Operation Destabilise was an international investigation led by the National Crime Agency (NCA) which, over the course of three years, uncovered a money laundering ring with ties to criminal organisations in the UK, drug cartels in South America, the Kinahan Organised Crime Group, Russian espionage efforts and sanction avoidance.
Between 2021 and late 2024, the National Crime Agency, alongside law enforcement agencies in Ireland, France, Finland, Spain, the Netherlands, the US and the United Arab Emirates, investigated the ring. Initially, the Russian ransomware group Ryuk was linked to Ekaterina Zhdanova, head of the Smart cryptocurrency exchange in Moscow. Soon after, TGR Group, also based in Moscow and headed by George Rossi, was discovered. Smart and TGR were linked to various ransomware groups, though the investigation into them was initially focused on global money laundering until the first evidence of cash handovers in the UK were discovered in November 2021. The discovery of these cash handovers then led to the discovery of courier networks operating across the UK and the Channel Islands, which collected dirty money from various criminal groups within the UK to be laundered through various means in the UK and Europe before being turned into cryptocurrency. A portion of this cryptocurrency would then be transferred to Zhdanova and/or TGR Group, which would either be banked, transferred to Russia or to individuals dodging sanctions. The networks provided by Smart and TGR Group were, between late-2022 and mid-2023, also used by the Russian government to fund espionage operations.
The results of the investigation up to that point were released on 4 December 2024, revealing that 84 people had been arrested in connection with the ring, 71 of which were arrested in the UK. Six individuals, both major money laundering networks and several companies were sanctioned, while a seventh linked individual was arrested for the facilitation of money laundering. In total, £20 million had been seized out of an estimated £700 million in drugs sales.
The operation continued, with the NCA reporting on 21 November 2025 that the network was at that time known to be operating in at least 28 towns and cities across the UK, that they had arrested a further 44 people in connection with the networks and seized over £5.1 million in cash over the almost 12 months prior. Over the entire period of the operation up to 21 November 2025, the NCA had assisted international partners in seizing $24 million and over €2.6 million from the network.
Investigation The operation initially evolved from a National Crime Agency (NCA) investigation into the Russian ransomware group Ryuk. The group conducts ransomware across the world, including in the US and the UK. As of December 2024, Ryuk was believed to have raised at least £27 million from 149 organisations based in the UK. During the investigation, the NCA discovered that payments made to Ryuk were being sent towards Ekaterina Zhdanova, a Russian national and head of Smart, a cryptocurrency exchange based in Federation Tower, Moscow. Around the same time frame, the NCA uncovered TGR Group, also a cryptocurrency exchange based in Federation Tower. The NCA quickly linked the networks to global money laundering efforts and further ransomware groups like Conti and Trickbot. Up until that point, the investigation was focused on major money laundering abroad, though the NCA soon began intercepting the first cash handovers relating to the group in the UK.
The NCA didn't receive their first major breakthrough in relation to cash handovers until the arrest of Fawad Saiedi, who was stopped by Metropolitan Police in November 2021 while driving southbound on the M1 toward London. A search of the vehicle found that he was transporting over £250,000 in cash. A search of his home discovered a further £24,500 and a currency-counting machine. Upon further investigation into Saiedi, police found that he was a courier under a network that operated around the UK and the Channel Islands; said network was found to have participated in 55 cash handovers over a four-month period, operating on behalf of 22 criminal groups in the UK. In his role as a courier, it is known that he had transferred criminal property worth £15,667,720. He pleaded guilty to possessing and transferring criminal property on 3 May 2022 and was sentenced to 52 months imprisonment. Saiedi was found to have performed his role under the direction of Ekaterina and Nikita Krasnov, a coordinator for Russian-speaking couriers under Smart. Krasnov then further connected to other courier networks.
A month prior to Saiedi's arrest, Muhiddin Umurzokov, Anvarjon Eshonkulov and Batsukh Bataa were arrested in Jersey after they attempted to launder approximately £60,000 on the island. Evidence seized in searches of mobile phones, documents, receipts and lists revealed that they had been housing illegal immigrants in sub-let properties using money from drug trafficking and prostitution. It was revealed that Umurzokov, Eshonkulov and Bataa all had large sums of money moving in and out of their bank accounts, primarily through a company called ISM Scaffolding Limited, which had approximately £4.31 million moving through its account over a ten-month period in 2021/22. The group plead guilty to a combined total of 22 charges relating to money laundering and admitting to work for a UK based organised crime group and were sentenced a combined total of 10 years imprisonment.
Smart and TGR networks
Ekaterina Zhdanova was the head of Smart. It is believed that she was raised in Siberia before moving to Moscow and working in the finance industry. By July 2016, she had opened several hotels and leisure businesses in Moscow. Zhdanova worked closely with Khadzi-Murat Magomedov and Nikita Krasnov to facilitate money laundering, with many of the transactions being brokered by Zhdanova and Magomedov. Krasnov would then work with couriers in the UK to arrange for money to be collected and converted.
George Rossi is a Russian-born Ukrainian national who was the head of the TGR Group, which has an office in Oxford Circus, London, and in Dubai, United Arab Emirates (UAE). Evidence suggests that Rossi may have been a banker in Russia who moved to Europe temporarily before starting his network. He primarily worked alongside two individuals: Elena Chirkinyan, a joint-Russian and Armenian national who was reportedly his second in command. Chirkinyan stated that she had studied in both Moscow and Caterham School, a private school in Surrey, then at a university in London, where she studied business and economics; and Andrejs Bradens, a Latvian national. Rossi was also the founder of TGR Partners, non-executive director of TGR Corporate Concierge LTD and linked to several other companies.
According to the NCA, both networks had a "heavy exposure" to Garantex, a Russian cryptocurrency exchange which has been sanctioned by the Office of Foreign Assets Control (OFAC) and the United Kingdom due to its connections to payments made by the Russian government for western components used in weaponry during the Russian invasion of Ukraine.
Both networks worked together, operating in a combined 30 countries globally including in the Middle East (through which large sums of their money was trafficked), the West, the UK and Russia. TGR Group received large sums of money on behalf of Zhdanova, converting the funds received into cryptocurrency. From late-2022 until mid-2023, the Russian government used Smart to fund espionage operations. Upon this discovery, that aspect of the investigation was handed to MI5. The Russian government also used both networks to assist sanctioned individuals in bypassing sanctions implemented both prior and due to the Russian invasion of Ukraine.
Methods
Smart and TGR Group would swap physical money into cryptocurrency through Tether, a company that provides a form of cryptocurrency called "stablecoin", cryptocurrency backed by physical currency (in this case, the US dollar) to provide stability. Tether was, as of December 2024, under investigation by the prosecutors in the Manhattan US Attorneys Office for its potential uses in money laundering and sanction avoidance, which the company denied following a report in The Wall Street Journal. The US Department of the Treasury was, in October that year, also considering implementing sanctions due to its "widespread" use by those sanctioned by the US, including Hamas, Russian arms dealers and several other major security threats.
They would then provide this cryptocurrency to criminal organisations in the UK and the West upon receiving physical currency through Smart's system of couriers organised by Krasnov; these criminals would then pay South American cartels for drugs using this cryptocurrency, repeating the cycle.
The physical money transported by the couriers would then be laundered through various means either in the UK or in Europe and either get transferred to cryptocurrency wallets in Zhdanova's name, or to TGR Group, who would either bank the money or transfer it to Russia or Russian individuals dodging sanctions in the West. It is believed that some sanctioned individuals used the system to invest in property in the UK and other goods, with the networks concealing the original source of the funds. According to the NCA, over £100 billion is laundered in or through the UK each year, with up to £5 billion being done using cryptocurrency. Will Lyne, Head of Cyber Intelligence in the NCA, estimated that over £100 million was moved in the UK each year by the networks.
The NCA's tactical lead for Operation Destabilise said that the groups were involved in transferring billions of dollars per year, though did say that the exact sum is difficult to calculate due to their methods. An NCA cryptocurrency investigator showed Wired some cryptocurrency wallets used by the groups, with one containing over £800 million and another containing approximately £169 million.
Further investigation The UK was identified as a key hub in the international money laundering operation, with the NCA identifying similar networks across the UK with links to drugs and cryptocurrency, cartels in South America and the Kinahan Organised Crime Group which, although originating in Dublin, Ireland, has a hub in Dubai. The group is involved in trafficking drugs and firearms around the world, with links to Iran, Venezuela, Russia and Hezbollah.
In late 2022, the NCA followed a van for 300 miles in a round trip from Kensington, London, to Oldham. Surveillance footage showed that when the van returned to London, bags containing over £200,000 were removed from it. An apartment linked to the van was searched, revealing a cash counting machine and empty bags, while another property held approximately £400,000.
This network was led by Semen Kuksov, the son of a former Russian executive for AKROS Oilfield Services Company, and Andrii Dzektsa. The network, which was formed in July 2022, was coordinated by Krasnov and collected money from criminal organisations in the UK and smuggled it into Europe to be laundered and operated a cryptocurrency exchange. Although subordinate to Kuksov, Dzektsa managed couriers, giving them directions as to where and when to collect money. Over a single 74 day period, the network helped to launder £12,329,460. The NCA revealed that cryptocurrency wallets connected to Kuksov had received over £30 million. Kuksov and Dzektsa were sentenced to 67 months and 60 months imprisonment respectively, while police seized approximately £1.8 million in both physical funds and cryptocurrency.