“Russia recruited a teenage spy. His arrest led to a crypto money trail.”
That’s the headline of Reuters’ special report — an exposé that unveils how the Russian FSB exploited a Canadian teenager as part of a broader espionage strategy. But the story doesn’t end there. Behind that global headline lies a deeper layer of evidence — a digital trail uncovered by our investigation team at Global Ledger, one that goes further than what Reuters reported.
A Canadian teen, Laken Pavan, drawn in by pro-Russian propaganda, ended up being used by the Federal Security Service (FSB) for spying across Europe. For his efforts, he was paid in Bitcoin. After turning himself in to police, his arrest in Poland on May 23, 2024, led Reuters to uncover a much broader crypto trail linked to Russian intelligence.
Our team at Global Ledger supported that investigation by tracing the digital flow of funds behind it. FSB-linked wallets used classic laundering tactics — splitting funds, mixing them with larger flows, and sending them through unrelated wallets to hide their origin. Let’s take a closer look.
During the investigation for Reuters, our team confirmed that Laken Pavan received three transactions that he was aware of on his Bitcoin crypto wallet: two allegedly from the FSB on May 20 and 21, 2024, totaling about $600, and one supposedly from his “Mom” on May 22, 2024, for approximately $74.
But it didn’t stop there. We uncovered many more transactions, traced their origins, analyzed the wallet’s activity after Laken’s arrest, and uncovered the methods the FSB used to hide the flow of funds.
As previously mentioned, Laken Pavan’s Bitcoin wallet received two payments linked to the FSB on May 20, 2024 and May 21, 2024.
By analyzing the transaction paths, we identified that both payments originated from wallets connected to a single source — a large upstream wallet. This wallet was flagged as potentially controlled by the FSB, though we could not confirm the exact identity of its operator.
The funds were not transferred directly from the purportedly FSB-controlled wallet to Pavan’s wallet. Instead, intermediary wallets acted as distributors, passing assets along in smaller portions. This is a typical tactic in laundering schemes.
Tracing the transaction flow further, we found that funds entering this FSB-linked wallet originated from:
The path these funds took strongly suggests laundering behaviour:
This flow structure made the funds look “clean” when they reached the final destination.
On May 22, Laken’s wallet received another deposit — this time from his mother. But when we followed the trail on the blockchain, the story didn’t add up.
Instead, we found that:
Based on the wallet behaviour, it can be concluded that:
Even after Laken was arrested on May 23, 2024, his Bitcoin wallet continued to receive several transactions between June 5 and June 14.
Global Ledger’s analysis showed a clear pattern: each transaction was part of a broader distribution involving high-risk entities, including darknet platforms like Kraken Darknet, MEGA, and OMG!OMG!.
Since launching in June 2022, the large upstream wallet has moved Bitcoin valued at over $600 million. Global Ledger’s analysis revealed that some of these funds were funneled to Garantex — a now-sanctioned Russian crypto exchange. Operating both online and offline, including discreet cash-out centers in Moscow City, Garantex acted as a “cross-border liquidity hub”.
However, tracing Garantex was difficult due to its constantly changing withdrawal addresses, which masked any consistent flow.
Our team’s forensic analysis also uncovered connections between Garantex and transactions linked to Slon, Laken’s alleged handler, whose last contact with Laken was on May 22, 2024, just one day after the teen arrived in Warsaw, Poland. More on Slon and their telegram communications with Laken can be found in the same Reuters report.
Our analysis uncovered several key findings:
This case illustrates not just the danger of radicalization or geopolitical manipulation — it can point out the blind spots in global financial visibility.
Need help following the crypto trail?
On-chain analysis can reveal the truth and evidence for journalists, investigators, and organizations handling crypto-related cases.
At Global Ledger, we support investigations with clear, evidence-based blockchain intelligence with the help of blockchain visualization technology and crypto AML risk-scoring solutions.
Reach out, and let’s dig into investigating suspicious crypto flows together.