Despite $26M in frozen USDT, Garantex still moves over $15M in crypto across ETH, BTC, and BNB. Multi-chain blind spots reveal major enforcement gaps.
“Russia recruited a teenage spy. His arrest led to a crypto money trail.”
That’s the headline of Reuters’ special report — an exposé that unveils how the Russian FSB exploited a Canadian teenager as part of a broader espionage strategy. But the story doesn’t end there. Behind that global headline lies a deeper layer of evidence — a digital trail uncovered by our investigation team at Global Ledger, one that goes further than what Reuters reported.
The story in brief
A Canadian teen, Laken Pavan, drawn in by pro-Russian propaganda, ended up being used by the Federal Security Service (FSB) for spying across Europe. For his efforts, he was paid in Bitcoin. After turning himself in to police, his arrest in Poland on May 23, 2024, led Reuters to uncover a much broader crypto trail linked to Russian intelligence.
Our team at Global Ledger supported that investigation by tracing the digital flow of funds behind it. FSB-linked wallets used classic laundering tactics — splitting funds, mixing them with larger flows, and sending them through unrelated wallets to hide their origin. Let’s take a closer look.
Crypto investigation behind the story
During the investigation for Reuters, our team confirmed that Laken Pavan received three transactions that he was aware of on his Bitcoin crypto wallet: two allegedly from the FSB on May 20 and 21, 2024, totaling about $600, and one supposedly from his “Mom” on May 22, 2024, for approximately $74.
But it didn’t stop there. We uncovered many more transactions, traced their origins, analyzed the wallet’s activity after Laken’s arrest, and uncovered the methods the FSB used to hide the flow of funds.
Tracing the FSB transaction flow
As previously mentioned, Laken Pavan’s Bitcoin wallet received two payments linked to the FSB on May 20, 2024 and May 21, 2024.
By analyzing the transaction paths, we identified that both payments originated from wallets connected to a single source — a large upstream wallet. This wallet was flagged as potentially controlled by the FSB, though we could not confirm the exact identity of its operator.
The funds were not transferred directly from the purportedly FSB-controlled wallet to Pavan’s wallet. Instead, intermediary wallets acted as distributors, passing assets along in smaller portions. This is a typical tactic in laundering schemes.
FSB funds moved to Laken Pavan
The origin of FSB funds
Tracing the transaction flow further, we found that funds entering this FSB-linked wallet originated from:
- Cobo-labeled wallet (a wallet-as-a-service provider). The funds were sent from this wallet to the FSB-linked wallet, with a single hop wallet acting as the distributor.
- F2Pool mining pool wallet, a common and legitimate source often used to make funds appear “clean”.
The origin of FSB funds and their movement to Laken Pavan
The path these funds took strongly suggests laundering behaviour:
This flow structure made the funds look “clean” when they reached the final destination.
Tracing the "mom"-related transaction flow
On May 22, Laken’s wallet received another deposit — this time from his mother. But when we followed the trail on the blockchain, the story didn’t add up.
Instead, we found that:
- The initial origin of the “Mom’s” funds came from wallets linked to a crypto payment platform.
- It passed through over 15 different wallets before reaching the one labeled as “Mom’s wallet.”
- The same wallet received funds from several other sources and was part of a group of wallets tied to centralized exchanges (CEXs).
Based on the wallet behaviour, it can be concluded that:
- The transfer may have been made through a payment service that routes funds through shared wallet infrastructure, with “Mom” as one of many recipients.
- Alternatively, the sender might not have been Laken’s actual mother but someone using a complex setup to hide the true origin of the funds.
Transactions after Laken's arrest
Even after Laken was arrested on May 23, 2024, his Bitcoin wallet continued to receive several transactions between June 5 and June 14.
Global Ledger’s analysis showed a clear pattern: each transaction was part of a broader distribution involving high-risk entities, including darknet platforms like Kraken Darknet, MEGA, and OMG!OMG!.
The shadow of garantex
Since launching in June 2022, the large upstream wallet has moved Bitcoin valued at over $600 million. Global Ledger’s analysis revealed that some of these funds were funneled to Garantex — a now-sanctioned Russian crypto exchange. Operating both online and offline, including discreet cash-out centers in Moscow City, Garantex acted as a “cross-border liquidity hub”.
However, tracing Garantex was difficult due to its constantly changing withdrawal addresses, which masked any consistent flow.
Our team’s forensic analysis also uncovered connections between Garantex and transactions linked to Slon, Laken’s alleged handler, whose last contact with Laken was on May 22, 2024, just one day after the teen arrived in Warsaw, Poland. More on Slon and their telegram communications with Laken can be found in the same Reuters report.
Laken-related investigation: final takeaways
Our analysis uncovered several key findings:
Final thoughts
This case illustrates not just the danger of radicalization or geopolitical manipulation — it can point out the blind spots in global financial visibility.
Need help following the crypto trail?
On-chain analysis can reveal the truth and evidence for journalists, investigators, and organizations handling crypto-related cases.
At Global Ledger, we support investigations with clear, evidence-based blockchain intelligence with the help of blockchain visualization technology and crypto AML risk-scoring solutions.
Reach out, and let’s dig into investigating suspicious crypto flows together.
Research
Beyond Bitzlato: Who Is Next in Line for Sanctions?
·
After Bitzlato sanctioned, Global Ledger predicts the top 5 exchanges that might be dancing too close to the flames.