{
  "id": "case-potekhin-crypto-exchange-phishing",
  "slug": "us-v-potekhin-crypto-exchange-phishing",
  "title": "U.S. v. Danil Potekhin & Dmitrii Karasavidi (Exchange Phishing)",
  "summary": "Southern District of New York criminal indictment and OFAC sanctions targeting Russian operators of a sophisticated mass phishing campaign that spoofed web domains of major cryptocurrency exchanges (Poloniex, Binance, Bittrex) to steal credentials and 2FA tokens, looting $16.8 million in digital assets.",
  "case_number": "1:20-cr-00669",
  "court": "U.S. District Court for the Southern District of New York",
  "district": "S.D.N.Y.",
  "country": "United States",
  "opened_at": "2020-09-15",
  "status": "fugitive",
  "victim_sector": "Cryptocurrency & Digital Asset Exchanges",
  "victim_country": "United States",
  "loss_amount_usd": 16800000,
  "loss_amount_note": "Direct theft of $16.8 million in Bitcoin, Ethereum, and digital assets from individual exchange accounts.",
  "first_seen_at": "2017-06-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "evil-corp",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1566.002",
      "evidence_excerpt": "Created look-alike web domains resembling legitimate cryptocurrency exchanges to trick users into entering account credentials and two-factor authentication codes.",
      "evidence_locator": "Indictment \u00b6 11, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Potekhin and Karasavidi",
      "source_url": "https://www.justice.gov",
      "technique_name": "Spearphishing Link",
      "tactic": "Initial Access"
    },
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Used harvested authentication tokens and session credentials in real time to execute unauthorized withdrawals to adversary-controlled digital wallets.",
      "evidence_locator": "Indictment \u00b6 19, Page 8",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Potekhin and Karasavidi",
      "source_url": "https://www.justice.gov",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2017-06-01",
      "description": "Phishing network registers deceptive exchange domains across global registrars."
    },
    {
      "event_type": "indictment",
      "event_date": "2020-09-15",
      "description": "S.D.N.Y. unseals indictment charging Potekhin and Karasavidi with computer fraud and money laundering."
    },
    {
      "event_type": "sanctions",
      "event_date": "2020-09-16",
      "description": "OFAC designates both conspirators and sanctions associated cryptocurrency cluster addresses."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Adversary gained initial access via Spearphishing Link: Created look-alike web domains resembling legitimate cryptocurrency exchanges to trick users into entering account credentials and two-factor authentication codes.",
    "blast_radius": "Resulted in $16,800,000 in documented financial liabilities. Direct theft of $16.8 million in Bitcoin, Ethereum, and digital assets from individual exchange accounts.",
    "kill_chain": [
      {
        "phase": "Phase 1: Initial Access",
        "title": "Initial Perimeter Infiltration",
        "description": "Created look-alike web domains resembling legitimate cryptocurrency exchanges to trick users into entering account credentials and two-factor authentication codes.",
        "technical_artifacts": [
          "T1566.002",
          "Spearphishing Link"
        ],
        "mitre_technique_id": "T1566.002"
      },
      {
        "phase": "Phase 2: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Used harvested authentication tokens and session credentials in real time to execute unauthorized withdrawals to adversary-controlled digital wallets.",
        "technical_artifacts": [
          "T1078",
          "Valid Accounts"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Cryptocurrency & Digital Asset Exchanges infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Southern District of New York criminal indictment and OFAC sanctions targeting Russian operators of a sophisticated mass phishing campaign that spoofed web domains of major cryptocurrency exchanges (Poloniex, Binance, Bittrex) to steal credentials and 2FA tokens, looting $16.8 million in digital assets.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}