Crystal & Ukraine: before and after the invasion

Key Takeaways

• Crystal’s partnership with Ukraine’s Cyber Police predates the invasion by nine months – built on operational trust, not just technology.

• When Russia invaded Ukraine, Crystal deployed real-time sanctions screening and tracked $225M in crypto donations amid rampant fraud.

• Crystal’s public-private partnership with Ukraine’s Cyber Police helped close 300+ crypto fraud cases from 2022 through blockchain analytics and attribution.

• Crystal turned a pro-Ukrainian insider’s Conti ransomware leak three days after the invasion into groundbreaking blockchain intelligence.

• Crystal expanded its Ukraine partnership to counter narcotics in 2023, earning a National Police award for tracing illicit crypto flows in 2024.

Crystal Intelligence’s deep connection to Ukraine began long before Russia’s February 2022 invasion. In fact, Crystal had formalized a partnership with the Ukrainian Cyber Police in May 2021 – over nine months before the first Russian jackboot stomped on Ukrainian soil. By the time the invasion came, Crystal already had roots in the region and boots on the ground, not just through some of its employees who called Ukraine home, but also through its analytics team, which had been actively embedded in the country’s investigative framework.

These weren’t remote relationships maintained over video calls. They were real, operational ties built through data analysis, training, and a common conviction that blockchain intelligence could – and should -serve the pursuit of justice.

Crystal’s response to the Russian invasion: sanctions screening & $225M in crypto donations tracked

When Russia invaded Ukraine on February 24, 2022, Crystal updated its platform to reflect the latest international sanctions on Russian individuals, businesses, and politically exposed persons (PEPs). Major economies – including the US, EU, UK, Canada, and others – added financially influential Russian entities to their sanctions lists. Crystal’s platform provided real-time global sanctions and PEP screening, with its team actively monitoring regulatory changes and collaborating with Ukrainian authorities to flag sanctioned wallet addresses.

Meanwhile, crypto became a lifeline for donating funds to Ukraine, both for military and humanitarian aid, as the chaos of war (branch closures, infrastructure, and local financial instability) severely hampered traditional banking methods. Sadly, crypto funds quickly became the target of fraud.

Crystal’s analytics team sprang into action to track and trace donations to Ukraine, publishing its first report on March 4, 2022, and updating it five times by July 20, 2023, by which time $225M in crypto donations had been made.

Some key insights at that time of writing included:

• Ukraine’s crypto donation drive is likely the largest in modern history, with $225 million received as of July 20, 2023 – a testament to crypto’s growing role in humanitarian and wartime finance. What began as an improvised response to a banking system under pressure quickly evolved into a sophisticated fundraising infrastructure that set a new benchmark for digital asset philanthropy.

• Donations more than tripled in 2022, rising from $53M in March to over $178M by September, reflecting the extraordinary global outpouring of support that followed Russia’s full-scale invasion. The pace of giving in those early months illustrated how crypto could mobilize international solidarity faster than traditional financial channels.

• The split between military and humanitarian aid shifted significantly over time – humanitarian donations rose from 40% in February 2023 to 60%, while army-directed donations fell from 60% to 40%. This shift may reflect donor fatigue with direct military contributions, growing awareness of civilian suffering, or the stabilization of funding for Ukraine’s armed forces through official government channels.

• USDT was the top donation currency at 37%, followed by ETH at 35% and BTC at 18% – a breakdown that speaks to the increasing dominance of stablecoins in practical crypto transactions, particularly where donors prioritize value certainty over speculative assets.

Tracking crypto donations & closing 300+ fraud investigations with Ukraine’s cyber police

Crystal’s collaboration with the cyber department of the National Police of Ukraine stands as a testament to the power of public-private partnerships. In January 2023, Crystal reported that it had assisted its partner in closing 50% (300+ of 600) of crypto-related fraud cases opened in 2022.

Crystal’s team provided comprehensive data analysis and investigations to present reports to the Ukrainian Cyber Police as follows:

• Identifying and tracking illicit activities like ransomware payments and showing attribution.

• linking pseudonymous blockchain transactions to real-world organizations, including exchanges and mixer services, and revealing the real-world names of those entities in a user-friendly format.

• providing evidence for the legal pursuit of charges and LEA action.

According to Yuriy Vykhodets, Head of the Cyber Police of Ukraine, these “results were achieved thanks to the combination of digital forensics with classical investigation methods,” and that “Crystal Blockchain has provided cyber police with tools to monitor crypto wallets, control money, and track transactions.”

Crystal’s crypto fraud investigations expose the Conti ransomware group’s cybercrimes after leak

Crystal’s investigation team did not stop there. On February 27, 2022 – three days after the invasion – a pro-Ukrainian insider within the Conti ransomware gang leaked 12 months of internal communications after the organized crime group publicly declared its support for Russia.

The invasion had created the volatile conditions that led to the leak. Crystal turned the leak into actionable intelligence, spending weeks analyzing data flows and publishing findings the industry had not yet seen: Crystal’s intelligence confirmed links between Conti and Ryuk ransomware, connections to the $97M Liquid exchange hack, previously unreported victims, and Hydra marketplace connections.

Crystal published the reports as the Conti Leaks Part One and Two.

In Part One, Crystal exposed the inner workings of a modern criminal network:

• Conti, an extortion group active since 2020, had 12+ months of internal communications leaked by a pro-Ukrainian insider in February 2022.

• Crystal identified financial links between Conti, Ryuk, and the 2021 Liquid exchange hack.

• Previously unreported Conti victims and ransom payments were uncovered in the chat logs.

In Part Two, Crystal built upon and deepened its analysis, including previously unseen chat logs from 2020 and 2021:

• Conti planned to attack 20-30 companies daily, threatening to destroy non-compliant businesses, while deliberately avoiding targets in the Commonwealth of Independent States (CIS) regions.

• Strong anti-US sentiment drove targeting: of 89 identified victims, 76 were US-based, and only 13 were from other regions.

• The largest ransom demand logged was 3,000 BTC, and the largest single payment received was 725 BTC.

• High-profile targets included Pfizer, with original chat logs and English translations included in Crystal’s findings.

• Most Conti attacks went unreported, with affected businesses choosing not to notify law enforcement.

How Crystal’s partnership with Ukraine’s cyber police Is cleaning up narcotics trafficking

As the invasion continued, so did Crystal’s support for Ukraine. In 2023, Crystal formalized a new collaboration with the Counter Narcotics Department. Training on tracing financial flows via crypto in illegal drug dealing has been rolled out across all regions of Ukraine, with each region now having its own virtual asset specialist.

In July 2024,the National Police of Ukraine formally honored Crystal’s investigations team with an award for its work in tracking and analyzing the movement of illicit funds associated with illegal narcotics manufacturing and dealing.

As well as the training, Crystal’s teams offered:

• The identification and tracking of illicit activities, such as ransomware payments, and attributing them to specific entities.

• The linking of pseudonymous blockchain transactions to real-world organizations, including exchanges and mixer services, and presenting this information in a clear, user-friendly format.

• The provision of solid evidence to support legal proceedings and law enforcement actions.

Crystal’s support for Ukraine’s Cyber Police runs deeper than war

“The Ukraine chapter isn’t closed. The work continues. But what these years proved is that blockchain intelligence built on real relationships – not just technology – holds when it matters most.”

Crystal’s history of supporting Ukraine may have been strengthened in the fires of Russia’s invasion, but it was not forged by them. The deepening bond Crystal has enjoyed with Ukrainian law enforcement agencies since 2021 was never just a client relationship – it was an extension of what Crystal is, and what it believes blockchain intelligence is for.

Long before the world’s attention turned to Kyiv, Crystal was embedding itself in Ukraine’s investigative infrastructure, training analysts, and building the kind of trust that holds under pressure. That foundation didn’t crack when the invasion came. It demonstrated exactly why it was built.