On the one hand, there were the U420 shops, which sold goods disguised as souvenirs. On the other, there were offices where operators recruited people for the drug trade or swindled money from customers of European banks. The National Police of Ukraine links these incidents to ‘Khimprom’, but describes them as part of separate investigations. To understand the scale of the network, it is important to trace where people and money went after someone applied for a job, visited a shop or answered a call. [2] [3] [4] [5]
In July 2026, the ‘Grey Cardinal’ channel released ‘Case No. 21’ about ‘Khimprom’. We have cross-checked the transcript of the video against journalistic reports and documents. Two episodes in particular highlight where the condensed video narrative requires further clarification. These are the 2024 searches in Moscow and the alleged roles of the individuals the author mentions in the chapters on the company’s early history and finances. [1] [2] [3] [6]
Watch ‘Case No. 21’ on ‘Khimprom’
‘Grey Cardinal’ channel, 19 July 2026, 8 minutes 41 seconds. View the original on YouTube. [1]
- 00:00 — the emergence of drug networks.
- 02:22 — the detention of couriers and the investigation into distribution networks.
- 03:13 — the overseas trail of the alleged organisers.
- 04:20 — violence and the role of the perpetrators.
- 05:14 — fraudulent call centres.
- 06:40 — law enforcement operations.
From Sterlitamak to Kyiv. What is known about the origins of ‘Khimprom’
In the first two minutes of ‘Case No. 21’, the author sets the story in Sterlitamak and dates the initial events to 2010–2011. RTVI also points to Sterlitamak, describing the early activities as having begun no later than 2012. According to the Russian investigation report published by *Kommersant* in April 2026, the emergence of ‘Khimprom’ as an organisation dates back to 2014. These dates may refer to different stages. It has not been possible to establish the exact date on which the first laboratory was launched, based on the materials examined. [1] [16] [17]
The Ukrainian angle has a separate public basis. In 2020, the SBU reported that seven members of ‘Khimprom’ had been convicted based on its evidence. The agency linked them to cross-border sales in exchange for cryptocurrency. This report concerns the convictions of specific participants. It does not provide the market share figure that the author of the video mentions at around the four-minute mark. Such an estimate would require data on the size of the entire market and a clear calculation methodology. [1] [18]
What kept the network going when operatives could be replaced
At the start of the video, the story is presented through the emergence of drug networks and the arrest of their rank-and-file members. National Police documents reveal another side to the same operation — the division of roles. According to the investigation, some people were involved in manufacturing and delivery. Others recruited staff, handled financial transactions or exerted pressure on those who interfered with the operation. Each of these functions had its own set of documents, means of communication and group of operatives. [1] [2] [3]
The arrest of a courier may provide the investigation with information about a specific drug-dealing incident. To trace the network further up the chain, it is necessary to link the order to the person who placed it, and the payment to the person who managed it. These leads may point to a recruitment office staff member, a delivery coordinator or the account holder. The police’s description of the hierarchy helps to understand where to look for such links. The conclusion regarding each person’s role depends on the evidence in the specific case. [2] [3]
Our previous analysis On the structure of ‘Khimprom’ This shows which links are worth examining separately. Here, we have looked at how these links manifest themselves in three publicly described episodes — U420, recruitment and telephone scams. [12]
U420. How a ‘souvenir’ ended up being the subject of forensic analysis
In March 2026, journalists from Bihus.Info published the results of laboratory analyses of goods purchased at U420. The study detected a synthetic cannabinoid in the samples tested. According to the journalists, the chain’s first physical shops in Kyiv opened in the spring of 2025, and by the time of publication, outlets were also operating in other major cities. Traditional retail gave the chain access to customers outside the dark web and made its product range available for independent testing. [6]
On 5 February 2026, the Cabinet of Ministers of Ukraine adopted Resolution No. 146 amending the list of controlled substances. The compound ADB-4en-PINACA was added to the list. The document came into force on 7 February. This date is important for the timeline: in order to assess a specific sale, the investigation must establish when it took place and which compound was contained in the product. In November, the police reported that forensic analysis of the seized samples was still ongoing. [2] [7]
On 14 April, according to the National Police, 281 searches were carried out in Kyiv and ten regions. Law enforcement agencies reported that production, packaging and distribution had been halted, that there were six suspects in the U420 case, and that 416 accounts and assets worth nearly 4 million USDT had been frozen. In a report dated 5 November, the police stated that not a single U420 shop had resumed operations following the operation. This report describes the situation regarding the chain of shops. Investigations into other ‘Khimprom’ cases are ongoing. [2] [5]
The control regulations also changed in the autumn. Decree No. 1213 of 2 October established the criteria under which derivatives of six groups of compounds may be classified as controlled substances. The police explained this measure by stating that adding each individual substance to the list left a loophole for new formulas to emerge. We wrote in more detail about the legal changes and the background to the operation in Report on the U420 case. [2] [8] [13]
Two types of call centres. Who were they looking for, and from whom did they seize money?
Recruitment offices. According to the National Police, operators of such centres used job advertisements to recruit people for specific roles, ranging from logistics and warehousing to delivery and production. According to the investigation, a system of fines operated within the organisation. The police also reported instances of physical violence and unlawful deprivation of liberty against people who tried to leave. In these cases, telephone contact was the first step in the recruitment process. [3] [9]
Fraudulent offices. In December 2025, the National Police described a specific scheme. Calls were made from offices in Ukraine to citizens of the Czech Republic, Latvia and Lithuania, with the callers posing as bank employees or law enforcement officers. Using false claims of a threat to their money, the victims were persuaded to transfer funds. At the time, the police reported at least 47 victims and losses totalling nearly 50 million hryvnias. In April 2026, the agency directly linked the December operation to ‘Khimprom’. [4] [5]
Similarities in offices, equipment and job titles may conceal different objectives. In one production facility, the investigation is looking into the recruitment and retention of staff. In another, the focus is on the deception of customers and the movement of embezzled funds. When examining the role of a specific individual, it is necessary to establish who they worked for, what instructions they received, and what evidence confirms their involvement in a particular incident. The term ‘call centre’ alone does not suffice to define this work. [3] [4]
Violence. What is known about the pressure exerted on people and the investigation
At the 04:20 mark in the video, the section on enforcement personnel begins. In the police’s August statement regarding the operation against recruitment offices, pressure on employees was described as part of internal control. The November report, however, refers to a wider range of incidents, including threats, extortion, harassment and damage to property. The National Police report that more than 30 incidents of violent crime and other forms of coercion have been documented in these areas. According to the agency, three perpetrators have been sentenced to prison terms. [1] [2] [3]
Dmitry Torgalo, Head of the Department for Combating Drug-Related Crime, spoke separately about attempts to intimidate police officers working on this case. To reconstruct the chain of command, the details of each incident are crucial — who received the threat, when it occurred, who passed it on, and on whose behalf. Public reports outline the scale of the case but provide only partial answers regarding specific individuals. [10]
Yegor Burkin, ‘The Mexican’ and the international lead
On 5 November 2026, the National Police of Ukraine named Yegor Burkin as the alleged leader of ‘Khimprom’, referred to him by the nickname ‘The Mexican’ and announced that he was facing charges in absentia on several counts, including organising a drug trafficking operation and violent crimes. According to the agency, Burkin is the subject of an international arrest warrant. In an April statement, the police claimed that the alleged leader may have been coordinating members and financial flows from abroad. These reports reflect the position of the investigation. [2] [5]
The sanctions annex to the decision of Ukraine’s National Security and Defence Council states that Burkin may use documents issued in the name of Yegor Levchenko. The wording is important: it reflects the content of the official record regarding the possible use of the documents. Which name appears in a specific operation and who actually controlled it needs to be verified separately. Our report ‘Burkin, Levchenko, “The Mexican”’ We examine where these names originated in public sources. [11] [14] [21]
Alexander Shchiptsov. In the video, his name appears in an early segment, where he is described as having a role in managing couriers. In its report on the Russian case, *Kommersant* linked Shchiptsov to security and recruitment. This is a description of his alleged role. It does not specify exactly which offices or incidents he oversaw. [1] [17] [22]
Andrei Vigel. In the section on money, the author of the video attributes the channelling of funds into property to Vigel. RTVI and *Kommersant* have also linked him to the alleged laundering of proceeds. Specific transactions, recipients and the source of funds for each property have not been established in the materials examined. The dossier compiles publications and separately analyses the corporate trail. [1] [16] [17] [23]
In the video, Mexico is mentioned as the place from which Burkin allegedly ran the network. *Kommersant* also named this country, citing operational intelligence. A November press release from the Ukrainian police states that he is wanted internationally. His current whereabouts are not disclosed in this report. [1] [2] [17]
Searches in Moscow. What do the figures from the end of the video mean?
In the finale of ‘Case No. 21’, the searches are presented as a crackdown on three offices. On 11 December 2024, the FSB and the Russian Ministry of Internal Affairs did indeed report an operation against three Moscow call centres, which the FSB linked to Burkin. According to the Ministry of Internal Affairs, there were approximately 500 workstations in the offices. At the time the police arrived, there were more than 300 people present. Regarding the incident involving Serbian nationals, the ministry reported that nine suspects had been taken into custody. The number of workstations, the number of people on the premises and the number of those arrested relate to different metrics. [1] [19] [20]
In April 2026, *Kommersant* reported that the Tverskoy District Court of Moscow had granted applications for the arrest in absentia of Burkin, Alexander Sheremetyev and Ahmed Awad in relation to the separate case. The court-appointed defence lawyers objected to the applications. Arrest in absentia is a decision on a preventive measure which, in this case, the court ruled should be applied upon extradition to the Russian authorities. Publicly available information about the operation also does not allow for a detailed reconstruction of the technical chain of events described in the video, which led the security forces to the offices. [1] [17] [20]
The August arrests and the November round-up. What followed the video
The July edition concludes with a chapter on law enforcement operations. A month and a half later, on 31 August, the National Police published the results of a multi-stage operation involving Ukraine, Albania and Kazakhstan against recruitment units. In the final Ukrainian phase, the police reported seven arrests and nine notices of suspicion. These figures relate to that specific phase. The operation against U420 in April and the case of the fraudulent offices, which was reported in December 2025, have their own figures. [1] [2] [3] [4] [9]
| Date | What has been published | To which episode does this relate? |
|---|---|---|
| 11.12.2024 | The FSB and the Russian Ministry of Internal Affairs reported an operation targeting three offices. [19] [20] | Investment fraud in Moscow. |
| 16.12.2025 | The police reported losses of nearly 50 million hryvnias. [4] | Telephone fraud targeting EU citizens. |
| 14.04.2026 | 281 searches, according to the November police report. [2] | Production, packaging and sales of U420. |
| 19.07.2026 | The release of ‘Case No. 21’ on YouTube. [1] | A documentary feature by the ‘Grey Cardinal’ channel. |
| 31.08.2026 | The police have announced the results of the international operation. [3] | Recruitment offices and the final stage in Ukraine. |
| 05.11.2026 | An update on the status of U420, the investigations and the search for Burkin. [2] | Update from the National Police of Ukraine on several fronts. |
Where do the figures end and the question of who owns the money begin?
Almost 50 million hryvnias — the estimated loss to victims in the case concerning the phone calls. Almost 4 million USDT is the value of the seized crypto-assets reported by the police in relation to U420. The figure 416 refers to the number of accounts seized. It is not possible to deduce the network’s total turnover or the personal income of any of the individuals involved from these figures. To make such a calculation, it is necessary to cross-reference the dates of payments, the recipients and details of who had access to the accounts and controlled the funds. [2] [4]
Publicly available materials already show a shift from the closure of individual outlets to an investigation into the infrastructure — offices, staff, accounts and management channels. The key questions for the court documents are: who made the decisions in each instance, and where did the money go? We have addressed the topic of financial links separately in Report on Garantex and ‘Khimprom’. [15]
The editorial team is prepared to supplement this article with published court rulings, documents and comments from the individuals mentioned or their representatives. Sources and procedural statuses have been verified as at 10 November 2026.
