Evita Founder Charged in $530M Case

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, charges against a crypto firm founder in a $530 million sanctions evasion and money laundering case, guilty pleas in a $36.9 million scam, an $8.3 million exploit of Alex Lab, and Cetus Protocol relaunched after a $223 million hack.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

The U.S. Department of Justice indicted Russian national Iurii Gugnin on 22 counts for using his cryptocurrency companies Evita Investments and Evita Pay to launder more than $500 million through U.S. banks and crypto exchanges. Authorities allege the New York resident facilitated transactions with sanctioned Russian banks, disguised fund sources and helped Russian clients obtain sensitive U.S. technology, including export-controlled servers and parts for Russia’s nuclear agency Rosatom.

Gugnin allegedly obtained a Florida money transmitter license using false information, enabling him to access crypto exchange services. Prosecutors accuse him of intentionally bypassing sanctions and export controls. Gugnin faces decades in prison if convicted, including up to 30 years for each count of bank fraud and 20 years for wire fraud and sanctions violations.

Five men pleaded guilty to their roles in laundering over $36.9 million stolen from U.S. victims through a global digital asset investment scam operated from Cambodia.

Scammers tricked victims into believing they were investing in digital assets, when in reality their funds were funneled through shell companies and foreign bank accounts before being laundered using cryptocurrency. Victims were misled through unsolicited messages, phone calls and dating platforms. The laundered funds were transferred to an account at Deltec Bank in the Bahamas under Axis Digital Limited, then converted to Tether and moved to wallets controlled by scam leaders in Cambodia.

The defendants include Joseph Wong, 33, of Alhambra; Yicheng Zhang, 39, of China; Jose Somarriba, 55, of Los Angeles; Shengsheng He, 39, of La Puente; and Jingliang Su, 44, of China and Turkey, with roles ranging from managing U.S.-based shell companies to overseeing the crypto conversions. Some face up to 20 years in prison.

Stacks-based DeFi protocol Alex Lab suffered an $8.3 million hack after an attacker exploited a flaw in the platform’s verification logic. The attacker bypassed safeguards in the self-listing function by referencing a failed transaction, taking advantage of Stacks’ inability to reliably detect such failures.

Alex Lab pledged to fully reimburse affected users using its treasury funds. The protocol’s token $ALEX plummeted about 45% following the breach.

This marks Alex Lab’s second major incident in just over a year: in May last year, it lost $4.3 million due to a phishing attack that compromised private keys. That earlier attack was linked to North Korea’s Lazarus Group. Alex Lab previously managed partial fund recoveries from centralized exchanges, adding that only eight of 15 have returned funds, with negotiations ongoing for the rest and more recoveries expected in the second quarter of the year.

A decentralized exchange operating on Sui and Aptos, Cetus Protocol has relaunched after a $223 million hack in May, restoring most of its affected liquidity pools. The attack, which exploited an integer overflow flaw in a shared math library, allowed a single token deposit to appear massively overvalued.

Sui validators froze $162 million, returning the amount. Cetus replenished affected pools using recovered assets, its $7 million treasury and a $30 million loan from the Sui Foundation, achieving an 85% to 99% recovery for liquidity providers. The remaining losses will be reimbursed in CETUS tokens over a 12-month vesting period. The Aptos pools were unaffected, and the hacker has begun laundering stolen funds through Tornado Cash. Cetus has since patched the vulnerability, conducted audits and plans further security upgrades and a white-hat bounty program.