U.S. v. Danil Potekhin & Dmitrii Karasavidi (Exchange Phishing)
Key Facts
- Legal Status: FUGITIVE in U.S. District Court for the Southern District of New York.
- Primary Target Sector: Cryptocurrency & Digital Asset Exchanges.
- Documented Financial Loss: $16.8 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Southern District of New York criminal indictment and OFAC sanctions targeting Russian operators of a sophisticated mass phishing campaign that spoofed web domains of major cryptocurrency exchanges (Poloniex, Binance, Bittrex) to steal credentials and 2FA tokens, looting $16.8 million in digital assets.
Root Cause & Infiltration Vector
Adversary gained initial access via Spearphishing Link: Created look-alike web domains resembling legitimate cryptocurrency exchanges to trick users into entering account credentials and two-factor authentication codes.
Operational Impact & Financial Blast Radius
Resulted in $16,800,000 in documented financial liabilities. Direct theft of $16.8 million in Bitcoin, Ethereum, and digital assets from individual exchange accounts.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Created look-alike web domains resembling legitimate cryptocurrency exchanges to trick users into entering account credentials and two-factor authentication codes.
Used harvested authentication tokens and session credentials in real time to execute unauthorized withdrawals to adversary-controlled digital wallets.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Cryptocurrency & Digital Asset Exchanges infrastructure.
Southern District of New York criminal indictment and OFAC sanctions targeting Russian operators of a sophisticated mass phishing campaign that spoofed web domains of major cryptocurrency exchanges (Poloniex, Binance, Bittrex) to steal credentials and 2FA tokens, looting $16.8 million in digital assets.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Phishing network registers deceptive exchange domains across global registrars.
S.D.N.Y. unseals indictment charging Potekhin and Karasavidi with computer fraud and money laundering.
OFAC designates both conspirators and sanctions associated cryptocurrency cluster addresses.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1566.002 | Spearphishing Link Initial Access | "Created look-alike web domains resembling legitimate cryptocurrency exchanges to trick users into entering account credentials and two-factor authentication codes." | Indictment ¶ 11, Page 4 | reviewed |
| T1078 | Valid Accounts Defense Evasion | "Used harvested authentication tokens and session credentials in real time to execute unauthorized withdrawals to adversary-controlled digital wallets." | Indictment ¶ 19, Page 8 | reviewed |