FBI Seizes $24M in Crypto from Russian Qakbot Cybercrime Leader

In a major move against cybercrime, the US Department of Justice has indicted Rustam Gallyamov, a Russian national, for operating the infamous Qakbot malware network. On May 22, 2025, the FBI confirmed the seizure of over $24 million in crypto assets tied to the scheme, which are expected to be returned to victims.

Since 2008, Qakbot has infected more than 700,000 computers globally, enabling ransomware attacks such as Conti, Black Basta, and REvil. Gallyamov allegedly received a cut of the ransoms paid by victims ranging from dental clinics in Los Angeles to real estate firms in Canada.

Global Effort Under Operation Endgame
The indictment is part of a wider international operation dubbed Operation Endgame, involving law enforcement agencies from the US, France, Germany, Netherlands, Denmark, UK, and Canada. “Even if they live halfway around the world, we will hold them accountable,” said Akil Davis, Assistant Director of the FBI’s LA office.

Despite a major Qakbot takedown in August 2023, Gallyamov reportedly continued his attacks using new spam-based tactics, with incidents recorded as recently as January 2025. The FBI has now also seized an additional 30 BTC and $700,000 in USDT, pushing the total recovery beyond $24 million. Gallyamov faces up to 25 years in federal prison if convicted.

Wider Crackdown Includes Tornado Cash and LockBit Hackers
Gallyamov’s case is just one of many. In December 2024, authorities indicted Rostislav Panev, a hacker linked to LockBit, for laundering over $230,000 in crypto. Meanwhile, Roman Storm, creator of Tornado Cash, faces accusations of laundering billions in illicit funds.

The US appears determined to dismantle crypto-enabled cybercrime – one takedown at a time.