Worked example · 2015-01

Coin.mx unlicensed Bitcoin exchange prosecution — Bitcoin — 2015-07 (arrests)

Loss

$0 direct on-chain loss to exchange customers (law-enforcement action against operators, not a hack). Prosecutors said Coin.mx processed over $10 million in illegal Bitcoin transactions, operated October 2013 to July 2015 [bm17]. At arrest, reporting said at least $1.8 million had been exchanged for bitcoin for tens of thousands of customers between October 2013 and January 2015 [cd15].

Recovery

not applicable; forfeiture and restitution were still to be set at a September hearing as of mid-2017 [bm17].

OAK Techniques observed

OAK-T6.007 (Trust-Substrate Shift / Vendor-Promise Revocation — regulatory-action variant. The Coin.mx criminal prosecution established that Bitcoin exchanges operating in the United States without state money-transmitter licenses and federal FinCEN registration face federal criminal liability. The trust substrate shifted from "Bitcoin exchanges can operate without traditional financial licensing" to "Bitcoin exchanges are money transmitters subject to federal criminal prosecution." One of the US federal criminal cases applying the money-transmitter statute to a Bitcoin exchange). OAK-T15.005 (Regulatory Enforcement Action — the criminal prosecution of Coin.mx operators was a federal law-enforcement action targeting the exchange's unlicensed-operation surface). OAK-T7.002 (CEX Off-Ramp Laundering — Coin.mx was allegedly used to process ransomware payments and other illicit proceeds; the case established the structural connection between unlicensed exchanges and money-laundering facilitation that would recur at BTC-e (2017) and subsequent exchange-enforcement actions).

Attribution

confirmed via US federal prosecution in the Southern District of New York. Anthony Murgio and Yuri Lebedev were arrested by the FBI in July 2015 [bm17][cd15]. Murgio pleaded guilty to three counts (reported plea date 9 January 2017) and received 66 months (5.5 years) in prison; prosecutors had sought 10 to 12 years [bm17][hns17]. Prosecutors described the exchange as owned by Gery Shalon, accused of orchestrating a large hacking scheme including JPMorgan Chase [fort16][bm17].

Key teaching point

Coin.mx is an early US federal prosecution applying unlicensed-money-transmitter and money-laundering charges to a Bitcoin exchange that knowingly sold bitcoin to ransomware victims and criminal proceeds. Operating an exchange without state licensing or FinCEN registration, and without filing suspicious activity reports, carries criminal exposure irrespective of how the asset is classified.

Corrected 2026-10-11

the date is the July 2015 arrests (not a 2015-01-26 indictment unsealing); Murgio pleaded guilty rather than being convicted at trial; the "first-ever" claim, the Preet Bharara and Secret Service details, and the claim that a defendant was connected to the JPMorgan breach (the exchange's alleged owner, Gery Shalon, was) were corrected or removed.