In brief
- A U.S. court has sentenced Russian citizen Aleksei Volkov to 81 months in prison for his role in ransomware attacks causing over $9 million in actual losses.
- Volkov operated as an “initial access broker,” finding vulnerabilities and selling unauthorized access to ransomware groups who then encrypted victims’ data.
- The 26-year-old must pay $9.2 million in restitution to victims and forfeit equipment used in the crimes.
A court in the Southern District of Indiana sentenced Russian citizen Aleksei Volkov, 26, to 81 months in prison Monday for assisting major cybercrime groups including the Yanluowang ransomware group in attacks that caused over $9 million in actual losses and over $24 million in intended losses across the United States.
Volkov, of St. Petersburg, Russia, operated as an “initial access broker”—a specialist who gains unauthorized access to corporate networks and sells that access to other threat actors, according to court documents. His buyers used the access to deploy ransomware that encrypted victims’ data, then demanded cryptocurrency payments—“sometimes in the tens of millions of dollars”—in exchange for restoring access and not publishing stolen data on leak sites.
On November 25, 2025, Volkov pleaded guilty to four counts from the Southern District of Indiana indictment—unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft—plus two counts from the Eastern District of Pennsylvania indictment for conspiracy to commit computer fraud and conspiracy to commit money laundering. Police in Rome, Italy, had arrested Volkov before his extradition to the United States.
As part of his plea agreement, Volkov admitted that he and co-conspirators “demanded tens of millions of dollars in ransom and received millions,” with Volkov receiving a share of cryptocurrency ransom payments. The court ordered him to pay full restitution including almost $9.2 million to known victims and to forfeit equipment used in his crimes.
Ransomware and crypto
Ransomware, often leveraging cryptocurrency for payment, remains a challenge for the crypto space. Per Chainalysis’ 2026 Crypto Crime Report, on-chain ransomware payments totaled $820 million in 2025, down 8% year-on-year, while claimed attacks increased by 50% and the median ransom payment grew 368% year-over-year to nearly $60,000.
In recent months, ransomware developers have turned to blockchain smart contracts as a distribution channel, including the DeadLock ransomware strain that leverages Polygon smart contracts for proxy server address rotation and distribution, and EtherHiding, which targets BNB Smart Chain and Ethereum smart contracts.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Can bypass Financial Supervisory Commission (FSC) rules to buy crypto with credit cards? ODC pushes a Wallet Pro service for buying crypto with U.S. debit cards
OdinDentis (Odinting?) launched the OwlPay and Wallet Pro services, focusing on B2B cross-border payments. By combining stablecoin technology with international financial systems, it showcases its fintech transformation. Through its partnership with MoneyGram, Wallet Pro enables cross-border transfers of stablecoins purchased with cash, and operates in the U.S. market. The company’s overseas model bypasses Taiwan’s strict regulation and, under the new draft law, challenges the market competition landscape; in the future, it will affect local operators’ compliance strategies.
CryptoCity14m ago
FBI teams up with Indonesia to dismantle W3LL phishing network, with more than $20 million involved
The U.S. FBI and Indonesian police successfully cooperated to dismantle a W3LL phishing network, seizing related equipment and detaining suspects. The W3LL phishing toolkit offers low-priced fake login pages that use man-in-the-middle attacks to easily bypass multi-factor authentication, forming an organized cybercrime ecosystem. This operation marks cooperation between the U.S. and Indonesia in law enforcement against cybercrime; however, the security threats to cryptocurrency users remain severe.
MarketWhisper2h ago
The Russian Federal Security Service cracked down on Telegram investment channel market manipulation, involving 19 companies and 55k illegal transactions
The Federal Security Service of Russia arrested three Telegram investment channel admins for manipulating stock prices through a "Pump&Dump" strategy, involving more than 55k trades across 19 large companies. Research shows that 11% of Telegram investment signals can affect stock returns, and more than 60% of investors rely on such signals. The central bank warned that it will monitor unusual transactions.
GateNews2h ago
Is it possible to bypass Financial Supervisory Commission (FSC) rules for buying crypto with card payments? O’DinDin promotes Wallet Pro, a service for buying crypto with a U.S. card payment
Odin Ding has launched the OwlPay and Wallet Pro services, focusing on B2B cross-border payments. By combining stablecoin technology with international financial systems, it showcases its fintech transformation. Through its partnership with MoneyGram, Wallet Pro enables cross-border transfers for cash purchases of stablecoins and operates in the U.S. market. The company’s offshore model avoids Taiwan’s strict regulation, and under the new draft legislation, it challenges the market competitive landscape; in the future, it will affect local operators’ compliance strategies.
CryptoCity3h ago
South Korean “retaliation intermediary” agencies charged USDT to carry out violent crimes, and continued operating even after the main suspect was arrested
South Korea has recently seen multiple “revenge intermediary” organizations that use cryptocurrency as a payment method. They offer intimidation and murder services via Telegram. Even though the main culprit has been arrested, related advertisements are still being posted. Police are investigating more than 50 cases and have arrested about 30 people.
GateNews4h ago
Encourage innovation! A U.S. judge in France bans Arizona’s regulation of prediction markets and pauses the prosecution against Kalshi.
A U.S. federal district court ruled that Arizona is prohibited from using its gambling laws to prosecute the prediction market platform Kalshi, concluding that the Commodity Futures Trading Commission has exclusive jurisdiction. The ruling affects the boundary between state and federal authority in regulating financial markets, and Kalshi maintains that its business is a financial product rather than traditional gambling. Decisions on prediction markets differ across states, and the Trump family has also expressed support for prediction markets.
CryptoCity5h ago
