I still remember the first time I saw a friend lose money to a crypto investment promise that looked airtight on paper. The numbers added up, the website looked polished, and the returns sounded just realistic enough. That was years ago. Today the same patterns keep showing up, only the scale has grown and the tools have gotten sharper. The latest move from Russia’s central bank drives that point home in a way that is hard to ignore.
What The Latest Blacklist Move Really Means
In the first half of 2026 the Bank of Russia placed roughly 2,600 cryptocurrency wallets onto a shared information system that banks and law-enforcement agencies already use for risk checks and investigations. More than one billion rubles in crypto equivalent had already moved into those addresses. The wallets belonged to companies, projects, individual entrepreneurs and other entities that showed clear signs of illegal financial activity.
That single figure sits inside a broader picture. During the same six months the regulator flagged 2,891 entities overall with indicators of illegal financial activity. The number dropped nearly 31 percent compared with the first half of 2025, yet it stayed close to the level recorded in the second half of last year. Progress, yes, but far from a clean sweep.
Banks and law-enforcement bodies now treat the new wallet list as a practical tool. They can run client transactions against it, tighten risk assessments and open financial investigations more quickly. The central bank also passes the same information to other authorized bodies, including competition authorities. The system is not merely a public warning list; it functions as an operational filter inside the daily compliance work of financial institutions.
How The Numbers Stack Up Against Previous Periods
Last year the same regulator identified more than 4,600 crypto wallets used by organizers of pyramid schemes simply to receive the first investment payments. In 2025 crypto was accepted by 84 percent of the pyramid projects that were spotted, up from 77 percent the year before. The 2026 figure of 2,600 wallets therefore marks a clear reduction in absolute terms, yet the underlying preference for crypto remains stubbornly high.
More than 74 percent of the pyramid schemes identified in the first half of 2026 still used cryptocurrencies to attract funds. The rest leaned on foreign payment services or cash. Organizers ran more than 940 websites, 120 Telegram channels and over 2,500 social-media pages to pull people in. Those channels change names and domains faster than most people can keep track, which is exactly why the shared monitoring system matters.
I’ve found that the real story often hides in the secondary numbers. Banks took restrictive measures against more than 500 payment details linked to illegal activity. Regulatory action produced over 330 administrative cases, some of them based on material collected in earlier periods. Authorities also applied more than 450 other enforcement measures and blocked access to over 11,800 online resources belonging to suspected illegal market participants and pyramid schemes. That is a lot of digital real estate taken offline.
Pyramid Schemes And Pseudo-Investment Projects Still Dominate
The regulator counted 929 entities that displayed signs of financial pyramid activity and another 379 that appeared to be illegally attracting investments. Taken together, the number of pyramid and other pseudo-investment projects fell 44 percent compared with the same period in 2025. Most of them operated entirely online, without physical offices, and reached potential clients through social networks, messaging services or cold calls.
What did these projects actually offer? Many promised exposure to cryptocurrencies or income from crypto mining. Some claimed to fund data centers that supposedly supplied computing power to miners. Others sold digital tokens said to track gold prices. The sales pitches sounded sophisticated, yet the underlying model stayed the same: early participants are paid with money from later ones until the flow stops.
Crypto remains a preferred payment method because recovering funds sent to a wallet is far harder than reversing a traditional bank transfer.
That practical advantage for scammers is exactly why the blacklist approach focuses on the wallets themselves. Once an address is flagged, any future transaction linked to it becomes a red flag inside the banking system. It does not freeze the blockchain, of course, but it raises the cost and the risk for anyone trying to cash out inside the regulated financial system.
Illegal Lending Takes A Sharp Turn Upward
While pyramid schemes declined, illegal lending moved in the opposite direction. The number of identified illegal lenders doubled, reaching 999 compared with 467 a year earlier. Part of the rise appears linked to tighter requirements for legal lenders. When formal credit becomes harder for people carrying high debt loads, informal channels fill the gap.
Among the products pushed outside the formal system were so-called crypto loans. Borrowers were offered funds denominated in a major stablecoin or in rubles converted at a fixed exchange rate. The regulator continues to receive hundreds of complaints about this model. Websites associated with the schemes are blocked, only to reappear under new domains within days or weeks. The cat-and-mouse game continues.
In my view the growth of illegal lending deserves as much attention as the drop in pyramid numbers. A person who turns to an unlicensed lender often does so under pressure. Once the funds arrive, the repayment terms can become punitive very quickly. The fact that some of these loans are denominated in crypto only adds another layer of volatility and recovery difficulty.
How The Broader Regulatory Framework Is Taking Shape
Russia has spent recent years trying to pull more cryptocurrency activity into licensed channels while keeping domestic payments restricted. A law approved this summer set out rules for exchanges, brokers, custodians and other intermediaries. The central bank is responsible for supervising the market. Regulated activity and certain cross-border uses are permitted; using cryptocurrency as an everyday domestic payment method remains banned.
Ahead of the new framework the regulator published draft operating rules for cryptocurrency exchanges and digital-asset depositories. Those drafts include capital requirements and the creation of official registers for licensed participants. The regulated market is scheduled to begin its broader rollout in September. The timing makes the current blacklist exercise especially relevant. It signals that enforcement will not wait for every licensing detail to be finalized.
Enforcement has already reached physical premises. Earlier this month more than twenty people were detained after authorities raided nine crypto exchanges in Moscow. Investigators alleged that the services converted proceeds from scams into cryptocurrency before moving the assets onward. The raids underline a simple point: once money leaves the formal banking system, tracking it becomes harder, so authorities are focusing on the conversion points.
A Separate Wave Of Ticket Fraud Shows The Same Pattern
While the central bank was publishing its half-year figures, a different set of scams targeted people looking for concert tickets. Analysts found at least ten websites registered since mid-August that used names connected with a well-known artist. The domains mixed .ru, .com, .site and .shop endings. Some pages let visitors select seats before requesting payment in cryptocurrency. Prices ranged from modest upper-level seats to expensive VIP boxes.
Other pages asked for transfers to a phone number and listed ticket prices from tens of thousands of rubles up to several million. Several sites advertised concerts in the wrong city. A few simply redirected users to illegal online casinos. At least seven related messaging bots were identified; only one remained active when checked, offering a mini-app that collected contact details and then requested a phone-number transfer.
The common thread is the payment method. When the only options are crypto or a direct phone transfer and no conventional payment channels appear, recovery becomes difficult. That is the same logic that makes crypto attractive to the larger pyramid schemes. The ticket cases simply show how quickly the technique migrates from long-term investment fraud to short-term event scams.
Why Crypto Keeps Showing Up In These Schemes
Perhaps the most interesting aspect is the persistence of the preference. Even as overall numbers of flagged entities decline, the share of schemes that rely on crypto stays high. Speed, perceived anonymity and the difficulty of reversing transactions all play a role. Once funds sit in a wallet controlled by the organizers, the next steps can include mixing services, cross-border transfers or conversion through informal exchangers.
Regulators cannot rewrite the properties of the underlying technology. What they can do is raise the friction at the points where crypto meets the traditional financial system. Blacklisting wallets is one of those friction points. Restricting payment details, blocking websites and opening administrative cases are others. None of these measures eliminates the activity, but together they raise the operational cost for the people running the schemes.
I have watched similar patterns in other markets. When one payment channel becomes more expensive or riskier, organizers simply shift to the next least-controlled option. The fact that crypto remains popular even after years of warnings tells us that the remaining friction is still not high enough for a large share of operators.
Practical Signals That Something May Be Off
Looking at the cases described by the regulator, a few practical warning signs appear repeatedly. They are not new, yet people continue to overlook them under the pressure of promised returns or limited formal options.
- The project operates entirely online with no verifiable physical presence or licensed status.
- Payments are accepted only in crypto or via phone-number transfers with no conventional banking options.
- Returns are presented as steady and relatively high regardless of market conditions.
- The marketing relies heavily on messaging apps and social pages that can be deleted or renamed overnight.
- Documents or contracts, when they exist, use vague language about custody and withdrawal rights.
None of these points proves fraud on its own. Taken together they raise the probability that the arrangement sits outside the regulated perimeter. The blacklist system exists precisely because many of these projects leave digital footprints that can later be matched against known wallet addresses.
What The Drop In Overall Numbers Actually Suggests
A 31 percent decline in flagged entities and a 44 percent drop in pyramid and pseudo-investment projects look encouraging at first glance. Yet the absolute numbers remain large. Nearly three thousand entities still showed signs of illegal activity in a single six-month window. The reduction may reflect better detection and deterrence, or it may simply mean that some operators have become more careful about leaving obvious traces.
The sharp rise in illegal lending points in a different direction. When formal credit tightens, demand does not disappear. It migrates. Crypto-denominated loans are one expression of that migration. The regulator’s continued receipt of complaints suggests that the supply of such products is still meeting real demand, even as websites are taken down.
In practical terms the mixed trends mean that enforcement resources cannot focus on a single category. Pyramid schemes, illegal lending, fake ticket sales and conversion services all require attention at the same time. The shared information system that now includes the 2,600 wallets is an attempt to make that multi-front effort more efficient.
Looking Ahead To The Regulated Market Rollout
September is supposed to mark a clearer start for the licensed crypto market under the new rules. Capital requirements, official registers and supervision by the central bank will create a formal perimeter. Inside that perimeter activity should become more transparent and easier to monitor. Outside it, the existing toolkit of blacklists, website blocks and administrative cases will continue to apply.
The question is whether the formal market will absorb enough legitimate activity to shrink the informal space, or whether the two will simply coexist. Early signals from other jurisdictions suggest that coexistence is the more common outcome, at least for a period of years. Operators who prefer the higher margins and lower scrutiny of the unregulated side often stay there until the cost of staying becomes prohibitive.
The current blacklist of 2,600 wallets can be read as a statement of intent. The regulator is prepared to keep updating the shared system and to keep feeding information to banks and law-enforcement bodies. Whether that pressure eventually changes the economics of running these schemes is something only the next set of half-year figures will show.
A Few Personal Observations On The Human Side
Behind every wallet address sits a person who decided the promised return looked better than the available alternatives. Sometimes that decision is made under financial stress. Sometimes it is driven by optimism about new technology. Sometimes it is simply the result of repeated exposure to polished marketing. The technology itself is neutral; the human incentives are not.
I keep coming back to the friend I mentioned at the start. The project that took the money looked professional. The people promoting it spoke confidently. The blockchain explorer showed real transactions. None of those surface features prevented the eventual collapse. The same surface features appear in many of the cases the central bank is now tracking.
That is why the combination of public warnings, shared blacklists and concrete enforcement actions remains necessary. Pure information campaigns rarely change behavior on their own. Raising the operational cost for organizers and making it harder to cash out inside the formal system at least shifts the risk calculation.
Putting The Pieces Together
The 2,600 wallets, the one billion rubles that already moved into them, the continued high share of crypto use among pyramid schemes, the doubling of illegal lenders and the parallel ticket scams all form a single picture. Crypto is still a preferred tool for a significant part of illegal financial activity in the market the regulator is watching. The tools available to push back—blacklists, website blocks, administrative cases, physical raids—are being used, and the overall numbers of flagged entities are moving downward. At the same time new pressure points, especially in lending, are appearing.
The coming months will test whether the formal market rules that take fuller effect in September can change the balance. Until then the shared monitoring system that now contains those 2,600 addresses will keep serving as one of the practical filters banks and investigators apply every day. For anyone following the space, the half-year report is less a final verdict than a progress note in an ongoing contest between adaptation on one side and enforcement on the other.
The pattern is familiar, yet the details keep shifting. Staying aware of the latest figures and the practical warning signs remains one of the few defenses that ordinary participants actually control. The rest of the work sits with the institutions that now have a longer list of wallets to watch.
