PwC analysts: SamSam hackers withdraw bitcoins through WEX

Iranian citizens Faramarz Shahi Sawandi and Mohammed Mehdi Shah Mansuri, among other hackers who distributed SamSam extortioner, laundered illegally obtained funds through the WEX cryptocurrency exchange (formerly BTC-e). This assumption was made by researchers of the PwC audit firm.

According to the report, for 34 months of hacking and extortion, Sawandi and Mansuri received about $ 6 million in bitcoins. About $ 1.9 million of this amount, they brought through BTC-e, the rest – through Iranian and Slovak cryptobirds.

“The operators of the Iranian bitcoin exchanges Mohammed Gorbanian and Ali Khorashadizade helped Sawandi and Mansuri exchange the bitcoins received as ransom,” the PwC report said.

For example, Gorbanian is listed as the only contact on the enexchanger.com website, which provided services for the exchange of WEX and USD codes, thus allowing direct withdrawal of money to WEX users.

“Both the perpetrator and those posing a threat to national security are linked to the BTC-e / WEX exchange. The little-known platforms without KYC / AML allowed them to hide the facts of illegal activities, ” PwC analysts said.

In general, losses from the activities of the extortionist SamSam in the US and Canada amounted to more than $ 30 million.

Recall that the domain of the BTC-e cryptocurrency exchange was confiscated by the US authorities in July 2017. BTC-e was called responsible for the withdrawal of 95% of all payments received by extortion programs from 2014 to 2017.

In September, the exchange restarted on the domain WEX.nz. The new site bought the accounts of all BTC-e customers and took on the stock exchange's debt obligations .

Earlier, a lawyer suspected of laundering $ 4 billion through the BTC-e cryptobirth Russian Alexander Vinnik suggested that the funds missing from the stock exchange may be partially located on the WEX site .

Subscribe to BlockchainJournal news on VK !