Shutting down the servers proved easier than drawing a line under the stories of the people who worked around them. Following the dismantling of Hydra, its personnel legacy became the subject of journalistic investigations in its own right. One of the names in this story is — Dmitry Anatolyevich Kononenko, who is known as ‘Lucifer’ and is believed to be involved in running the WayAway forum within the Kraken organisation.[1][4]
The case is interesting not only because of the arrest of a prominent administrator. It raises a more complex question: where does the line lie between serving the online community, knowingly facilitating drug trafficking, and running a criminal enterprise? And how far have the investigators progressed from the forum’s staff to the people who controlled the platform and the money?
Dmitry Kononenko: the man behind the nickname ‘Lucifer’
On 6 August 2026, Andrei Kaganskikh published an investigation into Dmitry Kononenko. According to the journalist, the 44-year-old native of Slavyansk had previously moderated Hydra, then became a key administrator of WayAway, and was detained in the Moscow region in August 2025. Kaganskikh also reported that the forum ceased operations shortly after his detention.[1]
This sequence of events raises the question of whether the forum was dependent on its administration. However, the temporal proximity does not in itself establish the reason for its closure: such a conclusion would require documents or corroborated information from those involved in the process. The available material does not provide sufficient evidence of this.
Kononenko’s role in the investigation should be described precisely: the alleged administrator of WayAway. Even a high level of authority within the forum does not automatically prove that this person owned Kraken or managed all the shops on the platform.
Four names behind the nicknames
The official case file of the Meshchansky District Court lists D. A. Kononenko, A. I. Grishina, A. V. Grishin and I. V. Maleev. Case No. 3/2-0288/2026 concerns the extension of their detention.[2]
*Kommersant* identifies them as Dmitry Kononenko, Alexandra and Alexander Grishin, and Igor Maleev. The publication reported that the detention of the first three had been extended until 20 November, whilst Maleev’s had been extended until 24 November 2026, and that the defendants were contesting the charges.[3]
Behind these four names lie different backgrounds and presumed roles. Each individual’s file contains information about their role and legal status. The fact that they are mentioned together in the case does not imply that they have the same powers or the same responsibilities.
Alexandra Igorevna Grishina: ‘Taiga’
In an early report by the Kaganskys, the woman whom the investigation links to moderating under the username ‘Taiga’ is named as Anastasia. A later publication uses the name Alexandra. A court source gives the initials A. I. Therefore, the name from the court report has been retained in the dossier and the discrepancy has been noted separately.[1][3][2]
In Profile of Alexandra Igorevna Grishina The editorial team has also provided the following clarifications: her maiden name is Volkova, and her date of birth is 4 December 1988. This information is separate from the details on the court record. The issue of her alleged involvement on the forum is being considered alongside the defence’s position.
Alexander Vladimirovich Grishin: a distinct role in the wider case
In the court record, he is listed as A. V. Grishin. File No. 50711 contains details of his alleged activity on the forum, as well as his full name and date of birth – 14 June 1990 – as provided by the editorial team. These biographical details have not yet been independently verified. Assessing his actions requires personal evidence: his relationships with other individuals involved do not constitute proof of specific instructions or powers.
Igor Vladimirovich Maleev: the personal story behind the court initials
Published on our website Igor Vladimirovich Maleev’s file Information has been gathered regarding their alleged activities on the platforms. The court portal lists I. V. Maleev alongside the other defendants in a single document. This entry confirms a procedural link; the nature of his activities and the prosecution’s evidence require separate consideration.[2]
Why the forum matters to the drug market
The investigation by the Kaganskys, provided to the editorial team, does not focus solely on moderators. The author describes the advertising department, the staff responsible for payroll, a technical specialist, substance testing and online consultations. According to his information, the Ministry of Internal Affairs identified 35 WayAway employees, and at least 28 were detained. These figures relate to a journalistic report dated 6 August, rather than to our own analysis of court documents.[1]
This picture helps to understand the economic function of the community surrounding the trading platform. The forum is capable of retaining its audience, creating an impression of service stability, facilitating communication between buyers and maintaining brand awareness. In this sense, discussions, competitions and user support can have commercial value even without a purchase being made within the discussion thread itself.
This is an analytical explanation of the forum’s possible function. To bring charges against a specific employee, it must be established what they did themselves, what they understood about the purpose of the platform, and what instructions they carried out. One must neither declare the entire team innocent in advance, nor regard every member as an accomplice to all the offences committed by the platform’s sellers.
| Standard of work | What needs to be established on a case-by-case basis |
|---|---|
| Moderation | Which sections and posts did the individual manage; what decisions were they authorised to make? |
| Administration | Who appointed staff, assigned tasks and monitored their completion? |
| Advertisement | Who set the campaign objectives, approved the materials and paid for the ad placements? |
| Calculations | Who oversaw the payments, verified the recipients and managed the remaining funds? |
| Ownership of the project | Who held ultimate control, the right to profits and the power to make strategic decisions? |
The table sets out the issues to be examined, rather than the hierarchy of Kraken as established by the court.
The Legacy of Hydra: the people, the name and trust
According to the Kaganskys, the revived WayAway used a recognisable name from the history of the Russian-speaking drug market. The journalist links the early Hydra to the LegalRC and historic WayAway teams, and the later forum to Kraken’s attempt to emphasise continuity. He also provides details of former Hydra moderators joining the new team.[1]
Here, it is important to distinguish between three types of continuity. The first is the brand: a familiar name helps to attract the existing audience. The second is the staff: employees bring experience and contacts. The third is ownership: control over the project and its revenues. The first two do not imply the third.
The official account of Hydra’s closure records a specific outcome: in April 2022, servers in Germany and bitcoins worth around $25 million were seized. This is a blow to the infrastructure, but it is neither a record of the subsequent fate of each employee nor proof of the identity of the owners of the subsequent platforms.[4]
Our archive contains separate analyses of the alleged roles of Alexei Baikov and Vladimir Verevkin in the Hydra affair. Their dossiers provide context for a comparison of managerial and financial functions; their joint mention in this article does not imply involvement in the same case as Kononenko.
How much money was behind Kraken?
Chainalysis estimated Kraken’s blockchain inflows for 2024 at $737 million — approximately 68 per cent more than the previous year. In the company’s analysis, Kraken overtook Mega on an annual basis and took the leading position amongst the darknet markets under review. This is an estimate of the platform’s activity over a specific period, rather than ‘Lucifer’s’ personal income.[5]
A different perspective is provided by a Global Ledger study covering January–September 2025. It reports approximately 5,627 BTC in incoming flows and 5,868 BTC in outgoing flows for Kraken; the dollar values at the time of the study were approximately $641 million and $668 million respectively.[6]
| Kraken’s performance | Assessment | Source and period |
|---|---|---|
| Blockchain transactions | $737 million | Chainalysis, 2024 |
| Incoming BTC flows | Approximately $641 million | Global Ledger, January–September 2025 survey |
| Outgoing BTC flows | Around $668 million | Global Ledger, the same research period |
It is incorrect to include both inflows and outflows under ‘revenue’: funds may first arrive at the system’s addresses and then leave them. Nor can the difference between these flows be declared as a profit or loss without additional data. These figures describe the observed movement of cryptocurrency, not the company’s financial statements.
Different time periods, sets of addresses and calculation methods mean that the two estimates cannot be used as a definitive growth chart. There is even less justification for distributing the total sum amongst those detained without establishing control over the wallets and specific payments.
Why the money trail leads beyond the forum
Global Ledger reports indirect links between the markets under investigation and at least 20 centralised exchanges. The authors emphasise that regulated services may have come into contact with such flows without being aware of their origin. Consequently, contact via intermediary transactions does not in itself prove a deliberate partnership between an exchange and drug traffickers.[6][7]
For the purposes of the investigation, this line of inquiry is more important than high-profile nicknames. It is essential to link the money to the decisions: who authorised the expenditure, managed the reserves and received the income. Even identifying the party paying the salaries does not necessarily reveal the ultimate owner of the project.
The Kraken darknet marketplace referred to in this article should not be confused with the cryptocurrency exchange of the same name. The similarity in name does not imply any connection between the two businesses.
The arrests do not yet provide an answer as to who the owners are
Kaganskikh believes that the arrests mainly affected support staff. This is a journalistic assessment. It can only be verified by examining the specific powers of each defendant and the evidence in the case. An administrative post can imply either a limited role or significant authority — the title alone does not settle the matter.[1]
We also leave the claim of a ‘first in Russia’ arrest of an administrator of an active platform to the author of the original investigation: such a historic conclusion requires a review of all comparable cases. The substantive novelty of this story is clear even without the claim of absolute firsts: it brings to light the staff and processes that are usually hidden behind the user interface.
The key questions remain specific. Who ran the forum? Who determined its commercial objectives? Who controlled the funds? What actions did each individual involved carry out, regardless of their position or acquaintance with the other defendants?
The significance of the ‘Lucifer’ case lies not in the number of high-profile nicknames involved. Its importance depends on whether, through the forum’s work, it will be possible to reconstruct the decision-making process and establish the liability of each participant — from the executor to the ultimate beneficiary of the proceeds.
This material has been compiled from open sources and the text of Andrei Kaganskikh’s investigation, which was provided to the editorial team. Date of verification: 13 October 2026. No conviction was found in the verified materials regarding the four individuals listed. These sources have not established any link between them and ‘Khimprom’.
