Executive Summary and Exchange Overview
| Service type | Telegram-native crypto-to-fiat swap bot (@OO1kBOT) plus a web dashboard launched June 2026, layered over a physical cash-courier network offering in-person cash payouts and card/IBAN/e-wallet off-ramps Confirmed |
| Operator of record (current) | SATOSHI NAKAMOTO CORP. (Panama), Company No. 155773571, Global Bank Tower, 18th Floor, Suite 1801, 50th Street, Panama City; governing law Panama, per the 24 Apr 2026 Terms & Conditions Credible (self-attested in T&C; no Panama-registry corroboration found) [20] |
| Prior operator of record | CryptoBarrel UAB (Lithuania), reg. 306696279, registered 5 Mar 2024, Krivių g. 5, Vilnius; ~1 insured employee; 2025 revenue EUR 266,320, net profit EUR 84,894; director/sole shareholder Anatolii Molchanov (foreign national) Confirmed (registry) [23][24][25] |
| Aliases / branding | 001k; 001k.bot (@OO1kBOT); 001k.exchange; app.001k.bot (web dashboard); 001k.Trade (@trade001k, ~92.4k subscribers, "Alpha Academy"). Logo styles the name "OO1K" (two letter Os) while the domain uses "001k" (two zeros), a deliberate naming ambiguity Confirmed |
| Entity registration jurisdiction | Panama (current, self-attested); formerly Lithuania (CryptoBarrel UAB, registry-confirmed). State explicitly: the move to a Panama shell removes the entity from an EU VASP/AMLD regime to a jurisdiction with no equivalent CASP licensing Credible |
| Infrastructure hosting jurisdiction | Cloudflare DNS/proxy fronts both domains; 001k.bot registered via NameCheap (created 18 Apr 2024, WHOIS privacy via Withheld for Privacy, Iceland); 001k.exchange via NameSilo (created 22 Oct 2019, PrivacyGuardian). Physical hosting country masked Confirmed (registrar/Cloudflare) Analyst Inference (physical host) [31] |
| Assessed operator location | Ukraine (Kyiv). The June 2026 launch press release carries a Kyiv dateline; BestChange lists "Country: Ukraine"; the alleged founder is assessed Ukrainian Credible [6][14] |
| Operational period | 001k.exchange domain registered Oct 2019 (predates the rest of the corporate timeline); cash service self-dated to "the beginning of 2018"; Telegram bot active by 2022; web dashboard launched 22 Jun 2026 Credible |
| Volume (received) | >$14.8B in crypto received by 001k-linked wallets since Aug 2022, primarily USDT, per Chainalysis data provided to ICIJ; figure widely republished but not independently re-derived by a second vendor Confirmed (figure) Single Source (underlying vendor) [1][4][5] |
| Geographic footprint | Cash drops advertised in 300+ cities across 60+ countries, including New York, Miami, Los Angeles, Toronto, Montreal and Dubai; card payouts to Ukrainian, Russian and Chinese bank cards; "rearrangements between cities" Confirmed (per self-description and ICIJ) [1][11] |
| OFAC designation | None as of June 2026 Confirmed (negative evidence) [28] |
| UK / EU / FinCEN designation | None. 001k was not in the UK 26 May 2026 crypto package (which named Garantex, Grinex, Bitpapa, Rapira, EXMO and others); no EU listing; no FinCEN advisory or Section 311 action Confirmed (negative evidence) [29] |
| State nexus tier | NONE. No documented state direction, protection, or control by Ukraine or any state; principal counterparty WhiteBIT was declared "undesirable" by Russia, which argues against a Russian nexus |
| Status | Active, unsanctioned, and expanding (web dashboard launched June 2026); rated "High Risk" by AML Network Confirmed [5][6] |
| Blockchain analytics coverage | Chainalysis (the $14.8B total, data provided to ICIJ); Arkham Intelligence (ICIJ's onward-flow tracing); Crystal Intelligence (CIO Nick Smart quoted on the record). No standalone TRM Labs, Elliptic or Chainalysis report names 001k Confirmed [1][4] |
Lineage and Organizational Heritage
Jurisdictional Flight, Not Predecessor / Successor
Evidentiary Pillars
| Pillar | Evidence | Confidence |
|---|---|---|
| Domain timeline predates corporate wrappers | WHOIS: 001k.exchange created 22 Oct 2019 (NameSilo); 001k.bot created 18 Apr 2024 (NameCheap). CryptoBarrel UAB registered 5 Mar 2024. The service existed years before the Lithuanian company that later claimed to operate it. | CONFIRMED WHOIS; Lithuanian registry |
| Operator-of-record substitution | Earlier public reporting cited CryptoBarrel UAB (Lithuania) as the licensed operator. By the 24 Apr 2026 T&C the named operator is SATOSHI NAKAMOTO CORP. (Panama). The substitution moves governing law and dispute resolution to Panama. | CONFIRMED T&C (telegra.ph); registry records |
| Timing relative to ICIJ exposure | The shell substitution falls in the months immediately after the November 2025 ICIJ investigation. Causation is not documented, but the sequence is a classic post-exposure jurisdictional hardening pattern. | ANALYST INFERENCE Sequence-based inference |
| Pseudonymous corporate naming | The Panama entity is named after Bitcoin's pseudonymous creator and uses a registered-agent address (Global Bank Tower) shared by thousands of offshore companies. This mirrors the brand's "OO1K" visual obfuscation. | CREDIBLE T&C; address is a known agent tower |
Operator Profiles
Credible Single Source Serhii Hutsu (also Gutsu): named in NGO reporting (Non-Stop Ukraine) as the founder or representative of 001k.exchange and reported to be the subject of an international search arising from the Kyrgyz "Four Dragons" case (an 841,000 USDT theft, February 2024). Assessed Ukrainian. He is not sanctioned or indicted by any Western authority. The attribution rests on advocacy-NGO and foreign-case material; no Ukrainian court record or NABU press release directly naming Hutsu in connection with 001k was located. [10][11]
Confirmed Anatolii Molchanov: listed in Lithuanian registries (Scoris, sourcing the Centre of Registers) as director and sole shareholder of CryptoBarrel UAB, the prior operator of record. A foreign national. CryptoBarrel reported roughly one insured employee, 2025 revenue of EUR 266,320 and net profit of EUR 84,894. No indictment, no sanction. The company's link to 001k rests on 001k's own documentation; the registry itself does not name "001k." Credible (001k link) [23][24][25]
Credible "Golda Nova": the sole named contact on the June 2026 web-dashboard launch press release (Chainwire, Kyiv dateline). Likely a press or pseudonymous role rather than an attributable principal. The launch contact email was [email protected] (the source draft's "[email protected]" was not found). [6]
Credible SATOSHI NAKAMOTO CORP.: the current corporate operator of record is itself a pseudonym at the entity level. Treat it as a liability shield, not an attribution: there is no identified natural person behind the Panama company in open sources, and no independent Panama-registry confirmation of the company number cited in the T&C. Single Source (self-attested) [20]
Disputed Assessments
Single Source The $2.7 billion figure: a Non-Stop Ukraine NGO report ("How WhiteBIT and 001k.Exchange help oligarchs launder...") states "we have USD 2.7 billion laundered through WhiteBIT." This is the NGO's estimate for the broader WhiteBIT-linked scheme overall, with 001k named as one of several conduits. It is not a 001k-specific or 001k-to-WhiteBIT figure and should not be presented as one. AML Network flags the same caveat. [5][10][12]
Credible The "AMLA set to probe" claim: AML Intelligence initially reported the EU AML authority AMLA looked "set to probe" the Coin Laundry findings, but AMLA publicly clarified on 24 November 2025 that it does not conduct criminal investigations and is not investigating. A member of the European Parliament separately called for a probe. The draft's framing should be corrected to "an MEP called for a probe; AMLA stated it does not investigate." [7][8]
Confirmed The FINTRAC framing: 001k was not a named subject of Canada's March 2026 FINTRAC revocations because it was never FINTRAC-registered. ICIJ states it is illegal for 001k to do business with Canadians precisely because it is unregistered. 001k was the catalyst (via the undercover test), not a target, of that enforcement. [3]
Service Model and Business Operations
Exchange Mechanics and Product Set
Credible 001k runs a bifurcated model. The first layer is an on-chain swap service via the Telegram bot (@OO1kBOT) and, since June 2026, a web dashboard (app.001k.bot): instant crypto-to-fiat swaps across 14-plus cryptocurrencies and multiple fiat currencies (USD, EUR, AED, UAH), limit orders, off-chain internal transfers, a custodial wallet, a three-level referral program, and API access for third-party integrations. The second layer is a physical cash-courier service: in-person cash payouts in 300-plus cities across 60-plus countries, plus card, IBAN and e-wallet off-ramps. A manager-led premium tier is self-described for transactions of $50,000 and up. This architecture (anonymous stablecoin inflow, centralized swap/layering, physical cash exit) is the classic integration-layering structure that AML practitioners flag. [5][9][18]
Stated KYC/AML Posture vs Observed Behavior
Observed behavior (sourced to investigative testing and analytics, not the exchange's claims): ICIJ's undercover test converted 2,000 USDT to cash in Toronto with no identity document, authenticated only by a photographed $5-banknote serial number; CBC reports roughly US$1,900 was paid out. Quebec journalists were offered cash deliveries up to about $1 million with no ID. AML Network and Crystal-cited analysis describe more than $14.8 billion in inflows with "little or no KYC enforcement." The gap between a sophisticated stated policy and a no-ID cash network is the primary analytical finding and indicates structural KYC/AML failure by design rather than lapse. Confirmed [1][3][5][9]
Fiat Rails (Schema Rule: Must Be Addressed)
Analyst Inference 001k advertises card payouts to Ukrainian, Russian and Chinese bank cards, IBAN transfers, and e-wallet rails (PayPal, Wise, Revolut), alongside physical cash. No specific bank or payment-processor relationship is documented in open sources; no named correspondent, acquirer, or processor appears in the reviewed reporting. The absence is itself a finding: a network advertising card disbursement to three countries' banking systems and e-wallets necessarily touches regulated payment rails, but the counterparties are undisclosed, consistent with deliberate opacity and reliance on money-mule card networks rather than a single banking relationship. The cash-courier leg is designed precisely to avoid named fiat-rail dependencies. [11][18]
Licensing and Regulatory Standing
Credible Through CryptoBarrel UAB, 001k could point to a Lithuanian corporate registration to imply EU/FCIS alignment, but the Lithuanian company is a small, recently created entity, not a substantive licensed VASP operation, and the registry does not tie it to 001k. With the operator of record now a Panama shell, there is no VASP/CASP licensing regime equivalent to the EU's MiCA framework, no Financial Intelligence Unit reporting obligation comparable to Lithuania's FCIS, and no Western authorization. Treat all compliance and licensing claims as marketing absent a primary regulator record. 001k holds no FINTRAC registration in Canada despite operating cash payouts there. [1][13][20]
Technical Infrastructure and Platform Footprint
Domain Portfolio and Registration History
| Domain | WHOIS / role |
|---|---|
| 001k.exchange | Created 22 Oct 2019 (NameSilo; privacy via PrivacyGuardian; Cloudflare DNS). Longest-standing property; the exchange/cash-courier front end. Predates the bot and the corporate wrappers. |
| 001k.bot | Created 18 Apr 2024 (NameCheap; privacy via Withheld for Privacy, Iceland; Cloudflare DNS). Telegram bot front end (@OO1kBOT). |
| app.001k.bot | Subdomain of 001k.bot (no separate WHOIS record); the web dashboard launched 22 Jun 2026. |
Confirmed Both domains sit behind Cloudflare, masking origin hosting, and both use registrar-level WHOIS privacy. The infrastructure is built for low attribution and easy redeployment: a Telegram bot interface (no app-store dependency for the core product), Cloudflare fronting, and privacy-shielded registrations across two registrars. [31]
Apps, API and the BoxExchanger Payout Rail
Confirmed Beyond the consumer bot and web dashboard, 001k exposes an API that other exchangers integrate against. The white-label exchanger-script vendor BoxExchanger publishes a dedicated "001k bot payouts" module: an operator activates an API key through @OO1kBOT (granting Balance and Withdrawal permissions, with 2FA and IP whitelisting) and uses 001k to disburse funds to its own customers. This independently corroborates, from a non-ICIJ technical source, that 001k functions as wholesale payout infrastructure for third-party money-service businesses and exchangers, not merely a retail cash desk. [26]
The Compliance-Tool Paradox
Credible 001k markets an on-demand AML wallet-screening add-on, sold on a subscription or token basis, positioning itself as a compliance-tooling provider at the same time it operates a no-ID cash network. This dual posture is itself an infrastructure observation: the platform packages a veneer of compliance capability as a product feature while the core cash leg is built to avoid the controls that screening would imply. [12]
Resilience and Adaptability
Confirmed 001k's infrastructure is resilient by construction. The primary interface is a Telegram bot, which is hard to take down through app-store or hosting action; Cloudflare fronting and privacy-shielded, multi-registrar domains complicate attribution and seizure; and the corporate layer can be swapped (Lithuania to Panama) without touching the technical stack. Rather than contracting after the ICIJ exposure, 001k expanded, launching a full web dashboard in June 2026. [6][20][31]
Financial Intelligence and On-Chain Analysis
Volume (Cite Source and Methodology; Do Not Average)
ICIJ / Arkham Intelligence tracing (Nov 2025): onward flows from 001k to exchange customer accounts of more than $400 million at Binance, more than $54 million at OKX, more than $13 million at Kraken, and more than $1.1 billion at WhiteBIT. These are ICIJ's own wallet-level analysis using Arkham, not separately vendor-attributed.
NGO (Non-Stop Ukraine, Feb 2025): about $2.7 billion. Correction: this is the NGO's estimate for the broader WhiteBIT-linked scheme overall, with 001k named as one conduit. It is not a 001k-specific figure and is not combined with the figures above.
BestChange (self-declared): a self-reported, unaudited "reserve" figure, listed around $30.9 million at review (the source draft's $51.4 million appears to be a stale snapshot). It reflects claimed liquid reserves, not total flow.
Figures from different sources are presented separately and never averaged. [1][4][5][10][14]
Three-Phase On-Chain Flow (001k as Node)
Phase 1: Receipt
Confirmed 001k receives high-volume stablecoin inflows (primarily USDT) into a network of receiving wallets. ICIJ characterizes the pattern as consistent with a cash-out service: incoming stablecoins, rapid onward movement, and no conventional customer profiling. Funds enter from anonymous or lightly screened wallets and from other exchangers using 001k as a payout rail. [1][5]
Phase 2: Layering
Confirmed Inflows move rapidly onward to customer accounts at major centralized exchanges (Binance, OKX, Kraken, WhiteBIT), where they co-mingle with general exchange liquidity, and through 001k's internal/off-chain transfer and custodial-wallet features. The use of multiple exchanges and accounts to obscure origin is the documented layering mechanism. Settlement is USDT-heavy, consistent with the broader cash-desk ecosystem. Credible (mechanism) [1][5]
Phase 3: Extraction
Confirmed The defining extraction leg is physical cash, delivered by courier in 300-plus cities, plus card/IBAN/e-wallet off-ramps. The no-ID cash handoff (authenticated by a banknote serial number) is the point at which value leaves the traceable on-chain environment, which is what makes the network a "money-laundering nightmare" in investigators' words. [1][3]
Sanctions and Risk-Rating Summary
| Authority / source | Action / status | Date / status |
|---|---|---|
| OFAC (U.S.) | No designation of 001k, SATOSHI NAKAMOTO CORP., CryptoBarrel UAB, or any named individual; no designated wallets | Not designated (June 2026) |
| UK (FCDO / OFSI) | Not in the 26 May 2026 crypto package (Garantex, Grinex, Bitpapa, Rapira, EXMO and others); no listing | Not designated (June 2026) |
| EU | No entity-specific listing located; not tied to the proposed 21st-package crypto list in any source | Not designated (June 2026) |
| FinCEN / DOJ | No advisory, Section 311 action, indictment or criminal complaint naming 001k located | None (negative evidence) |
| AML Network (watchdog) | Rated "High Risk"; profiled as a no-KYC crypto-to-cash laundering conduit | Active listing (2025, updated Dec 2025) |
Client Profile and Criminal Use
Crimeware Verticals by Evidence Tier
| Actor / use type | Evidence | Confidence |
|---|---|---|
| No-KYC cash-out for unspecified illicit proceeds | ICIJ undercover test (no-ID cash payout); >$14.8B inflow with "little or no KYC"; investigators describe funds routinely flowing from scams, sanctioned entities and high-risk services into unlabeled wallets and out as cash. | CONFIRMED |
| Wholesale payout rail for other exchangers / MSBs | BoxExchanger publishes a dedicated 001k payout-API module, confirming third-party MSBs disburse customer funds through 001k. | CONFIRMED |
| Foreign theft / fraud proceeds | The Kyrgyz "Four Dragons" case (841,000 USDT theft, Feb 2024) is reported to tie an 001k principal (Hutsu) to laundering of stolen funds; NGO/foreign-case sourced. | CREDIBLE |
| Oligarch / sanctions-evasion capital (via WhiteBIT ecosystem) | NGO reporting places 001k as one conduit within a broader WhiteBIT-linked scheme alleged to move oligarch and politically linked capital; PEP involvement alleged, not adjudicated. | CREDIBLE |
| Ransomware / extortion proceeds | A no-ID, high-volume cash-out network is a natural off-ramp for extortion proceeds, but no 001k-specific ransomware-actor attribution has been published by any analytics vendor. | ANALYST INFERENCE |
Geographic Patterns
Confirmed The cash-courier footprint concentrates in North American metros (New York, Miami, Los Angeles, Toronto, Montreal), Dubai, and card payouts into Ukrainian, Russian and Chinese banking systems. The operating base is assessed as Ukraine. Active or referenced scrutiny spans Canada, Austria, Ukraine, the UAE and Uzbekistan, though most of the Austria/UAE/Uzbekistan threads center on WhiteBIT, with 001k named as an affiliated conduit. [1][5][11]
High-Profile Flows
Credible The quantitative anchors are counterparty-level, not actor-level: >$1.1B to WhiteBIT and >$467M combined to Binance/OKX/Kraken (ICIJ/Arkham). The only named criminal case tying a specific theft to 001k is the Kyrgyz "Four Dragons" matter (841,000 USDT), which is single-source. No analytics vendor has published an 001k-specific, named-actor flow with an attributed dollar figure; this is a documented intelligence gap (Section 10). [1][11]
State Nexus Assessment
Jurisdictional Separation (Schema Rule: Three Jurisdictions)
| Jurisdiction type | Assessment | Confidence |
|---|---|---|
| 1. Entity registration | Panama (SATOSHI NAKAMOTO CORP., self-attested in the T&C, no registry corroboration found); formerly Lithuania (CryptoBarrel UAB, registry-confirmed). | CREDIBLE (Panama, self-attested) / CONFIRMED (Lithuania, prior) |
| 2. Infrastructure hosting | Cloudflare DNS/proxy on both domains; registrars NameSilo (001k.exchange, 2019) and NameCheap (001k.bot, 2024); physical hosting country masked. | CONFIRMED (Cloudflare/registrar) / UNKNOWN (physical host) |
| 3. Assessed operator location | Ukraine (Kyiv): Kyiv press dateline, BestChange "Country: Ukraine," assessed-Ukrainian principal. | CREDIBLE |
State Nexus Tier: NONE
What would be expected if a higher tier existed, and is absent: no evidence of intelligence-service tasking, no documented protection from prosecution, no state-linked ownership, and no pattern of selective enforcement immunity tied to state direction. On the contrary, the ecosystem faces NGO-reported NABU and SBI/DBR interest in Ukraine and an international search around a 001k principal, which is inconsistent with active state protection.
Caveat (low confidence): 001k continues to operate openly from an assessed Ukrainian base despite high-profile ICIJ exposure, which could be read as passive tolerance or simply weak/slow domestic enforcement during wartime. This is logged as a low-confidence signal, not a basis to escalate to TOLERATED SAFE HARBOR, because there is no evidence the state is aware-and-deliberately-refraining as opposed to under-resourced. Analyst Inference [10][11][13]
Negative Evidence (Expected if Higher Nexus Existed)
If 001k were under TOLERATED SAFE HARBOR, PROBABLE COOPERATION, or DIRECT CONTROL, one would expect documented state coordination, demonstrable protection from enforcement, or ownership ties to state organs. None are present. The available record points the other way: investigative and NGO reporting describes criminal-justice interest in the wider ecosystem, and the jurisdictional flight to a Panama shell is the behavior of an operator hardening against enforcement, not one relying on state cover. The assessment holds at NONE, with the open-operation-despite-exposure caveat flagged as the key uncertainty. Analyst Inference
Law Enforcement and Regulatory Response
Investigative Exposure (Primary "Action" to Date)
Multi-Jurisdictional Picture
| Jurisdiction | Action / status | Confidence |
|---|---|---|
| Canada | ICIJ undercover transaction assessed by experts as a probable AML violation (Nov 2025); FINTRAC revoked ~three dozen crypto-MSB registrations (Mar 2026) in a sweep catalyzed by the ICIJ/Toronto Star reporting. 001k was not on the revoked list (it was never FINTRAC-registered) and was the trigger, not a named subject. | CONFIRMED |
| Ukraine | NGO reporting cites NABU and SBI/DBR interest in the WhiteBIT/001k ecosystem and criminal proceedings for money laundering; no court record or NABU release directly naming 001k was located. | CREDIBLE Single Source |
| Kyrgyzstan | The "Four Dragons" case (841,000 USDT theft, Feb 2024) is the documented matter that directly names an 001k principal (Hutsu) and an international search. | CREDIBLE Single Source |
| Austria / UAE / Uzbekistan | Referenced as involved jurisdictions in AML Network's case profile; the underlying probes center on WhiteBIT, with 001k named as an affiliated conduit rather than the primary subject. | ANALYST INFERENCE |
| United States | No federal action. US metros (New York, Miami, Los Angeles) appear as cash-payout locations. No DOJ, OFAC, or FinCEN action located. | CONFIRMED (negative evidence) |
| EU (AMLA) | Correction: AMLA publicly stated (24 Nov 2025) it does not conduct such investigations; an MEP called for a probe. There is no AMLA investigation of 001k. | CONFIRMED (correction) |
Timeline
Post-Disruption / Post-Exposure Reconstitution Assessment (Schema Rule)
Outlook: absent a formal designation or coordinated takedown, the most likely trajectory is continued operation and incremental hardening (further entity substitutions, new domains/mirrors, additional payout rails). The decisive lever would be an OFAC/EU/UK designation plus seizure or sanctioning of receiving-wallet clusters and pressure on the downstream CEX off-ramps (Binance, OKX, Kraken, WhiteBIT). Credible [6][20]
Connected Entities and Ecosystem Relationships
Tier 2, Facilitation assessment: an analytical characterization of the role: Active facilitation, Structural enablement, or Incidental processing. The two tiers are independent and never collapsed.
Vendor note: nearly all 001k on-chain figures originate in a single investigation (ICIJ, using Arkham for onward flows and Chainalysis for the total). They are flagged Single Source accordingly; no second analytics vendor has independently published 001k-specific bilateral figures.
| Entity | Tier 1: Transaction confidence | Tier 2: Facilitation | Vendor coverage |
|---|---|---|---|
| WhiteBIT Ukraine-based exchange; Russia-"undesirable" Jan 2026 |
CONFIRMED >$1.1B from 001k to WhiteBIT customer accounts (ICIJ / Arkham). Single Source on the figure. (The $2.7B is WhiteBIT-overall, NGO, not 001k-specific.) |
Structural enablement WhiteBIT recharacterized the flows as crypto-only use of its infrastructure and denied fiat involvement; it did not deny the flows. Knowing active facilitation is not established at the operator level. |
Corroborating: ICIJ (Arkham); NGO Non-Stop (broader scheme); CoinDesk et al. on the Russia-"undesirable" status. WhiteBIT disputes the characterization. No second analytics vendor on the bilateral figure. |
| Binance Global exchange (downstream) |
CONFIRMED >$400M from 001k to Binance customer accounts (ICIJ / Arkham). Single Source. |
Incidental processing Receiving venue for onward flows; no evidence of a knowing relationship with 001k. Binance gave a generic compliance statement. |
Corroborating: ICIJ (Arkham); AML Network restates. Binance did not address 001k specifically. |
| OKX Global exchange (downstream) |
CONFIRMED ~$54M from 001k to OKX customer accounts (ICIJ / Arkham). Single Source. |
Incidental processing Downstream recipient; no documented knowing relationship. OKX did not comment on the 001k transactions. |
Corroborating: ICIJ (Arkham); AML Network restates. No second vendor. |
| Kraken Global exchange (downstream) |
CONFIRMED ~$13M from 001k to Kraken customer accounts (ICIJ / Arkham). Single Source. (Do not merge with ICIJ's separate $2.1M Kraken figure for an Armenian cash desk.) |
Incidental processing Downstream recipient; no documented knowing relationship. Kraken did not respond on 001k specifically. |
Corroborating: ICIJ (Arkham); AML Network restates. No second vendor. |
| BoxExchanger White-label exchanger-script vendor |
CONFIRMED Publishes a dedicated 001k payout-API integration module; not a fund-flow figure but a documented technical relationship. Single Source (vendor manual). |
Structural enablement 001k functions as wholesale payout infrastructure that third-party MSBs plug into, predictably extending its no-KYC cash-out capacity across other operators. |
Corroborating: BoxExchanger documentation (independent, non-ICIJ technical source). |
| Exchange Team / Crystal-Trade / 24BestEx Other exchangers named alongside 001k |
ANALYST INFERENCE NGO names these as part of the same fund-splitting network; no on-chain quantification. Single Source (NGO). |
Structural enablement If accurate, a cluster of interoperating exchangers amplifies layering/cash-out capacity; characterization is provisional pending on-chain corroboration. |
Corroborating: NGO Non-Stop only. No analytics-vendor corroboration; not yet published by TRM/Chainalysis/Elliptic. |
| 60Sek Cash-courier peer in the same ICIJ ecosystem |
ANALYST INFERENCE Named by ICIJ/Chainalysis as a cash-desk peer (linked to the Russian financial system), but no direct 001k-to-60Sek fund flow is documented. |
Incidental processing Ecosystem peer, not a confirmed 001k counterparty; included for completeness, not as an established relationship. |
Corroborating (as peer): ICIJ, Chainalysis. No 001k-specific flow published. |
Trajectory Assessment
Market Position and Volume Trends
Confirmed By received-volume, 001k is among the largest crypto-to-cash conduits documented in open source: >$14.8B since August 2022 places it well above the per-jurisdiction cash-desk figures ICIJ cites elsewhere (for example, ~$2.5B through Hong Kong desks in 2023). It is an established, high-liquidity node with a real if concentrated retail base (BestChange shows 263 reviews and a small number of resolved disputes) and a wholesale payout business serving other exchangers. [1][14][26]
Disruption Impact
Reconstitution / Continuity Status
Brand: Active, unsanctioned, and expanding. A full web dashboard launched June 2026, after the exposure. Confirmed
Hardening: Pre-emptive. Operator of record moved Lithuania to Panama (pseudonymous shell) in the months after ICIJ, with no service interruption. Confirmed
Future risk: Persistence and incremental hardening absent a formal designation or coordinated takedown; further entity substitutions and new payout rails are the most likely adaptations. Credible
Intelligence Gaps
Recent Reporting
[22 Jun 2026] 001k launches a full web dashboard (app.001k.bot), distributed via Chainwire with a Kyiv dateline and a 0% USDT-to-USDC swap promo aimed at MiCA-affected EU users; contact [email protected]. The platform is expanding, not retreating, after the ICIJ exposure. [6]
[24 Apr 2026] Updated Terms & Conditions name SATOSHI NAKAMOTO CORP. (Panama) as operator of record and set Panamanian governing law, replacing the Lithuanian CryptoBarrel UAB. [20]
[Mar 2026] Canada's FINTRAC revokes ~three dozen crypto-MSB registrations in a sweep catalyzed by the ICIJ/Toronto Star reporting; 001k, being unregistered, was the trigger rather than a named subject. [3]
[24 Nov 2025] AMLA clarifies it does not conduct such investigations, correcting "set to probe" reporting; an MEP separately called for a probe. [8]
[17 Nov 2025] ICIJ publishes "Coin Laundry," naming 001k (>$14.8B received) and detailing the undercover Toronto cash test (no ID; $5-banknote serial). 001k did not respond. Crystal Intelligence's CIO is quoted on the record. [1][2][4]
[Feb 2025] Non-Stop Ukraine NGO publishes the WhiteBIT/001k laundering exposé, the source of the $2.7B WhiteBIT-overall estimate and of the Hutsu attribution. [10][11]
Sources
- ICIJ: From Dubai to Toronto, inside the crypto-to-cash storefronts (001k >$14.8B received since Aug 2022 per Chainalysis data provided to ICIJ; onward flows >$400M Binance, ~$54M OKX, ~$13M Kraken, >$1.1B WhiteBIT via Arkham; undercover Toronto cash test) : 17 Nov 2025
- ICIJ: Undercover crypto transactions, shady multimillion-dollar schemes and more Coin Laundry stories from ICIJ's partners
- ICIJ: Canada revokes dozens of crypto firms' registrations (FINTRAC sweep, Mar 2026; 001k unregistered and not a named subject)
- Crystal Intelligence: Crypto-to-cash networks exposed (restates ICIJ $14.8B; Crystal CIO Nick Smart quoted on record) : 19 Nov 2025
- AML Network: 001k watchdog-database entry ("High Risk"; onward-flow breakdown; $2.7B is WhiteBIT-overall, not 001k; multi-jurisdiction scrutiny)
- Business Insider / Chainwire: From Telegram Bot to Full-Fledged Platform: 001k.bot Launches Web Dashboard (Kyiv dateline; contact "Golda Nova") : 22 Jun 2026
- AML Intelligence: "Coin Laundry" expose, main findings
- AML Intelligence: AMLA clarification that it does not conduct such investigations (correcting "set to probe") : 24 Nov 2025
- CBC: Crypto-to-cash in Canada (undercover test; ~US$1,900 cash received)
- Non-Stop Ukraine (NGO): How WhiteBIT and 001k.Exchange help oligarchs launder millions ($2.7B WhiteBIT-overall estimate)
- Non-Stop Ukraine (NGO): International search for 001k founder Hutsu; WhiteBIT owner Nosov
- 001k Terms & Conditions (Telegraph, 24 Apr 2026): SATOSHI NAKAMOTO CORP., Panama, Co. 155773571; AML wallet-screening add-on
- Lursoft: CryptoBarrel, UAB (Lithuanian company record, reg. 306696279)
- BestChange: 001K exchanger (self-declared reserve; "Country: Ukraine"; ~4y9m listed; 263 reviews)
- Revieweek: 001k.exchange (no office or owner data recorded)
- Liga.net: 001K.EXCHANGE exchanger overview (Ukrainian company; offline cash points)
- Cryptopolitan: 001k.exchange review (cash payouts; card/IBAN/PayPal/Wise/Revolut; $50k+ manager-led tier)
- 001k AML & KYC Policy (Telegraph): stated mandatory KYC, sanctions screening, exclusion list
- 001k Law Enforcement Requests Policy (Telegraph)
- Scoris: CryptoBarrel, UAB company info (director/sole shareholder Anatolii Molchanov; ~1 employee; 2025 revenue EUR 266,320; net profit EUR 84,894)
- BoxExchanger: 001k bot payouts module (API integration confirming 001k as a third-party payout rail)
- OFAC Sanctions List Search Tool (negative evidence: no 001k, SATOSHI NAKAMOTO CORP., CryptoBarrel UAB, or named-individual designation as of June 2026)
- UK Government: List of Russia sanctions designations, 26 May 2026 (negative evidence: 001k not included)
- CoinDesk: Russia flags WhiteBIT as "undesirable" over support for Ukraine's military : 26 Jan 2026
- FATF: High-risk and monitored jurisdictions, June 2026 plenary (Ukraine, Panama, Lithuania: none grey- or black-listed)
- CoinLaunch: 001k.Trade (@trade001k) channel statistics (~92.4k subscribers; "Alpha Academy")
Profile produced using open-source intelligence. Confidence labels applied per schema: CONFIRMED (multiple independent sources), CREDIBLE (single strong source or multiple weaker sources), ANALYST INFERENCE (logical extrapolation from confirmed facts). Volume figures cited with source and methodology and never averaged (Chainalysis-via-ICIJ >$14.8B received; ICIJ/Arkham onward flows >$400M Binance, ~$54M OKX, ~$13M Kraken, >$1.1B WhiteBIT; NGO $2.7B is WhiteBIT-overall, not 001k). Two-tier connected-entity model applied throughout Section 09 (Tier 1 transaction confidence plus Tier 2 facilitation assessment). Three jurisdictions documented separately per schema (registration Panama/formerly Lithuania; hosting Cloudflare with physical host unknown; assessed operator location Ukraine). Key corrections vs source draft: (1) the $14.8B is ICIJ citing Chainalysis, not a standalone Chainalysis report, and no second vendor has re-derived it; (2) the $2.7B is an NGO estimate for the broader WhiteBIT scheme, not a 001k-specific figure; (3) AMLA stated it does not investigate (the "set to probe" framing is inaccurate; an MEP called for a probe); (4) 001k was the catalyst for, not a named subject of, the FINTRAC revocations, because it was never registered; (5) the June 2026 launch contact was [email protected], not [email protected]; (6) the live BestChange reserve is ~$30.9M, not $51.4M; (7) CryptoBarrel UAB shows ~1 insured employee. Status: Active; unsanctioned (no OFAC/UK/EU/FinCEN designation); rated High Risk by AML Network; assessed state nexus NONE.