Ukraine’s cyberpolice extradited crypto criminal from FBI’s international wanted list to the US

• Ukraine’s cyber police found a member of a hacker group that attacked companies around the world.
• The attackers distributed malware and demanded ransom in crypto assets.
• The defendant in the case of UAH 3 billion in losses was handed over to the FBI.

The Cyberpolice Department of the National Police of Ukraine announced the detention in Kyiv of a 33-year-old foreigner wanted by the US Federal Bureau of Investigation (FBI) for large-scale cyber attacks.

According to the law enforcement agency, the detainee was one of the key members of an international hacker group that caused more than UAH 3 billion ($71.7 million at the time of writing) in losses to industrial enterprises in the US, Canada, France, Germany, the Netherlands and Norway.

The hackers used self-created malware, including ransomware, to gain access to the computer systems of global companies, encrypt their data, and then demanded a ransom in cryptocurrencies. The payments were made to drop wallets controlled by the criminals.

The international operation, launched in November 2023 with the participation of law enforcement officers from Ukraine, the US, the EU, Europol, and Eurojust, involved more than 80 searches in Ukraine. During the investigation, the following were seized:

• Crypto assets worth over UAH 24 million (almost $576,000 at the time of writing);
• Nine luxury cars;
• 24 land plots with a total area of almost 12 hectares.

All the property was seized to ensure compensation for the damage caused.

As a result of the analysis of the obtained data, the investigation identified another group member. This cybersecurity specialist was searching for vulnerabilities in the networks of the victim companies. Other hackers used his data to plan attacks. The FBI put the man on an international wanted list, charging him under several articles of the US Code.

The foreign national, who was living in Kyiv at the time of his arrest, was arrested by the Solomianskyi District Court of Kyiv for extradition.

Upon completion of the checks, he was handed over to the US side on 18 June 2025.

As a reminder, the cyber police conducts active operations to expose crypto fraud. In particular, a Ukrainian man suspected of hacking and illegal mining was recently detained in Zaporizhzhia.

Later, in Sumy, cyber police detained a resident of Kyiv region in a case of a fake crypto exchange.