Ukrainian police have reported the seizure of nearly 4 million USDT in connection with the U420 network, which is linked to ‘Khimprom’. A source at Kartel-Khimprom claims that a chain involving Nikolai Udyansky — the founder of Coinsbit, co-founder of Qmall and Honorary Consul of Romania in Kharkiv — was responsible for cashing out a significant portion of the group’s funds. We have cross-checked this account with police reports, a warning from the UK regulator and publications about Udyansky’s crypto projects. The key question is: where did the money leave the digital circuit, and who controlled that outflow? [1] [2] [3] [4]
‘Khimprom’s’ money. What is known about the route
On 22 April 2026, the National Police of Ukraine outlined the financial aspects of the ‘Khimprom’ case. According to the agency, the U420 network used business owners’ accounts to conceal actual income. One such account received 56 million UAH over a two-day period. According to the investigation, the participants used crypto wallets to further transfer and launder the funds. In its November report, the National Police announced the freezing of 416 business accounts and nearly 4 million USDT. The agency also named Yegor Burkin as the alleged head of ‘Khimprom’ and reported that he was under suspicion in absentia and subject to an international arrest warrant. [5] [1]
A source from Kartel-Khimprom describes the following section of the chain. According to this source, the group’s money was converted and withdrawn via an exchange network in which Udyansky was involved. The source describes this route as the channel for the ‘lion’s share’ of the funds. In two published police reports, Udyansky, Coinsbit and Qmall are not named explicitly. The editorial team does not have verifiable transaction identifiers or documents relating to the crediting of funds and the withdrawal of cash that would allow it to link the transactions to Udyansky or confirm the proportion cited by the source. [5] [1]
The figure of 56 million UAH refers to deposits into a single account over two days. Almost 4 million USDT is the volume of seized crypto assets, as reported by the police. These figures relate to different transactions and do not provide a basis for estimating the share of any individual intermediary. To verify the claim regarding the scale of the operation, we need the total volume of identified proceeds for a specific period and the amount actually withdrawn via the channel under investigation during the same period. If the same USDT was transferred between several addresses, such turnover must be excluded from the recalculation. [5] [1]
| The plot | Which records are being scrutinised? | What has been publicly established |
|---|---|---|
| Collection of proceeds | Account statements, payment service documents and cross-referencing with specific sales | The police reported on the entrepreneurs’ bank accounts and 56 million hryvnias in one of them over a two-day period. [5] |
| Conversion to cryptocurrency | Sender’s address, network, transaction ID, amount and date | The police have detailed the use of wallets and the seizure of nearly 4 million USDT. [5] [1] |
| Payment to the intermediary | The platform’s internal deposit log and documents relating to the client account holder | In the U420 reports, there is no verified link to Udyansky and his projects. [5] [1] |
| Withdrawals and receipt of cash | Withdrawal request, account statement, recipient confirmation and disbursement record | This link in the chain is described by a source close to the editorial team. There is no documentary evidence in the available materials. |
An exchange address on the blockchain can hold funds belonging to many clients. To identify the recipient of a specific transfer, one needs records from the platform itself or investigation materials specifying the account details. And when the transaction ends in cash, the final disbursement takes place off-chain. Here, records from the cash desk or the counterparty are required. It is at these two stages that the roles of the operator, the intermediary and the person who disposed of the funds are verified.
Nikolai Udyansky and Coinsbit. From a $60 million deal to a warning in London
Forbes Ukraine described the career of Nikolai Alexandrovich Udyansky (Mykola Oleksandrovych Udyansky) through his work with a network of payment terminals, the development of cryptocurrency platforms and the launch of Coinsbit. According to what he told the publication, after selling his terminal business, he moved to Thailand, where he was involved in setting up cryptocurrency exchanges. An office in Dubai was subsequently established. Udyansky also spoke about his investments in property in the UAE, Thailand and Ukraine. The source of this information regarding his investments is the entrepreneur himself. [2]
In 2019, according to Forbes, Udyansky sold 50 per cent of Coinsbit for the equivalent of $60 million in Bitcoin. Following the publication, his press office clarified that, after selling his stake, he received a percentage of the platform’s net profit. To verify any subsequent developments, it is important to know the buyer of the stake, the terms of the agreement, the right to appoint directors, and the group of people who had access to the wallets. This information cannot be gleaned from the public account of the deal. [2]
In May 2021, the crypto project UFO publicly accused Coinsbit of fraudulent activities. In his response to Forbes, Udyansky rejected the allegations and claimed that UFO had attempted to damage his reputation, published fabricated material and extorted money. These are the conflicting statements from the parties to the dispute. The Forbes article documents the dispute itself and the entrepreneur’s response. [2]
On 5 December 2023, the UK Financial Conduct Authority (FCA) issued a warning regarding Coinsbit Inc. and the domain coinsbit.io. The regulator stated that the firm was unauthorised and may have been offering financial services to UK residents. Clients were informed that they would have no access to the UK Financial Ombudsman and no protection under the FSCS scheme when dealing with this firm. This is the most direct regulatory action taken abroad in relation to Coinsbit. The document concerns the firm and the domain; however, it does not specify the ownership structure or Udyansky’s personal role as at December 2023. [6]
Miya Holdings, EVA and Qmall. Where the accounts of client funds diverge
Before Coinsbit came E-Dinar Coin. BlackBOX OSINT links the launch of this token in 2016 to Udyansky and Yuri Poltavsky, and also describes a sharp fall in the asset’s value. Here, too, it is important to distinguish between the market price and the flow of funds deposited by customers. To verify who received the proceeds from the offering, one needs the issuer’s documents regarding the token issuance, distribution and settlements with buyers. [7]
In March 2021, the Ukrainian Cyber Police reported that they had dismantled a pyramid scheme involving more than 55,000 investors, with the damage preliminarily estimated at over 150 million UAH. According to the police, clients were promised returns from the sale of electronics and taxi services. They purchased certificates, received the project’s internal units and could convert these into cryptocurrency on screen; however, actual withdrawals were not possible. The Coinsbit platform is not named in the official report. AIN.UA has linked the operation to Miya Holdings based on matching characteristics. [8] [9]
BlackBOX OSINT describes Coinsbit’s alleged role in this story. The authors write that Miya participants were offered the chance to convert their internal balances into EVA tokens, which, according to their information, were presented to clients as an asset traded on the exchange. They claim that inflated prices and simulated demand may have maintained the appearance of liquidity, after which token withdrawals ceased. To verify this, a dump of EVA transaction data and details of the accounts that placed matching orders are required. No such data is available in the publicly accessible documents. [7] [10] [8]
In 2021, Udyansky and Bogdan Prilepa launched Qmall. In an interview, Udyansky promised to launch a platform on the exchange to attract investment for Ukrainian start-ups. He also presented Qmall as an exchange regulated by the Ministry of Digital Transformation and the National Bank. Forbes Ukraine reported that both agencies denied any connection with the project. The publication also noted that in January 2023, Qmall was included in CoinMarketCap’s main list. Inclusion in such a directory reflects the platform’s status on the market data service. [2] [3] [11]
Outside Ukraine, there is a verifiable corporate trail. The Lithuanian Centre of Registers has published records relating to the company UAB Qmall, registration number 305964240. An entry dated 29 September 2025 records the submission of financial statements for 2024. An earlier entry from December 2022 mentions the same legal entity. These records establish the company’s details and the fact that documents were submitted. To verify whether it was this particular company that served a specific Qmall customer, a contract and an account statement are required. The Bank of Lithuania has separately clarified the general requirements for MiCA authorisation following the end of the transition period on 31 December 2025. This clarification does not contain a specific ruling regarding Qmall. [12] [13] [14]
The most serious public controversy surrounding Qmall concerns the funds for the production of FPV drones. BlackBOX OSINT, citing a source within the Ukrainian Armed Forces, reports that in December 2023, 500,000 USDT were deposited on the exchange, of which 110,000 were initially withdrawn, whilst the remaining 390,000 were blocked. According to the same publication, Udyansky attributed the blocking to a loss of operational control and decisions made by Prilepa’s team. ‘Media•Hub’ also reported on wallet freezes in connection with the procurement case and examined Prilepa’s role. It is impossible to determine the reason for the freeze or the subsequent fate of the remaining funds based on these reports. [7] [15]
When examining this episode, the deposit date, the time the withdrawal function was disabled, the administrator’s activity log and the transactions following the block are critical. These records could reveal who made the decision and whether the balance changed. The dispute over drone funding is not documented as being linked to the theory regarding ‘Khimprom’s’ funds. [7] [15] [1]
Kharkiv, Dubai, France and Bali. What can be seen in the photographs?
BlackBOX OSINT published a group photograph taken on a yacht and captioned it as a shot from Udyansky’s birthday celebration in Dubai in May 2021. In the same post, the authors identified Udyansky and Leonid Mitrov in the photograph sitting at a restaurant table and described how they met. The dates, locations and names in the captions below are attributed to the publication where its post specifies them. [16]
On 2 July 2024, the French gendarmerie detained three suspects in the Cannes area. The gendarmerie reported that it had launched an investigation following a tip-off from the Ukrainian police, and that the French investigation focused, amongst other things, on car thefts and burglaries. The French authorities identified the group as ‘Zaliutynski’. The Ukrainian National Police confirmed a joint operation to arrest the alleged leader of the ‘Zaliutynski’ group. BlackBOX OSINT named him as Leonid Mitrov. Udyansky is not mentioned in the French gendarmerie’s statement regarding the arrests. [17] [18] [16]
A separate still shows two men on a sofa. In the BlackBOX OSINT caption, they are identified as Nikolai Udyansky and Hasan Askhabov. The story surrounding Bali calls for precision. On 2 February 2025, the Indonesian National Police reported that Askhabov had been released following an investigation into the abduction and theft of cryptocurrency from a Ukrainian citizen. According to the agency, no evidence of his involvement in this incident was found, whilst the police continued to search for nine suspects. The location and date of the photograph taken together have not been established. [16] [19] [20]
The BlackBOX OSINT diagram specifically identifies Leonid Mitrov, Oleg Shiryaev, Sergei Lysenko, Yuri Poltavsky and other individuals mentioned by the authors in their investigation. The diagram was published in 2025. The arrows indicate connections according to BlackBOX OSINT’s version, whilst the captions reflect the authors’ claims at the time of publication. It does not show any bank transfers, wallets or transactions relating to ‘Khimprom’. [16]
The Honorary Consul of Romania and talks about the purchase of ‘Trukha’
On 1 March 2023, the Kharkiv Regional Military Administration announced the opening of the Honorary Consulate of Romania and Udyansky’s appointment. At the opening, the businessman announced the donation of generators and ambulances to the region. In the Ukrainian Ministry of Foreign Affairs’ directory, he is listed as Honorary Consul in Kharkiv. Later, in response to an enquiry from ‘Korotko Pro’, the regional administration stated that the matter of approval for the appointment falls within the remit of central government departments. Public statements regarding the activities of cryptocurrency platforms are verified against documents from the companies themselves and the relevant regulatory bodies. [4] [21] [22]
On 16 June 2026, Forbes Ukraine reported that, according to its sources, Udyansky may have become an investor in the ‘Trukha’ network of Telegram channels. The range of $15–25 million discussed was cited as an estimate of a potential deal. Udyansky and the project’s head, Maksym Lavrinenko, told the publication that there had been no change of ownership. The article contains no publicly disclosed documents regarding the financial transactions. [23] [24]
630 million hryvnia in the exchange network and Operation ‘Carthage’
On 2 October 2026, Ukraine’s Economic Security Bureau reported that, following 30 searches in connection with a case involving a network of illegal currency exchange outlets, it had seized cash in various currencies totalling the equivalent of over 630 million hryvnias. According to the agency, the network operated from a single central hub and utilised hidden storage facilities and separate accounting systems. The publication ‘Argument’ attributed the network to Udyansky. The BEB’s press release does not mention his name or his connection to ‘Khimprom’. To verify this link, legal entity identification numbers or procedural documents detailing who managed the network are required. [25] [26]
On 4 November 2026, NABU reported a new development in Operation ‘Carthage’. The published statement describes the activities of the alleged criminal organisation. On 11 November, Vlasti.net, citing an anonymous source, attributed to Udyansky a role in selecting potential victims and facilitating money laundering. Udianksy is not named in NABU’s verified reports on this episode and the five suspects. The information provided by Vlasti.net does not corroborate the operational sequence described by the Kartel-Khimprom source. [27] [28] [29]
Dmitry Dariy. What can be gleaned from case No. 645/8419/21
In the public court case index, Dmitry Anatolyevich Dariy (Dmytro Anatoliyovych Dariy) is listed as the defendant in case No. 645/8419/21. In a redacted copy of the judgement dated 21 March 2024, the court found the defendant in this case guilty under Part 2 of Article 121 of the Criminal Code of Ukraine — of intentionally causing grievous bodily harm resulting in the death of the victim — and sentenced him to eight years and six months’ imprisonment. On 29 January 2026, the Kharkiv Court of Appeal upheld the sentence. [30] [31] [32]
A Kartel-Khimprom source separately claims that Darius was Udyansky’s partner. The nature of the partnership and the timeframe are not specified. The court rulings on the Kharkiv episode relate to the circumstances of a different case. No contract, joint company or payment transaction linking Darius to Udyansky, Coinsbit, Qmall or the ‘Khimprom’ money-laundering chain has been found in the verified publicly available materials. [31] [32] [33]
An international trail in the documents
| Jurisdiction | Document or source | Subject of the report |
|---|---|---|
| United Kingdom | FCA warning, December 2023. [6] | Coinsbit Inc., the coinsbit.io domain and the lack of UK authorisation. |
| Lithuania | Records from the Centre for Registers, 2022 and 2025. [12] [13] | The Lithuanian company UAB Qmall and its reporting obligations. Client documents are required to identify the operator of a specific account. |
| France | National Gendarmerie, July 2024. [17] | Operation against the Zaliutynski group in the Primorsky Alps. |
| Indonesia | National Police, February 2025. [19] | Askhabov’s release following an investigation into the cryptocurrency embezzlement case. |
| Romania and Ukraine | The Kharkiv Regional State Administration and the Ukrainian Ministry of Foreign Affairs’ directory. [4] [21] | Udyansky’s appointment as Honorary Consul of Romania in Kharkiv. |
| Ukraine, Albania and Kazakhstan | Summary from the National Police of Ukraine, November 2026. [1] | International investigation into ‘Khimprom’. The police have reported that the case against two Ukrainians has been referred to court in Albania and that arrests have been made in Kazakhstan. The report also mentions cooperation with Interpol and the US DEA. |
| The UAE and Thailand | Interview and profile by Forbes Ukraine; photo by BlackBOX OSINT. [2] [16] | Business background and personnel from the UAE. No published decision by the regulator in these countries regarding the alleged cash-out has been found. |
Questions that need answers
- To Nikolai Udyansky. What was the extent of his access to Coinsbit’s operational management following the 2019 deal, and to Qmall in December 2023? Did his powers include the authority to withdraw and freeze funds?
- To the operators of Coinsbit and Qmall. Who owned the operating companies during the periods under investigation? Which legal entities maintained client balances, accepted deposits and facilitated withdrawals? Can the fate of the funds in the EVA and Qmall cases be confirmed by bank statements?
- The investigation into ‘Khimprom’. Which platforms or exchange services facilitated transactions involving the seized USDT? Has it been established where the digital assets were converted into cash and who the ultimate beneficiary was?
- A source close to the editorial team. Over what period does he estimate the share of the alleged money-laundering channel? Which bank or blockchain records can confirm the first and last transactions in the chain described?
Information is now publicly available regarding the seizure of crypto assets, a UK warning about Coinsbit and several conflicting explanations regarding Qmall. To establish Udyansky’s personal role in the movement of ‘Khimprom’s’ funds, at least one traceable route is needed from the group’s identified proceeds to a specific recipient, with confirmation of who controlled the account at each stage. The editorial team is prepared to publish a documented response from Udyansky and the platform operators.
