services. The second scenario does not solve the problem; it relocates it somewhere raids do not reach.

The 144-million-ruble case is instructive precisely on this point. The weak link turned out to be neither the blockchain nor the technology, but an ordinary office with a cash window — the one place in the entire chain where someone can turn up holding a court order.