Legalizer had usernames, moderators, technical infrastructure and discussions about investing in a conventional business. In August 2021, all of this found itself at the centre of a scandal following the publication of an alleged leak. Five years on, the main question remains the same: what in this story is corroborated by publicly available documents, and what still relies solely on the claims of the person who carried out the hack?
The analysis focuses on Artem Shvedov, Roman Kukharenko and Alexander Prokhozhenko. The editorial team regards them as alleged members of the Legalizer team, each with different roles. This assessment does not imply a finding of guilt; the materials examined do not confirm any connection between these individuals and ‘Khimprom’. [A]
Archive material that cannot be passed off as a new arrest
Kommersant’s report on the publication of the database appeared on 17 August 2021. The PDF provided contains the author’s analysis, ‘The Fall of Legalizer’, dated August of that same year. This is therefore a historical account, rather than a report on a recent police operation. [1] [A]
This distinction changes the meaning of the whole story. The publication of information about an account does not imply the arrest of its owner. The position described in the old text is not necessarily still in place five years later. Furthermore, the author’s remarks regarding the handover of materials to law enforcement do not confirm either a procedural decision that has been taken or the outcome of an investigation.
The source text itself is heterogeneous. It contains a mixture of fragments from the supposed database, correspondence, historical information about domains and the author’s conclusions. It also includes an offer to sell additional data. It is important for the reader to understand the origin of the material: the distributor may have had their own interests, and the available selection is not equivalent to a complete and verified archive. [A]
Three names — three different presumed roles
| Person of interest | Role according to the archive version | What remains to be verified |
|---|---|---|
| Artem Shvedov | Owner and developer | Identity of the account operator, periods of control, disposal of income |
| Roman Kukharenko | Former developer and administrator | Content of the works, period of access, circumstances of the proposed transfer of a copy |
| Alexander Prokhozhenko | Administrator: OldSchool bro | Attribution of correspondence, actual powers and the origin of attachments |
The table reflects the version provided by the author of the archive material; it is not a list of those convicted or officially wanted. [A]
Shvedov: developer, account and the question of actual control
In the PDF, Shvedov is presented as the person linking external web projects to Legalizer’s infrastructure. The author cross-references technical records, registration details and correspondence, and also attributes the ‘Gerard’ account to him. What matters is not just a single contact found, but whether independent evidence allows us to establish who was managing the forum at a specific point in time. [A]
This is where the line is drawn between an interesting lead and proof. A person might have developed the website, maintained it, owned it, or carried out a specific commission. To choose between these versions, information about their authority and actions is required. The analysis provided even includes a retelling of Shvedov’s words regarding the loss of control over the website — yet the authenticity of this conversation has not been established either. [A]
Kukharenko: a technical trail with an incomplete chronology
In the archive text, Kukharenko is referred to as a former member of the team. The author links him to the server logs and claims to have received a backup copy of the forum from him. There is no independent confirmation of this transfer in the collection examined. [A]
For the purposes of this investigation, the alleged technical role is significant in itself. However, it does not automatically allow us to attribute all user transactions to the developer or to recognise him as the ultimate owner of the platform. A timeline is needed: when access was granted, what tasks were carried out, who issued instructions, and when the collaboration ended. Without it, the term ‘administrator’ obscures more differences than it explains.
Prokhozhenko: from alleged correspondence to a real company
The most substantial follow-up was found in Prokhozhenko’s business history. In an article for AIN dated 20 August 2021, Molfar described an alleged request for 25,000 dollars for a tattoo parlour and linked it to the company ‘Malevich Tattoo Collective’. [2]
The OpenDataBot profile, verified on 15 October 2026, does indeed list Oleksandr Serhiiovych Prokhozhenko as the founder and ultimate beneficial owner of the company with registration number 43504058, with a 33.33 per cent share and a contribution of 25,000 hryvnias. The total authorised capital amounts to 75,000 hryvnias. YouControl also indicates that the company was registered on 11 February 2020. [3] [4]
This is a standalone addition to the archive story, but the scope of the conclusion is limited: it confirms a record of a person with the corresponding full name having been involved with the company. The source of the funds is not indicated in this record.
It is particularly easy to misinterpret the figure ‘25,000’. The alleged investment request refers to dollars, whilst the registry entry refers to a deposit in hryvnias. There is no equivalence between them. Even confirmed correspondence regarding a loan does not replace proof that it was actually granted, and the existence of a business does not prove the legalisation of criminal proceeds.
What the archive reveals about the site’s layout
If we treat the text provided as a set of versions to be verified, several areas of presumed work can be identified: technical support, administration, moderation, relations with shops and payments. This is the content of the source material, not an organisational chart established by the investigation. [A]
| Level | What is being discussed in the archive | What is missing to confirm this? |
|---|---|---|
| Technical infrastructure | Servers and backups | Verified file provenance and access history |
| Management | Decisions regarding the team’s work | Attribution of accounts and complete correspondence |
| Moderation | Responsibilities and remuneration | Confirmed identities and actual actions |
| Commercial relations | Payment for shop listings | Documents relating to payments and their recipients |
| Overseas business | Investment discussion | Fund flows and verified sources of funds |
This approach is useful in that it leaves questions open. It does not treat all the accounts mentioned as a single, proven group, nor does it replace research with a neat connection between surnames.
Alina Vasina: a reference that does not establish involvement
A source close to the editorial team suggests a possible link between Alina Vasina and Legalizer. Her specific role and legal status have not been independently confirmed.
The author of the PDF uses Alina Vasina’s name when comparing historical domain registration details. The materials provided do not offer sufficient grounds to assert that she administered Legalizer, received income from the forum or had official suspect status. She is therefore mentioned here as a person from the initial analysis, rather than as a confirmed participant in criminal activity. [A]
The same rule applies to other people in their circle: family ties, shared business interests and the presence of a photograph in the compilation do not in themselves establish involvement. In the case of accounts that exist solely under nicknames, one must not invent identities to fit the pattern.
Why history is not yet over
Based on the search results for this publication, no official document has been found regarding a warrant, charge or conviction against the three individuals named specifically for their work on Legalizer. It cannot be concluded from this either that there are no investigations or that the individuals in question are under anyone’s protection. The available evidence does not support such conclusions.
Further investigation should answer specific questions: who controlled the privileged accounts, to whom were payments made, what relationship existed between the technical contractors and the administration, and were the investments under discussion actually carried out? The answers to these questions could turn this archival scandal into a documented history. For now, the main new finding is a public corporate trail, which allows one line of inquiry to be investigated separately from the anonymous source of the leak.
[A] Archival source: ‘The Fall of Legalizer’, a text written under the pseudonym Pyk Kekov, saved as a PDF and provided to the editorial team. The document is dated 29 August 2021 and contains a separate note regarding an update on 13 August. This is the author’s analysis of the alleged leak, not an expert report or a court document. The authenticity and completeness of the source material have not been independently verified.
