Full Report
Nine people have been arrested - eight Ukrainians and one Belarusian - who operated from currency exchange offices.
Analysis Summary
# Threat Actor: Unnamed Money Laundering Network (Ukrainian-led, Poland-based)
## Attribution & Identity
- **Name/Alias:** None reported. Polish authorities did not name the group or assign an alias.
- **Nationality:** Eight Ukrainian nationals and one Belarusian national were detained. The suspected ringleader is a 34-year-old Ukrainian national who made key decisions and oversaw domestic and international fund flows.
- **Composition:** Nine suspects (four women, five men, aged 26 to 53), including four female cashiers, three men running the exchange offices, and two couriers.
- **Investigating bodies:** Łódź Regional Prosecutor's Office (lead), Internal Security Agency (ABW), Border Guard (Straż Graniczna), and the Central Bureau for Combating Cybercrime (CBZC, referenced in the official social media post).
- **Associated groups:** None identified in the article.
- **Note:** This is a financial crime network, not a cyber threat actor in the traditional sense. No intrusion activity, malware, or hacking is described. The "threat" is the laundering of proceeds from online fraud.
## Activity Summary
- Laundered an estimated 337 million zloty (about €77 million) between February 2025 and July 2026.
- Used currency exchange offices to process money from internet scams, including investment fraud and cryptocurrency-related fraud, per the Polish government's post.
- Operated across Warsaw, Lublin, Wrocław, Katowice, and Gdańsk, with arrests in Łódź, Warsaw, and Małopolska province.
- Seized gold and cash worth over 1 million zloty.
- All nine suspects face charges of participation in an organised criminal group and money laundering, with up to 15 years in prison possible.
- Seven are in pre-trial detention for three months (two months for one suspect). Two were released on bail with travel restrictions.
## Tactics, Techniques & Procedures
- **Currency exchange abuse:** Funneled illicit funds through exchange offices, bypassing anti-money laundering (AML) procedures.
- **Courier-based cash movement:** Used couriers to physically transport money.
- **Cross-border cash transport:** Moved proceeds abroad by car.
- **Layering through financial channels:** Transferred funds to bank accounts and cryptocurrency exchanges.
- **Trade-based obfuscation:** Concealed proceeds in fictitious gold purchases.
- **Crypto conversion:** Converted most proceeds into cryptocurrency.
- **Structured hierarchy:** Used a central ringleader directing domestic and international channelling, with specialized roles (cashiers, operators, couriers).
- **MITRE ATT&CK IDs:** None are referenced in the article, and the activity is not a cyber intrusion. Analysts may map related behaviors to ATT&CK Financial/Impact or Exfiltration techniques, but such mappings are the analyst's own inference, not reported facts.
## Targeting
- **Sectors:** Currency exchange, banking, cryptocurrency exchanges, precious metals (gold), and the broader financial services sector. Victims of the underlying internet scams are not described in detail.
- **Geography:**
- Poland (operations and arrests in multiple cities and regions)
- International channels (funds sent abroad, details not specified)
- Source of fraud proceeds: not specified in the article
- **Victims:** No specific organizations are named. Victims of the underlying internet investment and cryptocurrency scams are implied but not identified.
## Tools & Infrastructure
- **Malware families:** None reported.
- **C2 infrastructure:** None reported.
- **Domains/IPs:** None reported.
- **Financial infrastructure:**
- Currency exchange offices (used as the entry point for laundering)
- Bank accounts (used for layering)
- Cryptocurrency exchanges (used for conversion and investment)
- Gold purchases (used for value storage and concealment)
- Physical cash and couriers
## Implications
- **Scale:** A roughly €77 million laundering operation over about 18 months indicates significant organizational capacity and sustained access to fraud proceeds.
- **Interdiction:** The case shows that currency exchange offices remain a weak point in AML controls, particularly where cash is converted into crypto or gold.
- **Regional pattern:** Ukrainian-led laundering networks operating from exchange offices in EU states is a recurring threat that may extend to other EU jurisdictions.
- **Fraud ecosystem link:** Money laundering enables investment and crypto scams to scale. Disrupting laundering nodes may reduce the profitability of scam operations, though the article does not indicate whether the scam operators themselves were identified.
- **Ongoing risk:** Dismantling one network does not remove the demand for laundering services, and successor groups are likely.
## Mitigations
- **Currency exchange operators:**
- Apply enhanced customer due diligence for large or repeated cash exchanges.
- Monitor for structuring (splitting transactions below reporting thresholds).
- Flag exchanges linked to cryptocurrency purchases or gold-related transactions.
- **Banks:**
- Monitor for rapid inflow-outflow patterns and transfers to crypto exchanges following cash deposits.
- Scrutinize accounts receiving funds from multiple unrelated individuals (possible mule accounts).
- **Cryptocurrency exchanges:**
- Strengthen travel rule compliance and source-of-funds checks for large deposits, especially cash-linked deposits.
- Monitor for wallets receiving proceeds from known scam typologies.
- **Precious metals dealers:**
- Verify source of funds for large cash gold purchases and watch for purchases inconsistent with customer profiles.
- **Law enforcement and regulators:**
- Continue cross-agency information sharing (prosecutors, ABW, Border Guard, CBZC) and cross-border cooperation with Ukrainian and Belarusian authorities and EU partners.
- Target the fraud-to-laundering pipeline, including the scam operations that generate the proceeds.
- **Public awareness:**
- Warn potential investors about investment and cryptocurrency scam indicators to reduce the supply of victim funds.