Worked example · 2011-20

BTC-e exchange account farming and sybil infrastructure — 2011–2017

Loss

Infrastructure case, not a per-victim loss. BTC-e was a cryptocurrency exchange operating from 2011 to 2017 that functioned as a primary laundering rail for ransomware operators, darknet marketplaces, and cybercriminal groups. The exchange was estimated to have processed over $4B in cumulative transaction volume, much of it illicit. The U.S. DOJ indicted BTC-e and its operator Alexander Vinnik in 2017.

OAK Techniques observed

OAK-T8.004 (Exchange Account Farming / Sybil Accounts) — canonical anchor. BTC-e operated with minimal KYC/AML compliance, enabling criminal actors to maintain multiple exchange accounts under fabricated or stolen identities — the exchange as account-farming infrastructure. OAK-T7.002 (CEX Deposit-Address Layering) — BTC-e deposit addresses were the primary destination for illicit proceeds from ransomware, darknet markets, and cybercrime.

Attribution

confirmed — Alexander Vinnik (BTC-e operator) was arrested (2017, Greece), extradited to France (2020), convicted (2020, France), and subsequently extradited to the United States (2022). Vinnik pleaded guilty to money-laundering conspiracy charges in U.S. federal court (2024).

Key teaching point

BTC-e is the canonical T8.004 anchor: an exchange that did not enforce meaningful identity verification served as a de facto account-farming platform for the entire cybercriminal ecosystem. The absence of KYC/AML controls at the exchange level enabled an unlimited number of exchange accounts under fabricated identities — the exchange itself was the sybil infrastructure.