The Parisian Court of Corrections on Monday ruled that Alexander Vinnik will serve five years, in addition to paying a total of 100,000 euros (US$120,000) in financial penalties, after he was found guilty of money laundering.
The court had previously acquitted Vinnik, for lack of evidence, on further charges of extortion and association with a criminal enterprise, relating to his tenure as technical operator at BitCoin currency exchange BTC-e.
Prosecutors also accused him of directly contributing to the creation of a ransomware programme called “Locky,” which was allegedly used in a series of attacks on French businesses and organizations between 2016 and 2018 that resulted in at least 20 victims paying out to retrieve data encrypted with the malicious software.
While Vinnik’s journey may have landed him in a French prison, the path that led him there was far from straightforward, with his sentence marking at least a temporary reprieve in the three-year legal odyssey that saw the Russian national at the epicenter of a complex jurisdictional tug-of-war between several countries.
In 2017, amid a crackdown on Russian cybercriminals operating in Europe, the U.S. Department of Justice indicted Vinnik on 21 charges relating to BTC-e’s alleged role as an international money laundering hub for organized crime groups, carrying a possible criminal sentence of more than 55 years in jail.
Specifically, Vinnik is believed to have laundered proceeds from a hack against Japanese crypto-exchange Mt. Gox, which subsequently collapsed, through holdings based in San Francisco, thus establishing U.S. jurisdiction in the matter.
However, it was later revealed that BTC-e had also allegedly laundered money for the cyber-espionage outfit Fancy Bear, a group with links to Russia’s GRU and widely believed to have been behind the 2016 hack against the Democratic National Committee.
Greek authorities arrested Vinnik shortly after the U.S. issued its indictment in 2017, while he was on a family holiday at a beach-side village outside of the northern city of Thessaloniki.
Russian authorities subsequently filed their own extradition request, on separate charges related to a petty theft totalling around US$11,000, in a move seen by many as an attempt to keep Vinnik from falling into the hands of U.S. investigators.
While in October of that year a court in Thessaloniki gave the green light for Vinnik to be extradited for trial in the U.S., an appeal soon saw the matter brought before the Greek Supreme Court in Athens.
Vinnik then submitted a confession to Russian authorities regarding his role at BTC-e, leading to a new set of more serious charges involving computer fraud, which carried a possible sentence of ten years in jail, thereby bolstering the country’s claim.
Russian president Vladimir Putin was even reported to have raised the matter of Vinnik’s prosecution during talks in Moscow with the Greek prime minister, Alexis Tsipras, in December 2018.
Greece’s Supreme Court eventually ruled in Russia’s favor. But it was while Vinnik was being shuffled between Athens and Thessaloniki, with the courts offering contradictory rulings, that France weighed in with its own extradition request, accusing Vinnik of defrauding French citizens and continuing to operate BTC-e even after he was detained by Greek authorities.
The lower court in Thessaloniki was able to successfully arrange Vinnik’s transfer to France because, according to EU law, the approval of the Greek justice minister was not required for extradition to a fellow member state: a fact seized upon by the accused’s lawyers as evidence that France had made its request at the behest of the U.S., in order to keep Vinnik from being tried in his home country.
If the suspected move was designed to prevent Vinnik from receiving lighter punishment for his alleged crimes, it would not appear to have paid off, with the recent ruling by a Parisian court imposing a sentence equivalent to just an eleventh of the time Vinnik might have faced if he had been tried by the U.S. Department of Justice.
Vinnik claimed during legal proceedings in France that he had merely been acting on instruction of other senior figures at BTC-e, and his lawyers are reported to now be considering an appeal on the basis that cryptocurrency is not “money” per say, and that the charges which secured Vinnik’s conviction therefore ought not to have applied.
It remains to be seen whether Vinnik will be returned to Russia after completing his sentence, or if U.S. prosecutors may be able to take another run at trial once when he is due for release.
