Nexo crypto lender investigated for alleged large-scale financial fraud - chronology (update)

The Prosecutor’s office and the police on January 12, 2023, raided the offices of a crypto lender that operates from the territory of Bulgaria.

Operation against crypto company Nexo in Sofia

Today’s raid comes after tracking millions of transactions. Investigators say they have evidence that EU, UK and US sanctions against Russia were circumvented through NEXO. Both companies and individuals on the banned list have been funded. The investigation is also into alleged money laundering, illegal banking activity, tax crimes and even suspicions of terrorist financing.

According to unofficial information, the investigation has identified 100 transfers of cryptocurrency to the terrorist group Hamas. Through the partner services, it was identified that there were contacts between the Bulgarian NEXO and Mahmoud Mohamed, one of the people through whom Hamas is hiding its cryptocurrency assets.

NEXO was incorporated in 2018, but a conflict quickly arose between the founders and two of them left a year later. There are even lawsuits in UK courts between the former partners.

NEXO came into the focus of the US authorities in the autumn of 2022, when the New York Attorney General Letitia James tweeted that she was suing the crypto platform. A year earlier, Letitia James had banned the company from operating on the territory of the whole state, and in the autumn of 2022, according to James, NEXO continued to offer services by misleading clients that they were a registered platform. Days later, the California Department of Financial Protection and Innovation, along with regulators in eight other states, brought actions against Nexo group.

An investigation was then launched into more than $800 million in customer fraud. They found that the company was run from Sofia and the investigation was done jointly with Bulgaria’s State Agency for National Security (SANS) and the Bulgarian Prosecutor's office. For months, investigators documented millions of transactions.

"We have identified over 3,600,000 transactions to and from the NEXO crypto exchange. Some of them are with extremely risky players," said Svetoslav Vassilev, head of the National Investigation Service's cybercrime unit.

"We can clarify, and this is already clear in the pre-trial proceedings, that over the past 5 years more than 94 billion dollars have passed as turnover through the platform. It has also been established and evidence has been collected that a client of the platform, a person who transferred cryptocurrencies, has been officially declared a person who finances terrorist acts," said the spokeswoman for Bulgaria’s Prosecutor General, Siyka Mileva.

Over 15 addresses searched in connection with operation against cryptocurrency firm

Bulgarian authorities and foreign agents have begun searching the company's offices in the country.

"The crypto lender operates through multiple registered trading companies, most of which are mailboxes, i.e. shell companies. Over 300 colleagues are currently working in this large-scale raid, no such thing has been done before. These are 35 investigators from the National Security Service, SANS officers, gendarmerie officers, officers of the Ministry of Interior, Siyka Mileva explained.

More than 15 addresses have been searched, most of them connected to the founders and people who have run NEXO since it was set up. Among them are former Reformist Bloc MP Antoni Trenchev, who is known to be out of the country, together with his partner Kosta Kantchev, who is an executive chairman of Nexo. At the moment there is no information on the whereabouts of the company's CFO Kalin Metodiev. Georgi Shulev, who used to be representative of NEXO, but whose employment was terminated in September 2019, was interviewed as a witness today. He is the son of former Deputy Prime Minister Lidia Shuleva.

Shulev's office told BNT that he left the company in 2019, a year after it was incorporated, and has since sued the co-founders in a UK court. Sokol Yankov also had a stake in the company. According to information BNT has, he is travelling to Bulgaria to appear as a witness. The company that Yankov currently runs said that he left NEXO also in 2019 and has since had nothing to do with the group of companies under investigation.

The company's position

NEXO today posted a short message on Twitter saying that the approach was "kick first, ask questions later", adding that in corrupt countries this is bordering racketeering. The company later sent a position paper specifically to public service broadcaster BNT.

They note that the raid was ongoing and their employees were being detained. They have not yet been presented with official documents that clearly state the claims. They say that the raid was unnecessarily ostentatious and that the investigating officers refused to identify themselves and did not show a search warrant for hours.

Nexo's position to the BNT on the Prosecutor's office raid

NEXO says videos of violence against company employees will be shown shortly. They claim that people have been detained without being named in the warrants. According to them, everything that has happened so far is in stark violation of established legal and procedural norms.

They also point out that they do not operate on the Bulgarian market in order not to fall under the "fire of the absurd". They claim to be among the crypto companies with the highest standards in terms of "know-your-customer" and anti-money laundering measures.

Beyond the standard means of any financial institution, NEXO also used the services of companies like Chainalysis, which were used by the FBI and CIA among others. This allowed their specialists, who had undergone a special qualification training in anti-money laundering in the US, to be sure of the origin of the crypto assets entering the platform, as well as to know where those withdrawn from the platform were going.