⚠ Triple-Designated Entity, No Named Operators : Hero Module
Bitpapa is one of the few crypto services sanctioned under three separate national regimes: OFAC (25 March 2024), Ukraine (6 July 2025), and the United Kingdom (26 May 2026). The corporate entity, BITPAPA IC FZC LLC, is designated in all three. No founder, beneficial owner, or operator has been publicly named or designated by any authority, which is the profile's single most important intelligence gap and the reason no operator hero module appears here.
BITPAPA IC FZC LLC
Sanctioned legal entity : the only designated node
TypeCustodial P2P crypto marketplace and wallet
RegistrationAjman Media City Free Zone, UAE (Reg. 5069)
Established29 Apr 2022
Websitesbitpapa.com, bitpapa.org
OFACSDN 25 Mar 2024, E.O. 14024 (RUSSIA-EO14024)
Ukraine / UKNSDC 6 Jul 2025; FCDO 26 May 2026
ConfidenceCONFIRMED (all three designations, primary sources)
OFAC / UK / UA Designated Operational
Operators: UNATTRIBUTED
Critical intelligence gap
Named foundersNone in any public source
Beneficial ownersNot disclosed in OFAC, UK, or Ukraine listings
IndictmentsNo DOJ or other criminal charges located
Nationality / locationUnknown (assessed Russia or UAE)
CautionDo not conflate with Bukanov (TOEP / NetEx24, co-designated separate entity)
ConfidenceCONFIRMED gap (negative evidence across regimes)
Intelligence Gap No Designated Individuals
01

Executive Summary and Exchange Overview

Outgoing Flow to Sanctioned Targets
9.7%
Share of Bitpapa outgoing crypto to OFAC-sanctioned entities (Elliptic, Feb 2026)
Flow Specifically to Garantex
5%
Of total outgoing flow, to the sanctioned exchange Garantex (Elliptic)
Sanctions Regimes
3
OFAC (2024), Ukraine (2025), UK (2026), same UAE entity
OFAC Designation
25 Mar 2024
E.O. 14024; transactions with Hydra Market and Garantex
UK Designation
26 May 2026
FCDO 18-entity A7 / crypto package
Named Operators
0
No founder or owner publicly named or designated
Overall Assessment
Bitpapa is a UAE-registered, Russia-focused peer-to-peer crypto marketplace that combines a custodial exchange and wallet with a Telegram-driven P2P network and ruble-linked fiat rails. It was designated by OFAC on 25 March 2024 for facilitating millions of dollars in transactions with the sanctioned entities Hydra Market and Garantex, then added to Ukraine's NSDC sanctions list (6 July 2025) and the UK's Russia sanctions list (26 May 2026), making it one of the few crypto services under three separate national regimes. Elliptic's February 2026 analysis quantifies the core finding: approximately 9.7% of Bitpapa's outgoing crypto funds reach OFAC-sanctioned targets, including 5% to Garantex, and Bitpapa "manages its wallets specifically to evade sanctions enforcement by constantly rotating addresses." Despite three designations and two-plus years of continued operation, no founder, owner, or operator has been named by any authority, the profile's central intelligence gap. The service remains operational as of June 2026 (web, app, and Telegram). State nexus is assessed at TOLERATED SAFE HARBOR. Note a correction to the source draft: the Sberbank and Alfa-Bank ruble-rail linkage in the secondary literature attaches in the primary OFAC record to the co-designated entity NetEx24 (TOEP), not to Bitpapa.
Service typeCustodial peer-to-peer (P2P) cryptoasset marketplace with escrow, hosted wallet, and Telegram-coordinated trading; ruble-to-crypto on/off ramp
Legal entityBITPAPA IC FZC LLC Confirmed [OFAC SDN; UK FCDO]
Aliases / brandingBitpapa; marketed as a "worldwide peer-to-peer cryptocurrency exchange" and "cryptobank" with escrow protection
Entity registration jurisdictionUnited Arab Emirates: A-0059-652 Flamingo Villas, Ajman Media City Free Zone, Ajman (Reg. No. 5069); established 29 Apr 2022 Confirmed
Infrastructure hosting jurisdictionNot publicly mapped. Primary domains bitpapa.com, bitpapa.org. Customer base anchored in Russia Credible (Russia focus); Unknown (specific hosting)
Assessed operator locationUnknown. No named operators; an informed hypothesis places controllers in Russia or the UAE, but this is inference, not evidenced Analyst Inference
Operational periodEntity established Apr 2022; active through three designation cycles; operational as of June 2026
Volume (total)No total throughput figure published by any vendor. Elliptic reports concentration metrics, not totals: 9.7% of outgoing flow to OFAC-sanctioned targets, 5% to Garantex (Feb 2026). Do not present as total volume Confirmed (metric); Single Source (Elliptic)
Geographic footprintPrimarily targets users in Russia, allowing rubles to be exchanged for cryptoassets; nominal UAE registration; Russia/CIS-centric user base
OFAC designationEntity designated 25 Mar 2024, E.O. 14024, program RUSSIA-EO14024; secondary sanctions risk noted; SDN id 48096 Confirmed
Ukraine designationNSDC sanctions, presidential decree 6 Jul 2025 (package of ~60 legal entities) Confirmed
UK designationDesignated 26 May 2026, Russia (Sanctions) (EU Exit) Regulations 2019, category "supporting the Russian financial sector"; asset freeze Confirmed [UK FCDO]
EU designationNot individually listed as of June 2026; EU 21st sanctions package (proposed 9 Jun 2026) includes crypto-platform transaction bans, adoption pending Credible
State nexus tierTOLERATED SAFE HARBOR; no PROBABLE COOPERATION or DIRECT CONTROL evidence
StatusSanctioned (OFAC, Ukraine, UK); operational; no rebrand observed
Blockchain analytics coverageElliptic (entity-specific, Feb 2026); TRM Labs (designation analysis; April 2026 deposit-wallet heuristic); Chainalysis (March 2024 designation coverage)
02

Lineage and Organizational Heritage

No Predecessor Rebrand; Network Membership, Not Inheritance

Key Finding
Unlike clear lineage chains (BTC-e to WEX, or Garantex to Grinex), Bitpapa is not described in any open source as a rebrand or successor of a prior named exchange. It is best understood as an independent node within a network of Russia-linked services (Garantex, NetEx24, ABCeX, Rapira, Aifory Pro) that share function and counterparties rather than corporate parentage. Bitpapa is not described as inheriting customers, domains, or code from those entities. Credible [Elliptic, TRM, OFAC]

Evidentiary Pillars

PillarEvidenceConfidence
No corporate predecessor No source identifies a prior brand that Bitpapa rebranded from. The entity BITPAPA IC FZC LLC was established 29 Apr 2022 in the UAE with no documented predecessor registration. CONFIRMED
OFAC SDN (establishment date); negative evidence
Wallet-cluster continuity via rotation Elliptic reports Bitpapa "constantly rotating addresses" to defeat attribution. TRM (April 2026) released a new deposit-wallet heuristic for Bitpapa, indicating a stable underlying cluster despite address rotation, a continuity signal at the infrastructure (not brand) level. CONFIRMED
Elliptic; TRM
No shared codebase / white-label evidence No open report states Bitpapa runs a shared or white-labeled codebase with other Russian P2P services. Software-level lineage is unknown. UNKNOWN
Negative evidence; investigative gap

Operator Profiles

Mandatory Subsection: No Named Individuals (Schema Rule)
As of June 2026, no DOJ indictment, OFAC individual designation, UK listing, or Ukrainian decree names a Bitpapa founder, beneficial owner, or operator. The OFAC, Ukraine, and UK actions all target the corporate entity only. Nationality and current location of any controller are unknown. This is a critical intelligence gap and the reason this profile carries no operator hero module. Confirmed (negative evidence across three regimes) [OFAC, UK FCDO, Ukraine NSDC]
Attribution Caution (Do Not Conflate)
Secondary search results sometimes surface the name Timur Evgenyevich Bukanov in proximity to Bitpapa. Bukanov is the owner and director of TOEP (operator of NetEx24 / Netexchange) and of Bitfingroup OU (Estonia), both designated in the same 25 March 2024 OFAC action. He is not a Bitpapa operator. Likewise, the individuals named in the UK 26 May 2026 list (Igor Gorin, Irina Akopyan, Sergey Mendeleev, Liran Cohen) are grouped in the package but are not mapped by the FCDO to Bitpapa specifically; Mendeleev is the Garantex/ABCeX figure. No individual should be attributed to Bitpapa on current evidence. Confirmed [OFAC jy2204; UK FCDO list]

Disputed Assessments

Analyst Inference The only defensible operator-level inference is geographic: given Russia-focused operations and a UAE shell registration, controllers are plausibly located in Russia or the UAE. This is a hypothesis, not a finding, and is not supported by any named-individual evidence. [Analyst assessment]

03

Service Model and Business Operations

Exchange Mechanics and Product Set

Confirmed Bitpapa operates a custodial P2P marketplace with escrow. Per TRM, it functions "as a typical cryptocurrency exchange, which offers custody solutions and hosts its own peer-to-peer marketplace." Self-presentation (2022) describes escrow mechanics: Bitpapa "ensures that the transaction is completed by holding the purchaser's coins in an account until the transaction is complete," with 24/7 availability. Trades are frequently coordinated through Telegram bots. [TRM, Line A Geek, AML Network]

Credible Supported assets reported in 2026 reviews include Bitcoin, Ethereum, USDT, Monero, and TON, consistent with the USDT-centric Russia evasion ecosystem. Activity appears focused on spot P2P and custodial transfers; no leveraged-derivatives product is documented. [TradersUnion, Bitget review]

KYC/AML Posture: Stated Policy vs Observed Behavior

Stated Policy vs Observed Behavior (Schema Rule)
Stated policy: No preserved copy of Bitpapa's own KYC/AML statement appears in independent archives or secondary reporting. Marketing emphasizes ease of use, escrow protection, and global reach, not identity verification. The stated posture is effectively undocumented. Credible (intelligence gap on the stated side)

Observed behavior (sourced to vendor/government framing, not the exchange's claims): Elliptic reports Bitpapa "manages its wallets specifically to evade sanctions enforcement by constantly rotating addresses," designed to prevent monitoring systems from identifying Bitpapa as a counterparty and to hide the Russian origin of funds. OFAC designated the entity for transacting with Hydra Market and Garantex. TRM previously labeled it a high-risk exchange. The gap between an undocumented stated posture and observed obfuscation plus large flows to sanctioned counterparties is the primary analytical finding. Confirmed [Elliptic, OFAC, TRM]
No public law-enforcement charging document detailing specific Bitpapa KYC/AML failures (thresholds, Travel Rule non-compliance, monitoring gaps). The designations are administrative; their underlying evidentiary files are not public.

Fiat Rails (Schema Rule: Must Be Addressed)

Credible Bitpapa is a ruble-to-crypto on/off ramp: Elliptic notes it allows "rubles to be exchanged for a range of cryptoassets," which in the Russia/CIS context typically involves local bank-card transfers, cash deals, and domestic payment systems intermediated through its P2P book. [Elliptic]

Banking relationships: No specific bank or payment-processor relationship is documented for Bitpapa in primary sources. Single Source Correction to the source draft: the Sberbank and Alfa-Bank linkage attributed to Bitpapa in the AML Network write-up maps, in the primary OFAC record (jy2204), to NetEx24 (TOEP), which "enabled digital payments in rubles and virtual currencies to OFAC-designated entities such as Sberbank, Alfa-Bank, and Hydra Market." That ruble-rail tie should be assigned to NetEx24, not Bitpapa, absent independent Bitpapa-specific evidence. No documented de-risking or bank-termination events appear in open sources. This subsection is included per schema even though no named Bitpapa bank relationship is documented. Confirmed (the correction); [OFAC jy2204, AML Network]

Licensing and Regulatory Standing

Confirmed BITPAPA IC FZC LLC is an Ajman Media City Free Zone entity (Reg. 5069), established 29 Apr 2022. No UAE Virtual Asset Service Provider (VASP) license number or named regulator approval is cited in any source; the UAE registration reads as a free-zone shell for a Russia-centric operation rather than evidence of substantive licensed supervision. Inclusion on the OFAC SDN list, the Ukrainian NSDC list, and the UK Consolidated List indicates the platform holds no reputable Western-aligned licensing. [OFAC SDN, UK FCDO]

04

Technical Infrastructure and Platform Footprint

Domains and Brand Footprint

Confirmed The OFAC SDN entry lists two associated websites: bitpapa.com and bitpapa.org. Earlier promotional content referenced bitpapa.com/buy. AML-oriented profiles treat Bitpapa as a single brand; no large set of alternate domains or typosquat rebrands beyond .com/.org is evidenced. [OFAC SDN, Line A Geek]

Hosting providers, CDN, TLS-certificate history, and server locations for bitpapa.com/.org are not publicly reported. Passive-DNS and WHOIS mapping of the primary domains is an open investigative task.

Client Platforms, Apps, and Bots

Credible 2026 reviews describe access via iOS and Android apps, a Telegram bot, and a web interface under a single account. Non-technical explainers describe Bitpapa as a "program" or "app" available 24/7. No Google Play or App Store takedown is referenced in sanctions-related coverage. [TradersUnion, Bitget review, Line A Geek]

Credible AML Network reports that Bitpapa's anonymous trades are "often coordinated through Telegram bots," consistent with dedicated trade-coordination channels mirroring the web marketplace, a pattern common to Russian OTC/P2P networks. [AML Network]

Architecture Hints

Analyst Inference TRM's reference to a Bitpapa deposit-wallet heuristic implies a standard exchange model where individual deposit addresses forward into internal hot-wallet clusters. The constant address rotation Elliptic describes implies an internal wallet-management layer that separates user-facing deposit addresses from exchange hot wallets via intermediate hops. Whether Bitpapa runs its own blockchain nodes or uses third-party providers is not stated. [TRM, Elliptic]

Resilience After Disruption

Confirmed After the 2024 OFAC designation, Bitpapa continued operating; ForkLog and Elliptic describe it as sanctioned but active. No U.S. law-enforcement domain seizure or forced rebranding is reported. TRM's April 2026 deposit-wallet heuristic update confirms ongoing operation under the same brand. Resilience to date has focused on wallet-level stealth (address rotation) rather than overt brand change. [ForkLog, Elliptic, TRM]

05

Financial Intelligence and On-Chain Analysis

Overall Volume and Role

Volume Sourcing (Schema Rule: Cite Source and Methodology; Do Not Average)
Elliptic (Feb 2026): reports concentration metrics, not totals. Approximately 9.7% of Bitpapa's outgoing crypto funds are destined for OFAC-sanctioned targets, including 5% specifically to Garantex.
TRM Labs (May 2026): describes Bitpapa qualitatively as a high-risk P2P platform and does NOT publish a Bitpapa-specific bilateral dollar figure, even though it published such figures for co-designated peers (Huobi $4.9B, ABCeX $355M, Rapira $543M, Aifory $189M). The absence of a Bitpapa bilateral figure is itself a reporting gap, not a zero.
AML Network: "millions of dollars" in illicit transactions since 2022 (non-quantified, secondary).
No total throughput (licit plus illicit) figure exists in any reviewed source. These figures measure different things and are presented separately, not combined.

Phase 1: Receipt (Who Deposits and From Where)

Confirmed Inbound exposure includes darknet-market flows (Hydra Market), the sanctioned exchange Garantex, and ransomware-linked clusters, with Russia as the primary geography. OFAC: Bitpapa "conducted transactions worth millions of dollars with OFAC-designated Russian entities Hydra Market and Garantex." AML Network frames Bitpapa as "a critical conduit for laundering millions of dollars on behalf of notorious darknet markets and ransomware operators." Grounded in OFAC designation plus multiple vendor reports. [OFAC, AML Network, Elliptic]

Phase 2: Layering (Internal Mechanics, Obfuscation)

Confirmed Elliptic: Bitpapa is "constantly rotating addresses" to "prevent transaction monitoring systems from identifying Bitpapa as a counterparty and to hide the Russian origin of the funds from services that subsequently receive them." Combined with escrow flows between buyer and seller accounts and Telegram-coordinated P2P orders that separate fiat counterparties from crypto origin, this functions as an off-exchange layering mechanism. [Elliptic, AML Network]

Analyst Inference Single Source Cross-asset chain-hopping (between tokens or chains) is plausible given the USDT/BTC/ETH/TON/Monero support set but is not explicitly documented in the reviewed material. [Inference from supported-asset reporting]

Phase 3: Extraction (Where Funds Go)

Confirmed Outbound: Elliptic quantifies the dominant extraction signal, 9.7% of outgoing flow to OFAC-sanctioned targets and 5% to Garantex specifically. Credible Additional extraction via other Russia-linked exchanges and overseas OTC brokers for eventual fiat withdrawal is consistent with Elliptic's network framing but not separately quantified for Bitpapa. Domestic Russian banking cash-out is plausible but, per the Section 03 correction, the specific Sberbank/Alfa-Bank tie belongs to NetEx24, not Bitpapa. [Elliptic, OFAC]

Designated Addresses and Risk Status

Confirmed The OFAC SDN entry designates BITPAPA IC FZC LLC at the entity level under program RUSSIA-EO14024 with a secondary-sanctions-risk notation; the public Summary page does not enumerate specific designated crypto wallet addresses. TRM tracks Bitpapa as a distinct clustered entity (April 2026 deposit-wallet heuristic). The UAE registration jurisdiction is not on the FATF black or grey list; the relevant exposure is jurisdictional arbitrage, not host-country blacklisting. [OFAC SDN, TRM, FATF]

06

Client Profile and Criminal Use

Crimeware Verticals by Evidence Tier

VerticalEvidenceConfidence
Darknet markets (Hydra) OFAC: transactions worth millions with Hydra Market. AML Network: Bitpapa acts as an on/off ramp for Hydra. CONFIRMED
Sanctioned exchanges (Garantex) Elliptic: 5% of outbound flow to Garantex. OFAC: transactions with Garantex. CONFIRMED
Sanctions-evasion / state-aligned ruble flows OFAC, Ukraine, and UK all designate Bitpapa for facilitating Russia-linked sanctions evasion. CONFIRMED
Ransomware operators AML Network: laundering "millions" for ransomware operators aligned with Russian interests. No named ransomware family tied to Bitpapa as a specific cash-out venue in public reporting. CREDIBLE Single Source
Retail fraud / withdrawal complaints 2025 review video alleges withdrawal issues, delayed transactions, and "fake escrow" patterns, plus very low third-party trust scores. Anecdotal; not corroborated by formal LE action on retail fraud. CREDIBLE Single Source

Geographic Patterns

Confirmed Elliptic: Bitpapa "primarily targets users in Russia, allowing rubles to be exchanged for a range of cryptoassets." TRM: it offers "services to Russian nationals." The Russia/CIS core is clear; the UAE registration may facilitate some Middle East access, but no meaningful US/EU retail targeting is evidenced. [Elliptic, TRM]

High-Profile Flows

Confirmed (qualitative) Public materials cite "millions of dollars" with Hydra and Garantex but no case-by-case amounts tied to named criminal operations, and no DOJ indictment provides granular figures. This is a notable evidentiary gap relative to detailed BTC-e/WEX cases. The best-evidenced quantified signal remains Elliptic's 9.7%/5% outbound concentration. [OFAC, AML Network, Elliptic]

07

State Nexus Assessment

Jurisdictional Separation (Schema Rule: Three Jurisdictions)

Jurisdiction typeAssessmentConfidence
1. Entity registration United Arab Emirates: BITPAPA IC FZC LLC, Flamingo Villas, Ajman Media City Free Zone, Ajman (Reg. 5069), established 29 Apr 2022. CONFIRMED
2. Infrastructure hosting Not publicly mapped. Domains bitpapa.com/.org; hosting provider and server location unknown. Customer base anchored in Russia. UNKNOWN (specific hosting) / CREDIBLE (Russia-anchored users)
3. Assessed operator location Unknown. No named operators. Informed hypothesis: Russia or UAE. Explicitly stated as unresolved. UNKNOWN

State Nexus Tier: TOLERATED SAFE HARBOR

Assessment
Indicators for Tolerated Safe Harbor: Bitpapa openly serves Russian users and sanctioned Russian counterparties (Hydra, Garantex) yet faces no reported Russian domestic enforcement and continues operating after three foreign designations. The state is, at minimum, aware of and not acting against the service.

Why not Probable Cooperation: There is no evidence of state tasking, coordination, or active protection. No FSB, Rosfinmonitoring, or ministry link is documented; no procurement or defense-payment tasking is evidenced. Membership in the broader Russia-linked evasion ecosystem is network-level context, not direct tasking of Bitpapa.

Evidence against Direct Control: No open source identifies state ownership, named official involvement, or state shareholders.

Negative Evidence (What Would Be Expected if Higher Nexus Existed)

If Bitpapa were under PROBABLE COOPERATION or DIRECT CONTROL, one would expect documented state shareholding, named intelligence-officer involvement, procurement tasking, or explicit protection signaling. None of these are present. There is also no reported Russian government defense of Bitpapa, nor any domestic enforcement against it; the combination is most consistent with tolerated operation rather than active coordination. The assessment therefore stops at TOLERATED SAFE HARBOR. Analyst Inference

08

Law Enforcement and Regulatory Response

Sanctions

AuthorityActionStatus
OFAC (U.S.) Designated BITPAPA IC FZC LLC on 25 Mar 2024 under E.O. 14024 (program RUSSIA-EO14024, press release JY2204; 13 entities and 2 individuals), for operating in the financial services sector of the Russian Federation economy and transacting millions with Hydra Market and Garantex. Secondary-sanctions-risk notation; websites bitpapa.com, bitpapa.org. Entity-level only; no individuals designated. CONFIRMED (asset block in force)
Ukraine (NSDC) Designated by presidential decree on 6 Jul 2025 within a package of roughly 60 legal entities targeting crypto-enabled sanctions circumvention and financing of the Russian military-industrial complex. CONFIRMED
UK (FCDO / OFSI) Designated 26 May 2026 under the Russia (Sanctions) (EU Exit) Regulations 2019, category "entities and individuals involved in supporting the Russian financial sector," within an 18-designation A7/crypto package (incl. Huobi/HTX, Exmo, Rapira, Aifory, ABCeX/Nueva Cryptologia). Asset freeze; UK-regulated firms prohibited from making funds or economic resources available. CONFIRMED (asset freeze in force)
EU Not individually listed as of June 2026. EU 21st sanctions package (proposed 9 Jun 2026) includes transaction bans on Russia-linked crypto platforms; adoption and entity-specific scope pending. CREDIBLE (proposed, not adopted)
FinCEN No Section 311 action or Bitpapa-specific advisory in open sources; grouped within broader Russia-evasion advisories. CONFIRMED (negative evidence)
DOJ / criminal No public DOJ indictment or criminal complaint names Bitpapa or its operators as of June 2026. CONFIRMED (negative evidence)

Timeline

29 Apr 2022
BITPAPA IC FZC LLC established in Ajman Media City Free Zone, UAE. Confirmed [OFAC SDN]
25 Mar 2024
OFAC designates Bitpapa (with NetEx24/TOEP, Bukanov, and others) under E.O. 14024 for Russia-linked virtual-asset sanctions evasion. Confirmed [OFAC, Chainalysis, Elliptic]
6 Jul 2025
Ukraine (NSDC) sanctions Bitpapa within a ~60-entity crypto/sanctions-evasion decree. Confirmed [President of Ukraine]
21 Feb 2026 (upd. 3 Mar 2026)
Elliptic publishes Russia-linked sanctions-evasion analysis: 9.7% of Bitpapa outgoing flow to sanctioned targets, 5% to Garantex; constant address rotation. Confirmed [Elliptic]
Apr 2026
TRM releases a new deposit-wallet heuristic for Bitpapa, indicating continued activity sufficient to warrant improved attribution. Confirmed [TRM]
26 May 2026
UK FCDO designates Bitpapa and 17 other entities/individuals in the A7/crypto package; asset freeze in force. Confirmed [UK FCDO, TRM]

Post-Sanction Reconstitution Assessment (Schema Rule)

Reconstitution: No Rebrand, Brand-Level Continuity
Bitpapa shows continuity rather than reconstitution: there is no observed rebrand, successor brand, domain migration, or takedown banner. The same UAE entity has operated through three designation cycles (OFAC 2024, Ukraine 2025, UK 2026) under the same name and domains (bitpapa.com/.org), accessible via web, app, and Telegram as of June 2026. Adaptation is at the wallet layer (constant address rotation) rather than the brand layer. The relevant indicators to monitor are new deposit-wallet clusters (TRM is actively expanding coverage), any future domain or Telegram migration, and whether post-Garantex displaced flows route through Bitpapa as they have through ABCeX, Rapira, and Aifory. Confirmed (continuity); [Elliptic, TRM, ForkLog]
09

Connected Entities and Ecosystem Relationships

Two-Tier Model (Applied to Every Entry)
Tier 1, Transaction confidence: how confident that funds transited Bitpapa (CONFIRMED / CREDIBLE / ANALYST INFERENCE), backed by on-chain evidence where available.
Tier 2, Facilitation assessment: an analytical characterization of Bitpapa's role: Active facilitation, Structural enablement, or Incidental processing. The two tiers are independent and never collapsed.
EntityTier 1: Transaction confidenceTier 2: FacilitationVendor coverage
Hydra Market
Sanctioned darknet market (defunct since 2022)
CONFIRMED
OFAC: Bitpapa transacted millions with Hydra. AML Network: Bitpapa on/off ramp for Hydra.
Structural enablement
Deliberate KYC/AML deficiencies predictably enabled this at scale; no evidence of direct operator coordination.
Corroborating: OFAC, TRM, AML Network. None disagreeing.
Garantex
Sanctioned Russia-linked exchange (disrupted Mar 2025)
CONFIRMED
Elliptic: 5% of Bitpapa outgoing flow to Garantex (on-chain). OFAC: transactions with Garantex.
Structural enablement
Persistent, concentrated outbound exposure plus address rotation exceed incidental overlap; no evidence of joint operations.
Corroborating: Elliptic, OFAC, TRM. None disagreeing.
NetEx24 / TOEP
Co-designated Moscow fintech (OFAC 25 Mar 2024)
ANALYST INFERENCE
Co-designated in the same OFAC action; no public direct Bitpapa-to-NetEx24 on-chain flow figure. Relationship is ecosystemal, not evidenced as transactional.
Structural enablement
Parallel high-risk P2P/fintech behavior; no evidence of joint active facilitation. NetEx24 (not Bitpapa) carries the Sberbank/Alfa-Bank ruble-rail tie.
Corroborating (co-designation only): OFAC. No on-chain vendor link published.
Russian banks (Sberbank, Alfa-Bank)
Ruble fiat endpoints
ANALYST INFERENCE (re-attributed)
Primary OFAC record assigns the Sberbank/Alfa ruble-payment tie to NetEx24, not Bitpapa. The Bitpapa-specific bank linkage in AML Network is a likely conflation. Single Source for any Bitpapa-direct claim.
Incidental processing
From the banks' standpoint; no evidence of a knowing Bitpapa-bank arrangement.
Disagreeing/primary: OFAC jy2204 (ties banks to NetEx24). Secondary: AML Network (attributes to Bitpapa).
Ransomware operators
Unnamed Russia-aligned groups
CREDIBLE
AML Network: laundering "millions" for ransomware operators. No named family or on-chain case published. Single Source
Structural enablement
Weak controls predictably enable cash-out; no evidence of knowing per-actor coordination.
Corroborating: AML Network only. No on-chain vendor has published a named case. Single Source
ABCeX, Rapira, Aifory Pro, NetEx24 (ecosystem)
Russia-linked exchange network
ANALYST INFERENCE
Bitpapa is analyzed within the same Elliptic/UK network, but direct Bitpapa-to-peer bilateral figures are not published. Relationships are ecosystemal.
Structural enablement
Co-participant in the ruble-to-crypto evasion corridor; no evidence of coordinated operations with Bitpapa specifically.
Corroborating (network-level): Elliptic, TRM, UK FCDO. No direct bilateral figures published.
Huobi / HTX
UK-sanctioned global exchange (same package)
ANALYST INFERENCE
Co-designated 26 May 2026; TRM names Huobi as a persistent counterparty to the broader set, but no Bitpapa-specific Huobi bilateral is isolated.
Structural enablement
Large-exchange liquidity bridge for the network; Bitpapa-specific role unquantified.
Corroborating: TRM (network-level). Huobi/HTX publicly disputes that the sanctioned entity equals its operating brand.
10

Trajectory Assessment

Market Position and Volume Trends

Confirmed Bitpapa is a persistent node in Russia's P2P sanctions-evasion ecosystem, distinguished by an unusually high outbound concentration to sanctioned entities (9.7% overall, 5% to Garantex per Elliptic). It is one of the few services in the Elliptic/UK network sanctioned across multiple regimes. No total-volume trend line is published; the available signal is concentration, not throughput. [Elliptic, UK FCDO]

Disruption Impact

Structural Assessment
All three designations are administrative asset freezes and listings, not infrastructure seizures or operator arrests. Their bite is on foreign-nexus financial access and counterparty risk, not on Bitpapa's domestic Russian operations or its servers. The structural weakness this profile flags is twofold: (1) the operator layer is entirely unattributed, so there is no human-capital pressure point to target, and (2) resilience is achieved cheaply through wallet address rotation rather than costly brand migration. Degrading Bitpapa requires resolving operator attribution, mapping and blocking its rotating deposit-wallet clusters (TRM coverage is the lever here), and pressuring its fiat off-ramp and counterparty network, not additional single-jurisdiction listings alone.

Reconstitution Status

Brand: Operational, no rebrand. Same entity, name, and domains across three designation cycles; accessible via web, app, and Telegram as of June 2026. Confirmed

Wallet layer: Adaptive. Constant address rotation; TRM expanding deposit-wallet attribution (Apr 2026). Confirmed [Elliptic, TRM]

Future risk: Continuity over reconstitution. With no seizure and no named operators, the service can persist indefinitely under the same brand; a future forced rebrand would most likely follow a domain seizure or app-store removal, neither of which has occurred. Credible

Intelligence Gaps

Identities, nationalities, and locations of founders/operators: entirely unattributed across OFAC, Ukraine, and UK actions. Highest-priority gap.
Total trading volume (licit vs. illicit) and case-linked dollar amounts: no vendor publishes a Bitpapa total or a TRM-style bilateral figure.
Full wallet-cluster and designated-address lists: only Elliptic concentration metrics and TRM internal heuristics exist publicly; no OFAC-listed wallet addresses.
Hosting providers, CDN, and server locations for bitpapa.com/.org are not publicly mapped.
Confirmed bank, payment-processor, or P2P cash-agent fiat off-ramps for Bitpapa specifically (distinct from NetEx24's Sberbank/Alfa tie).
Stated KYC/AML policy text: no preserved copy of Bitpapa's own compliance statement located.
EU 21st-package adoption and whether Bitpapa is individually listed remains unresolved as of June 2026.

Recent Reporting

[26 May 2026] UK FCDO designates Bitpapa and 17 other entities/individuals (Huobi/HTX, Exmo, Rapira, Aifory, ABCeX/Nueva Cryptologia, Eurasian Savings Bank, A7 infrastructure) under the Russia (Sanctions) (EU Exit) Regulations 2019; TRM publishes accompanying analysis noting Bitpapa is now under a third national regime. [UK FCDO, TRM]

[Apr 2026] TRM releases a new deposit-wallet heuristic for Bitpapa, the sanctioned P2P marketplace, indicating ongoing activity and expanded attribution. [TRM]

[21 Feb 2026, updated 3 Mar 2026] Elliptic names Bitpapa in its Russia-linked sanctions-evasion report: 9.7% of outgoing flow to OFAC-sanctioned targets, 5% to Garantex, constant address rotation. [Elliptic]

[6 Jul 2025] Ukraine (NSDC) sanctions Bitpapa within a ~60-entity decree targeting crypto-enabled circumvention. [President of Ukraine]

[25 Mar 2024] OFAC designates Bitpapa (with NetEx24/TOEP and Bukanov) under E.O. 14024 for facilitating Russia-linked sanctions evasion involving Hydra Market and Garantex. [OFAC, Chainalysis, Elliptic]

Sources

  1. Elliptic: Russia-linked cryptocurrency services and sanctions evasion (Bitpapa: 9.7% outgoing to sanctioned, 5% to Garantex; address rotation) : 21 February 2026 (updated 3 March 2026)
  2. U.S. Treasury / OFAC: Treasury Designates Russian Companies Supporting Sanctions Evasion Through Virtual Asset Services and Technology Procurement (JY2204; Bitpapa, NetEx24/TOEP, Bukanov) : 25 March 2024
  3. OFAC Recent Actions: Russia-related and Cyber-related Designations (Bitpapa IC FZC LLC; SDN id 48096; RUSSIA-EO14024) : 25 March 2024
  4. UK Government: List of Russia sanctions designations, 26 May 2026 (BITPAPA IC FZC LLC, supporting the Russian financial sector)
  5. UK FCDO: UK cracks down on backdoor Russian sanctions evasion with tough new measures (18-designation A7/crypto package) : 26 May 2026
  6. TRM Labs: UK Designates Huobi, Exmo, Bitpapa, and 11 Other Entities for Russian Crypto Sanctions Evasion (Bitpapa under three regimes: OFAC 2024, Ukraine 2025, UK 2026) : 26 May 2026
  7. TRM Labs: US Treasury's OFAC sanctions Russia-based crypto exchanges and fintechs (Bitpapa custody + P2P; high-risk label) : March 2024
  8. TRM Labs: Blockchain Intelligence Releases, April 2026 (new deposit-wallet heuristic for Bitpapa)
  9. Chainalysis: OFAC Sanctions Netex24 and Bitpapa, Plus Other Russian Crypto Companies : March 2024
  10. President of Ukraine: NSDC sanctions decree (package including Bitpapa) : 6 July 2025
  11. AML Network: Bitpapa watchdog profile (weak AML/KYC; Telegram-coordinated trades; Hydra on/off ramp; note: Sberbank/Alfa attribution disputed, see OFAC jy2204)
  12. ForkLog: US Imposes Sanctions on Atomyze and Bitpapa Platforms : March 2024
  13. Virtual Routes: Cryptocurrency exchanges Bitpapa, TOEP, and Crypto Explore sanctioned (financial-services-sector designation language)
  14. OFAC Sanctions List Search: BITPAPA IC FZC LLC (entity detail; established 29 Apr 2022; Ajman Media City Free Zone; websites bitpapa.com, bitpapa.org)
  15. Traders Union: Bitpapa Review (April 2026) (continued operation; web/app/Telegram access; supported assets)
  16. Line A Geek: An In-Depth Guide to Bitpapa and Cryptocurrency (escrow self-presentation; 24/7) : 2022

Profile produced using open-source intelligence. Confidence labels applied per schema: CONFIRMED (multiple independent sources), CREDIBLE (single strong source or multiple weaker sources), ANALYST INFERENCE (logical extrapolation from confirmed facts). Volume figures cited with source and methodology; figures from different vendors and authorities are presented separately, not averaged. Two-tier connected entity model applied throughout Section 09 (Tier 1 transaction confidence plus Tier 2 facilitation assessment). Three jurisdictions documented separately per schema (registration UAE; hosting unknown; operator location unknown). Key correction vs. source draft: the Sberbank/Alfa-Bank ruble-rail tie belongs in the primary OFAC record to NetEx24 (TOEP), not Bitpapa. Status: Sanctioned (OFAC 25 Mar 2024; Ukraine 6 Jul 2025; UK 26 May 2026); operational; assessed state nexus TOLERATED SAFE HARBOR.