On-chain Analysis in Times of Sanctions: Analyzing the Accusations Against Crystal and Its Partners
In the summer of 2024, a post titled “Crystal Blockchain and Chainalysis assist Russians in avoiding crypto sanctions” appeared on Medium. Its author claimed to be an employee of Crystal, a company providing tools for blockchain analysis and AML (Anti-Money Laundering) compliance.
According to the author, Crystal and its partner firms — AMLBot, Getblock and Alfabit — continue to work with Russian clients and the market. He said the company “neither the moral nor the legal right to serve an aggressor state and its clients, by helping identify risky wallets and circumventing blocks on major exchanges that legitimately use our software”.
“We simply can no longer hide the fact that Crystal continues to actively work with clients from russia, both directly and indirectly. The most striking case for us is the exchange from the scandal-ridden moscow city towers, Garantex”, the post on Medium stated. [Here and throughout, the author’s spelling and punctuation are preserved — editor’s note, Incrypted].
As a reminder, the US Treasury Department’s Office of Foreign Assets Control (OFAC) imposed sanctions on the exchange, that was mentioned above, in April 2022. According to an official statement, an analysis of known Garantex transactions showed that over $100 million worth of transactions were related to illicit actors and darknet markets. Nearly $6 million of those transactions came from the Russian group Conti, as well as approximately $2.6 million — from the liquidated darknet marketplace Hydra.
Moreover, in March 2024, it was reported that the US and UK authorities began investigating over $20 billion in crypto transactions through Garantex as part of a probe into sanctions evasion. According to journalists, all these transactions occurred after sanctions were imposed on the exchange.
“The issue lies in the fact that our software is covertly, and often with our knowledge, used throughout the moscow City Tower and numerous proxy companies across russia, kyrgyzstan, and belarus. Some of these entities are already on sanction lists, like Garantex and Bitpapa, while others are not yet listed but inevitably will be (such as ABCex, Bitriver, Coyote, and many others)”, the post on Medium said.
In response to an inquiry from Incrypted, Crystal’s COO Marina Khaustova stated that the claim regarding the company’s cooperation with Garantex is “completely untrue and offensive”:
“At the request of law enforcement or governmental bodies we may track their activity for investigative purposes only to aid enforcement against the OFAC sanctioned exchange. In no way do we provide services to Garantex or other sanctioned entities”.
According to the author of the Medium post, Crystal historically does not work with small clients and uses partners like Alfabit, Getblock, and AMLBot for distribution and retail sales.
The author specifically highlighted the latter. According to his claims, Crystal sells them “a significant volume of checks and assist with support”. However, AMLBot “is openly used by us to circumvent sanctions and service a good portion of russian crypto exchanges on Bestchange”, the author claims.
Among the services he mentioned were IME, Karma, Kupi bit, Laslobit, Master Change, Perfect change, Swap Coin, Tyt Cash, and X-obmen.
The Incrypted editorial team checked these claims. For example, the Kupibit website indeed has the AMLBot logo in the “Partners” section. The tech support team confirmed the use of the solution for transaction checks.
On the Laslobit site, there is no mention of using tools from AMLBot. Incrypted team representatives contacted their tech support to clarify whether we can really expect that the AMLBot solution is used to verify transactions. The service did not confirm this and said that they recommend using GetBlock solution for such purposes.
No evidence of AMLBot use was found on the websites of Perfect change, Tyt Cash, or X-obmen either.
According to the Swap Coin site, among the operations, withdrawal to Russian cards is available. Tech support confirmed that it uses AMLBot solutions.
We couldn’t find any services with the same name as the ones mentioned in the Medium material — IME and Karma.
Master Change, which is mentioned in the post on Medium, was created in Ukraine, is focused on Ukrainian users and does not work with Russian cards and clients.
“We do not have a single direction of exchange related to the RF,” — assured the representatives of Incrypted in the company.
In addition, the author cites the example of the company AlfaBit, which works with cards of Russian banks. The article talks about the use of Crystal and AMLBot systems when selling AML services to companies from the Russian Federation and attaches a screenshot from the AlfaBit website, in which the logos of the latter are displayed in the cooperation section.
At the time of writing, the AlfaBit website no longer displays AMLBot or Crystal logos.
Similarly, the exchange service Rapira, which operates in Russia and is cited in the Medium article, has no logos or mentions of using Crystal, AMLBot, or Chainalysis services.
The Quickchange exchange, mentioned in the story, at the time of writing lists Crystal as a service used to determine the risk level of transactions.
Reactions from story participants
We contacted AMLBot representatives for comments. The company stated that they ceased cooperation with Russian businesses after the outbreak of the full-scale war. They noted that most of the AMLBot team is based in Ukraine.
“Crypto companies sometimes use our logo without authorization. When we identify such cases, we respond by asking them to remove it from their websites,” AMLBot added.
When asked whether the company contacted the mentioned platforms to have them remove the AMLBot logo from their websites, the representatives confirmed that they had.
UPD: CEO of AMLBot Slava Demchuk in his statement for Incrypted said that the “allegations against us are not only outdated, but seem to be part of a deliberate attempt by an unknown party to damage our reputation, based on recycled evidence from clients prior to the war to pursue ulterior motives”.
“AMLBot has been deeply committed to supporting and standing by Ukraine and law enforcement around the globe such as in Asia, Europe, India, contributing education, tools and resources. We have relentlessly directed our efforts to help our team in Ukraine, investing significant support and resources to help them through the ongoing crisis”, he said.
In addition, AMLBot confirmed cooperation with Crystal. According to the team, the latter is one of the providers whose solutions the company uses in its own analytics. The AMLBot also believes that the article published on Medium is “most likely commissioned”.
In Crystal, the accusations described in the Medium post were also called baseless, emphasizing that the company does not serve Russian users and does not assist Russians in evading sanctions. Crystal’s CEO Navin Gupta, in a statement to Incrypted, pointed out that such claims “aim to undermine our significant contributions to Ukraine”:
“We have tirelessly invested our time, expertise, and resources to empower the Ukrainian government and authorities with blockchain tools, data, and expertise in their struggle against Russia. Our work is creating a tangible impact, and these false stories are being spread in an attempt to damage our reputation and the positive influence we are making”.
It’s worth noting that Crystal actively cooperates with Ukrainian and European law enforcement agencies, providing data in many investigations, as well as training its employees to combat financial crimes.
Gupta emphasized that the company strictly follows the policy of verifying all potential clients through “KYC and due diligence before being admitted to the results of our data analysis”. He noted that Crystal’s partners are also required to undergo these same verification and conduct checks for their users.
“Despite these wrongful attacks, which intend to damage our and our peers’ reputations, we remain committed to ethical practices and unwaveringly dedicated to supporting Ukraine and our global clients. Crystal stands strong against these allegations and continues to focus on meaningful, ethical work”.
It’s also worth mentioning that the Medium post references the well-known analytics firm Chainalysis.
“As far as I know, Chainalysis also maintains a strict policy regarding russians, albeit partially adhered to, and there’s no issue obtaining their software by registering a proxy-ru business in kyrgyzstan or kazakhstan”, claims the author of the post on Medium.
Crystal, referring to an internal investigation, states that this person is not an employee of the company, and the post was written “with the intention of causing harm to our business.”
Incrypted’s editorial team contacted the author. When asked to provide any evidence that he actually works or has worked at Crystal, we received the following response [the author’s spelling and punctuation are preserved — editor’s note, Incrypted]:
“What were they supposed to say? Yes, he’s our guy, and we violate sanctions? Yes, we support AMLbot so we can work with Russia through them? That’s funny. I crafted the material in such a way that they won’t figure out who’s writing it… In my opinion, everything is clearly and thoroughly described. Half of the Russian market sits directly in Getblock or AMLbot (both are old clients of ours who sell our data to Russian companies and don’t hide it). The other half buys our services through intermediary companies”.
