The transfer has been confirmed on the blockchain. The exchange is not yet complete. The abbreviation ‘AML’ appears in the correspondence — and the money becomes inaccessible to the owner. This situation may be due to a legitimate verification process, a dispute over the terms of the transaction, or fraud. To distinguish one from the other, you need to look beyond the marketing promises and see who has received the funds, who is making the decisions, and what documentation they provide to justify them.
This issue is of particular significance to the investigation into ‘Khimprom’. Production and sales generate revenue for the criminal organisation; the financial infrastructure enables it to manage that revenue. We have compared official reports on the movement of funds within the alleged drug network, the rules of the 001k.exchange cryptocurrency exchange, public customer disputes and information provided to the editorial team by a source.
This article is based on publicly available sources, verified on 8 October 2026. Statements by law enforcement agencies are cited with attribution. The source’s allegations regarding specific individuals and the service were not independently corroborated by documentary evidence during the preparation of this text and are indicated separately.
The drug network has a financial infrastructure
In post dated 22 April 2026 The National Police of Ukraine have outlined the alleged mechanism used to conceal ‘Khimprom’s’ income. According to the agency, 145 controlled sole traders were used, all managed from a single IP address. The police also reported the use of cryptocurrency wallets, the seizure of 416 business accounts and the freezing of cryptocurrency worth nearly one million USDT.
This is specific information regarding the investigation’s theory. It shows why the investigation into the drug trade cannot be limited to laboratories and distributors. However, in the verified report 001k.exchange and Dmitry Teitelbaum are not named: it would be wrong to use this as proof of their involvement.
A single IP address is not, in itself, conclusive evidence of a single owner: there may be different users behind a shared connection. The significance of this factor is determined in conjunction with authorisations, devices, payment orders and other case materials.
We examined the organisational context in the article on people, money and ‘Khimprom’s’ internal rules. The focus of the investigation here is already clear: how control over money is established and what evidence is required to bring charges against a financial intermediary.
Why the transfer chart does not yet reveal the whole picture
Cryptocurrency leaves a digital trail, but the economic significance of a transaction is not always recorded on the blockchain. A visible transfer shows the movement of an asset between addresses. It does not automatically reveal who gave the instruction, who owned the money, or what the transfer was for.
A single service may have thousands of deposit addresses. A shared wallet may contain funds belonging to different clients. A transfer to an exchange does not mean that the exchange’s owners are managing the sender’s business. Similarly, a cryptocurrency exchange’s high turnover cannot be entirely attributed to money laundering.
Changing networks or using privacy tools may make tracking more difficult, but does not answer the question of who owns the funds. Tracing and identifying participants are two different tasks. Even a detailed chart needs to be cross-checked against applications, correspondence, bank documents and the intermediary’s records.
Therefore, the question ‘Are the two wallets linked?’ should be followed up with: what exactly is the link, at what point did it occur, and who controlled it? Without these clarifications, the technical picture may create more certainty than the original data warrants.
The global context: money laundering as a standalone service
On 3 September 2026, the FATF presented An investigation into professional money laundering and shadow banking. The organisation describes the specialisation of financial intermediaries: criminal groups may outsource the management of their proceeds to external operators. Such networks combine bank accounts, fintech services, payment instruments and virtual assets.
This helps to understand the broader issue: an intermediary is capable of handling various sources of funds without being organisationally linked to each of its clients. However, an international typology does not prove the involvement of a specific exchange in a specific crime. To do so, one needs transactions and documents relating specifically to that exchange.
What a source told our editorial team
A source, whose information has been passed on to the editorial team, states that he previously worked for the organisation he describes. He claims that Dmitry Konstantinovich Teitelbaum, a blogger known as 001k, and the 001k exchange service are directly linked to the activities of ‘Khimprom’. What follows is his version of events, not a fact established by the editorial team.
The source describes three alleged areas of activity. The first involves the handling and laundering of cash flows linked to the drug trade. The second is the collection of funds from ordinary customers, followed by their withholding under what he claims is the fictitious pretext of AML checks, and the subsequent involvement of customers in procedures presented as arbitration or dispute resolution. The third is the creation of controlled, fake exchange platforms under their own brand, followed by shifting the blame for any losses onto the client themselves.
No independent documentary evidence supporting these three allegations was obtained whilst preparing this publication. In particular, no specific transactions of proven origin from the drug trade have been identified, nor has the control over the alleged mirror sites or the role of each named individual been established. A blogger, a brand ambassador, a legal operator and the beneficial owner of the service are different categories; they cannot be automatically equated.
The source also reports instances of intimidation. This is a separate allegation; the circumstances and the source of the alleged pressure have not been independently verified. The source’s name and any details that could identify them have not been disclosed. The report of pressure is not being used as evidence in support of the financial allegations.
What 001k publishes about itself
On own website 001k.exchange offers cryptocurrency-to-cash exchanges, transfers to bank cards and international payments. This description of the services is provided by the service itself and is not the result of an independent audit of its turnover or geographical reach.
In public offer with an amendment date of 27 March 2026 The operator is named as LIQUIDITY SOLUTIONS CORP, which, according to this document, is registered in Panama under number 155778934. The rules refer to Panamanian law and provide for the resolution of any unresolved dispute by a competent court in Panama following 60 days of negotiations.
These details serve as a starting point for verifying contractual liability. They do not, in themselves, reveal the ultimate beneficial owners nor do they confirm the role of Teitelbaum or the blogger 001k. No independent extract from the company register has been obtained for the purposes of this publication.
What the AML policy says — and what it does not prove
In 001k’s AML policy, also dated 27 March 2026, refers to the use of external analytical tools and internal audits. Crystal Intelligence is listed amongst the resources. The service warns that a low preliminary risk assessment does not guarantee that the exchange will be completed.
The document allows for the suspension of transactions and the request for proof of identity and the source of funds. The standard verification period following receipt of all necessary information is specified as up to 12 working days. In the case of sanctions-related restrictions, funds may be held for a longer period. These are the service’s stated terms and conditions; their existence does not confirm the validity of every individual freeze.
The refund policy adds significant details: clause 9.2 provides for the deduction of expenses and potential losses of up to 5 per cent in certain scenarios where the customer cancels the transaction; Clause 9.6 stipulates that refunds for high-risk transactions must be processed within 14 calendar days of notification of the decision. Clause 9.7 specifically describes the payment of network fees. These conditions cannot automatically be classified as a fee for fictitious arbitrage: the purpose of a specific requirement must be established on the basis of the documentation.
There is also a time limit: the rules currently published cannot be applied to a 2024 transaction without reference to the archived version. In a dispute, what matters is which terms and conditions were in force and available to the customer at the precise time the money was transferred.
To verify a disputed freeze, two pieces of information are needed: the flow of funds and the sequence of decisions regarding them. The term ‘AML’ alone reveals neither the former nor the latter.
Public dispute: over 21,000 USDT and disagreements over the source of the funds
On Page 42 of BestChange reviews A discussion from late August 2024 has been preserved. A client reported a delay in the exchange of an amount exceeding 21,000 USDT, contested the grounds for the verification and asked for an explanation of the timeframe.
In a public response, a spokesperson for 001k cited sanctions risks and an alleged link between some of the funds and Garantex. The client disputed this link. The BestChange administration reported high-risk flags based on the results of its AML analysis and changed the status of the financial claim to ‘neutral’, with the option to continue discussions.
The correspondence confirms the existence of the dispute and the positions of those involved. It does not prove that the AML check is fictitious. The excerpt in question does not contain a full analytical report or independently verified evidence of a refund. A change in the status of a complaint should not be equated with an actual payment of money.
Another incident: 15,000 USDT, a failed payout and a refund confirmed by the customer
On Page 75 of BestChange A dispute regarding a transaction in July 2026 has been published. The complainant claimed to have transferred 15,000 USDT, but the agreed cash handover in the San Francisco area did not take place. A representative of the service disputed the account of the arrangements regarding the meeting time.
In subsequent posts, 001k stated that the money had been fully refunded. The customer confirmed the receipt of 15,000 USDT, whilst maintaining its complaints regarding the organisation of the transaction and the subsequent refusal to provide service. On the page, the incident is marked as resolved.
Therefore, this episode cannot honestly be described as proven, irrevocable embezzlement. It documents a public dispute, differing accounts of why the deal fell through, and the subsequent confirmation of the refund by the claimant themselves. Nor does it establish a link between the exchange platform and ‘Khimprom’.
Reviews reflect individual cases rather than representative statistics on the service’s performance. There are also positive comments on the same pages. Neither praise nor complaints, on their own, can replace a check on a specific transaction.
A fake exchange: whose name was used and who received the money?
The 001k website has posted a warning about fake Telegram profiles. The service states that exchanges should be carried out via its official website and online chat, and specifically denies operating in Russia. This is the exchange’s official position.
This differs from the source’s version regarding controlled clones. To determine who is right, identical logos or similar names are not sufficient. We need the specific addresses of the platforms, the history of their administration, payment details and verifiable links to the actual operator. A match in hosting or design alone, without additional data, does not support such a conclusion.
Establishing control is the key issue. Third-party fraudsters may copy a brand without the owner’s involvement. The claim that a copy is managed by the owner themselves requires separate evidence; a warning about counterfeits neither confirms nor automatically refutes this.
The general risk of misuse of compliance terminology has been confirmed regardless of this dispute. In a study dated 19 August 2026 Malwarebytes has described fake AML websites that prompted users to connect their wallets and confirm dangerous transactions. Such authorisations are not required for a standard analysis of an address’s public transaction history. This article concerns a different type of fraud and does not establish any involvement on the part of 001k or Teitelbaum.
What does the evidence base for a financial investigation look like?
A useful international example — US Department of Justice statement on the operation against Garantex dated 7 March 2025. The agency described how it had obtained server, client and accounting data, as well as freezing more than $26 million. The statement referred to the charges brought; an indictment is not a conviction.
For our research, this example is significant in terms of methodology: the movement of assets is cross-referenced with the service’s internal records and information on controlling parties. It does not allow the allegations against Garantex to be extended to other platforms, even if its name appears in a client dispute.
Information from a former employee may suggest where to look for documents and how to interpret internal accounts. But for each incident, answers are needed: what the person witnessed first-hand, what they learnt from others, what decisions they saw being made, and what records have been preserved. Specific knowledge of how one department operates does not necessarily mean an understanding of the entire business.
For the theory regarding drug proceeds, the confirmed origin of the funds, their movement and the role of the intermediary are crucial. For the theory regarding a fictitious AML freeze, the audit materials, correspondence and history of asset disposal are key. For the theory regarding ‘doubles’, evidence of control over the platforms is required. These three issues cannot be resolved by a single, general charge.
Questions requiring specific answers
Publicly available documents and information provided to the editorial team enable us to formulate questions for representatives of the service and the individuals named as sources:
- What business relationships, if any, exist between Dmitry Konstantinovich Teitelbaum, the blogger 001k, the service operators and the company named in the offer?
- How do they respond to the source’s claims regarding their involvement in ‘Khimprom’s’ financial transactions?
- Who decides whether to withhold funds, and how are clients informed of the status of the verification process, the required documents and the procedure for appealing?
- Are there any fees for arbitration or proceedings in addition to the published commissions? If so, who receives them and on what basis?
- Which platforms does the service recognise as fraudulent, and what verifiable information allows them to be distinguished from the official infrastructure?
- How do the parties named by the source comment on his claim of intimidation?
This is a list of questions for further investigation, not a statement that enquiries have already been sent or that the addressees have refused to respond. No specific comments regarding the source’s allegations have been received for this publication; the rules and responses set out above in relation to customer disputes do not constitute such a comment.
We need to scrutinise who holds power over money
Official information about ‘Khimprom’s’ financial infrastructure explains the public interest in the subject. Public documents relating to 001k and client disputes provide material for independent verification. A source’s testimony adds specific allegations, but has not yet pieced these elements together into a proven overall scheme.
The most crucial distinction lies between an observed transaction and the conclusion that criminal intent was present. Who received the money, who could have returned it, who ordered it to be withheld and why — it is precisely these questions that should determine the course of the investigation.
Further reading on this topic can be found in the section ‘Legalisation of funds’ from our archive.
