On June 9, 2025, the United States (US) Department of Justice (DOJ) unsealed an indictment charging New York resident Iurii Gugnin, also known as Iurii Mashukov and George Goognin, for allegedly operating a crypto-enabled money laundering network that funneled over USD 530 million from Russia into the US.
At the center of the case is Evita Investments, a cryptocurrency payments company also known as Evita Pay, which prosecutors say was used to facilitate transactions for sanctioned Russian banks, technology firms, and other restricted counterparties. In 2024, sanctioned entities drove the largest share of illicit crypto volume with inflows of USD 14.8 billion, as highlighted in TRM Labs’ 2025 Crypto Crime Report.
The indictment sheds light on how digital assets can be woven into sophisticated cross-border payments pipelines — bypassing traditional controls and complicating sanctions enforcement.
A cross-border crypto network for sanctioned entities
According to court documents, Gugnin operated Evita Pay from 2019 through at least 2024. The company, which marketed itself as a global crypto payments provider, allegedly offered a “covert channel” to move money from Russia to the US.
The DOJ alleges that Evita processed payments for entities that included:
- Russian banks and financial institutions sanctioned following Russia’s 2022 invasion of Ukraine
- Russian technology companies that had been placed on export control lists
- Individuals and firms involved in restricted cross-border trade
Rather than using traditional financial institutions, Evita Pay allegedly settled transactions via digital assets — converting rubles into cryptocurrency, transferring value across borders, and liquidating funds in fiat within the US financial system.
How the scheme worked
The DOJ indictment outlines a layered payments architecture designed to obscure both the source and purpose of funds. Prosecutors allege that Gugnin and his co-conspirators facilitated cross-border payments using cryptocurrency and stablecoins, enabling Russian clients to move value out of sanctioned jurisdictions without engaging traditional financial institutions.
To avoid detection, they allegedly structured transactions to evade US banking controls and used front companies to conceal connections to Russian entities. At the same time, Evita Pay actively promoted itself as a tool for sanctions-resistant commerce — with internal communications describing the platform as a way to “avoid sanctions via stablecoins.” Marketing materials further advertised its utility in helping Russian nationals move funds abroad.
In addition, Gugnin is accused of making false statements to US banks about the nature of Evita’s business and the origin of the funds it handled. These actions, according to the DOJ, formed part of a broader effort to deceive financial institutions and circumvent anti-money laundering (AML) safeguards.
Why this matters
This case illustrates how bad actors may use crypto to exploit gaps between jurisdictions — moving funds across borders without involving regulated financial intermediaries. Several themes stand out:
Crypto is being used to facilitate sanctions evasion at scale
The DOJ estimates that Evita Pay processed over USD 530 million in transactions. This volume suggests a high degree of operational sophistication and access to infrastructure that could support repeat, high-value flows between Russia and the US.
Stablecoins are playing an increasing role in cross-border laundering
The DOJ complaint references the use of stablecoins as part of the laundering mechanism, underscoring their growing role in cross-border financial activity. Stablecoins are often favored in illicit finance typologies for their liquidity, dollar parity, and usability in jurisdictions with limited fiat access.
Crypto doesn’t erase compliance obligations
Evita Pay marketed itself as a crypto-native solution. But according to the DOJ, it also operated in fiat rails and misrepresented its activity to traditional financial institutions. The indictment serves as a reminder: crypto companies that interact with banks must uphold the same Know Your Customer (KYC), AML, and sanctions compliance standards as traditional finance organizations.
Russia’s mounting sanctions since Ukraine invasion
Following Russia’s invasion of Ukraine in February 2022, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned a number of Russian cryptocurrency services and individuals allegedly involved in illicit finance and money laundering. These designations have included virtual asset service providers (VASPs) such as Garantex (sanctioned on April 5, 2022) and peer-to-peer exchanges like Bitpapa, as well as actors linked to broader laundering networks, such as Ekaterina Zhdanova and the TGR Group.
The European Union (EU)’s 16th sanctions package included crypto exchange Garantex, citing its role in facilitating over USD five billion in illicit transactions linked to Russian actors. Additionally, the US, often in coordination with international partners such as the EU and the United Kingdom, has targeted Russian hybrid threat networks and supply chains — particularly those supporting military and energy operations.
This underscores the growing role of crypto channels in circumventing traditional financial restrictions. These developments reflect a clear trend: regulators are treating digital assets not as a gray zone, but as an integral part of the global sanctions landscape.
A warning signal for compliance teams
The indictment against Gugnin reflects growing US scrutiny of crypto’s role in sanctions evasion and export control violations. It also highlights a key challenge for financial institutions — distinguishing between legitimate crypto payments activity and cross-border flows designed to evade oversight.
As regulators sharpen their focus on stablecoins and crypto-based payment firms, VASPs and banks alike must:
- Conduct enhanced due diligence on counterparties operating in or near sanctioned jurisdictions
- Monitor for unusual patterns in crypto-to-fiat conversion behavior
- Screen for entities that may be acting as unlicensed money transmitters or front companies
Blockchain intelligence — combined with traditional financial risk indicators — remains essential to identifying these threat actors early and disrupting their operations.
{{horizontal-line}}
FAQs: Crypto payments, sanctions evasion, and the Evita Pay case
Who is at the center of the DOJ’s indictment?
The DOJ has charged Iurii Gugnin, a New York resident, for allegedly operating a crypto-enabled money laundering network that moved over USD 530 million from Russia into the US.
What role did Evita Investments play in the alleged scheme?
Evita Pay, described as a cryptocurrency payments company, allegedly served as a covert payments channel for sanctioned Russian banks, technology companies, and restricted counterparties. The firm is accused of converting rubles into cryptocurrency, transferring value across borders, and liquidating funds into fiat currency within the US financial system.
How did the laundering network allegedly bypass sanctions?
According to the DOJ, Gugnin and his co-conspirators used digital assets and stablecoins to obscure the origin of funds. The scheme involved structuring transactions to avoid US banking controls, using front companies, misrepresenting the business to banks, and actively marketing Evita Pay as a sanctions-resistant solution.
Why are stablecoins specifically highlighted in this case?
The indictment underscores the role of stablecoins in cross-border laundering due to their liquidity, dollar parity, and usability in jurisdictions with limited access to fiat. Their characteristics make them attractive for entities seeking to circumvent sanctions and banking restrictions.
What are the broader compliance implications of this case?
The indictment serves as a warning that crypto firms operating across fiat and digital rails are still subject to KYC, AML, and sanctions compliance obligations. Financial institutions are advised to strengthen due diligence, monitor crypto-to-fiat behavior, and identify front companies or unlicensed money transmitters.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
