The building is 374 meters tall, sheathed in glass, and visible from most of central Moscow. Federation Tower East stands at Presnenskaya Naberezhnaya 12, in the Moscow-City International Business Center — a cluster of corporate skyscrapers on the Moskva River that was meant to announce Russia's arrival as a global financial capital. When it was completed in 2017, it was the tallest building in Europe. It held that title until 2019, when Lakhta Center in St. Petersburg surpassed it. It remains the tallest building in Moscow.
Its developer, AEON Corporation, is controlled by Roman Trotsenko, a Russian industrialist sanctioned by the EU and UK, whose company AEON Corporation was designated by OFAC in November 2023. Its western twin belongs to VTB Bank, Russia's second-largest financial institution, sanctioned since 2022. The Podium — the low-rise structure connecting the two towers — is held by EVINDREAM LIMITED, a Cyprus holding company (HE 343693) registered in Limassol in May 2015 with a nominee director who serves on at least eight other Cyprus entities. Its beneficial owner is not publicly disclosed.
From a distance, Federation Tower is beautiful — two silver-blue columns catching light off the river, tapering toward a sky that in winter is the same color as the glass. Up close, the lobby is marble and security desks. There is no public directory of tenants at the entrance. A receptionist bars entry to anyone who has not been invited. The building projects legitimacy the way a Swiss watch projects precision — through materials, through scale, through the simple fact of being expensive.
It is also, by cumulative volume, the single most productive address in the history of financial sanctions evasion.
The Parade
The sequence begins in September 2021, when the U.S. Treasury's Office of Foreign Assets Control designated Suex OTC, a cryptocurrency exchange operating from floor 31 of Federation Tower East. It was the first-ever OFAC designation of a virtual currency exchange — a precedent that signaled the U.S. government would treat crypto intermediaries the same way it treated rogue banks. Treasury identified over $160 million in transactions linked to ransomware proceeds, darknet markets, and fraud. The operation was remarkably physical for a digital business: couriers used pre-ordered building passes to enter the tower, exchanged cash for crypto in private rooms, and left. The building was not incidental to the business. It was the business — the place where digital currency met physical cash, where anonymous blockchain wallets acquired real-world liquidity.
Suex was sanctioned. Two months later, in November 2021, Chatex was designated — a service nested inside Suex's own infrastructure, sharing the same technical backbone, operating from the same building. Second in sequence. The gap between sanctions was narrowing.
Five months after that, in April 2022, OFAC designated Garantex, the largest of them all. Floor 14 East. Over its lifetime, Garantex would process $96 billion in transaction volume — a number that dwarfs most cryptocurrency exchanges and exceeds the GDP of several European nations. North Korean state hackers from the Lazarus Group funneled stolen cryptocurrency through its wallets. Ransomware payments — the kind extracted from American hospitals, school districts, and municipal governments — were laundered through its infrastructure.
Garantex's co-founder, Aleksej Besciokov, was indicted by the U.S. Department of Justice in March 2025. He was arrested in India that same month on an international warrant. In August 2025, he died in Indian custody. His domains were seized. The exchange he built kept operating under a new name.
Grinex appeared four days after the Garantex domain seizure. Its own domain had been registered a year earlier — the succession was not reactive but planned, the replacement queued before the original was even shut down. Grinex was sanctioned in August 2025. It operated in conjunction with A7A5, a ruble-pegged stablecoin that processed $93.3 billion in trading volume in 2025 alone, jointly owned by Ilan Shor — a Moldovan politician convicted of bank fraud and sentenced in absentia — and Promsvyazbank, a Russian state defense bank under EU and U.S. sanctions. In April 2026, Grinex reported a $13.7 million "hack." Chainalysis raised concerns that the hack may have been a false flag — a manufactured exit that launders the exchange's own reserves. Grinex subsequently suspended operations on April 16, 2026.
Four exchanges sanctioned. Four replacements launched. One address. The building never closes.
And then the fifth. On May 26, 2026, the United Kingdom designated ABCeX — through its parent company, Nueva Cryptologia S.A.S. de C.V., registered in El Salvador — as part of the first-ever application of banking-style sanctions to cryptocurrency exchanges under the UK's Russia regime. Eighteen entities in a single package — headlined by HTX (formerly Huobi), a global exchange suspected of channeling $1.5 billion to Russia, along with Exmo, Bitpapa, and the Kremlin-backed A7 payments network. The largest coordinated action against Russia's crypto-sanctions-evasion infrastructure since the Garantex takedown. ABCeX was the Federation Tower entity in the package.
ABCeX's successor, AEXBit, was not named in the designation. As of May 2026, it remained accessible.
The Current Occupant
The exchange most recently sanctioned while operating from Federation Tower East is ABCeX — designated by the UK on May 26, 2026, the fifth in the building's sequence. It occupied floors 3, 28, and 52 — spread vertically through the building like a company that expects to need multiple escape routes. Established in late 2023, it processed over $11 billion in its first two years of operation, according to Elliptic, the blockchain analytics firm. TRM Labs documented $355 million in bilateral exposure with sanctioned entities — $133.4 million with Garantex, $175.2 million with Aifory Pro, $38.1 million with Rapira. It operated 53 physical offices across Russia where customers exchanged cryptocurrency for cash. It claimed more than 30,000 users.
Its alleged beneficial owner is Shukhrat Rasulov, an Uzbek-born businessman who operates through Yuri Kvashonkin and LAKOST LLC on the building's third floor. Russian investigative outlets Sledstvie.info and Rucriminal.info have published extensive reporting on the operation.
On March 29, 2024, one week after the Crocus City Hall terrorist attack killed at least 149 people in suburban Moscow, law enforcement searched ABCeX's offices as part of the broader investigation into the attack's financing. Russia's Rosfinmonitoring stated that financing "passed through numerous financial organizations using various tools, including cryptocurrency." No charges against ABCeX resulted from the search.
Nine months later, on December 9, 2024, a joint operation by the FSB, the Ministry of Internal Affairs, and the Investigative Committee raided ABCeX across multiple locations. Equipment was seized from the 52nd floor of Federation Tower. Evidence of illegal casino payment processing — for operators 1win and 1xBet — was recovered. Criminal cases were opened under Articles 172 (illegal banking) and 186 (counterfeiting). Russian outlet TheIns.ru reported over $10 million seized in three weeks of raids.
ABCeX was open the next day.
Before its designation, Elliptic had called ABCeX "the largest unsanctioned exchange" in the Russian sanctions-evasion ecosystem. Blockchain analytics showed documented flows with Garantex — approximately 818,000 USDT sent and 204,000 received — and with Grinex, its successor: approximately 1.19 million USDT sent and 627,000 received. TI Russia's undercover operation traced specific USDT flows through intermediary wallets: Arvix to intermediary to target wallet, $2.66 million routed through a Garantex-linked address on a single date in January 2025.
ABCeX had already rebranded before the sanctions hit. In July 2025, a service called AEXBit appeared with an identical interface, the same cryptocurrency offerings, and the same Telegram promotion channels. TRM Labs' co-spending analysis indicates common control — the same wallets service both brands. Arvix LLC, a Georgian entity designated alongside ABCeX, appears in the AEXBit infrastructure. But AEXBit itself was not named in the UK designation — not as a separate entity, not as an alias.
The pattern is by now familiar: Suex begat Chatex. Garantex begat Grinex. ABCeX begat AEXBit. But this generation is faster. Previous transitions took months. ABCeX and AEXBit were running concurrently — a parallel deployment, not a serial succession. The factory has optimized its production line. And the UK's designation of ABCeX, the most comprehensive crypto-sanctions package any Western government has assembled, did not name the successor that was already live on the same wallets.
Why This Building
The question that the sanctions, the seizures, and the raids have not answered is structural. Why does the same address keep producing the same operations?
It is not for lack of alternatives. Moscow has no shortage of office space. The city's commercial vacancy rate exceeds 10 percent. A crypto exchange that wanted to avoid attention could operate from any of thousands of anonymous business centers. Instead, five exchanges in sequence chose the most conspicuous commercial address in Russia — a sanctioned tower owned by a sanctioned developer, guarded by security that logs every visitor, in a complex watched by every intelligence service with an interest in Russian financial crime.
They chose it because the building is not a liability. It is an asset. The lobby has no public directory of tenants. Visitors are admitted only by prior arrangement — the receptionist bars entry to anyone who has not been invited by a specific office. When Suex operated from floor 31, couriers arrived with pre-ordered building passes, exchanged cash for crypto in private rooms, and left. AEON Corporation does not disclose which companies rent which floors. The building's management company, VB Service LLC, operates the access system that makes this possible. The structure ensures that no outside observer can determine who occupies a given office until an exchange is large enough to attract a sanctions designation. By then, the successor is already running.
The answer is in the building's ownership layer.
Federation Tower's corporate structure is designed for opacity. AEON Corporation is sanctioned. VTB Bank is sanctioned. EVINDREAM LIMITED is a Cyprus shell with a nominee director and no visible beneficial owner. But the Panama Papers — the 2016 leak of 11.5 million documents from the Panamanian law firm Mossack Fonseca — revealed a deeper layer.
The Panama Papers trail begins with a name that seems to lead nowhere. Bancario Corporation appears in the leaked documents as shareholder of a Bahamas-registered company called Legal Consulting Limited. Searching deeper into the ICIJ's database reveals that Bancario is a Seychelles entity registered at 102 Aarti Chambers in Victoria, Mahé — a mass-registration address shared with sixty-six other offshore officers. It holds shares in not one but two Bahamas entities, and it inherited its stake from another Seychelles shell at the same address, which inherited its stake from bearer shares. Three layers of opacity, one mailing address, zero identifiable humans.
What sits at the end of this chain is a Moscow operation called Legal Consulting Services Limited, based in a building on Bolshaya Polyanka Street — the firm that administered both Bahamas entities on Mossack Fonseca's behalf. When CrimsonVector downloaded the complete ICIJ dataset and searched for every entity this firm had administered, the result was not the fifty-seven shown on the public website. It was 2,014.
Two thousand offshore shells — registered across the British Virgin Islands, the Bahamas, Panama, and Niue — all administered through one Moscow office, by two men, through a Danish limited partnership called Graff International Partners. Danish Business Authority records show the partnership was registered in Copenhagen in November 2010 (CVR 33258291), classified initially under construction project management, then re-coded to non-specialized wholesale, then to business consultancy. Its general partner changed twice — from Graff Nordic Management ApS to Park Management ApS in Frederikssund, then to a foreign entity called Mentor Capital Partners Ltd. It was struck from the Danish register in August 2013, re-registered in August 2014, and finally dissolved on August 28, 2017 — sixteen months after the Panama Papers were published. Its beneficial owners are classified as hidden under Danish law. We found no prior published analysis of this specific intermediary network. It is one of the largest intermediary portfolios in the entire Panama Papers.
One of its clients was the man who owns Federation Tower.
The ICIJ's leaked Mossack Fonseca records show that Roman Trotsenko — the EU- and UK-sanctioned developer of Federation Tower East, who controls AEON Corporation — held bearer shares in a British Virgin Islands entity called Dothy Investments Limited, incorporated in February 2004 and still listed as active. His contact person on the Mossack Fonseca paperwork was Sergey Sobolev of Graff International Partners — the same man whose name appears on 1,996 of the 2,014 entities in the network. Trotsenko held his shares as bearer from 2004 to 2007, then briefly as a named shareholder before the entity passed to an associate, Anatoliy Matveenko, who also serves as beneficiary of a second active LCS shell, Flamank Resources S.A. By 2017, according to the Pandora Papers — a separate leak from a separate law firm — both entities list a new ultimate beneficial owner, Rustem Rinatovich Khalilov, at the same Moscow apartment building across two independent datasets. A third LCS entity, Sempyo Trading Corporation, lists Sofia Trotsenko — a family member — as its beneficiary.
The building's owner did not merely benefit from the opacity that Legal Consulting Services provided. He was a client of it. The intermediary that structured 2,014 shells also served the man whose company collects the rent.
The rest of the client list deepens the pattern. Vadim Gurinov, a representative of sanctioned Putin associate Gennadiy Timchenko and Gazprom Neft CEO Andrey Dyukov, used the intermediary for three entities. His brother Artem connects through it to Petroruss DMCC, the oil trading firm sanctioned by the United Kingdom in December 2024 for operating Russia's shadow tanker fleet. Andrey Komarov, the billionaire owner of ChelPipe and former member of the Federation Council, sanctioned by the United States in February 2024 under Executive Order 14024, held bearer shares in four LCS entities. Anatolie Stati, the Moldovan energy oligarch whose Ascom Sudd Operating Company is on the U.S. Bureau of Industry and Security Entity List, ran 15 entities through the same office — 10 still active. The Tskhovrebov family, beneficiaries of BVI shells and operators of German real estate holding companies, listed their Panama Papers address at the Moscow City complex itself — the same complex where the crypto exchanges do business.
This is not a building that happens to house sanctions-evasion operations. It is a building whose owner used the same offshore infrastructure that services sanctioned oil exports, sanctioned industrialists, and BIS-listed energy companies. The crypto exchanges are the building's most visible product. They are not its only one.
The full network analysis is published separately in "Two Thousand Shells and a Mailing Address."
The American Thread
Sergey Kunitsa is the CEO of Paysol LLC, the domestic payment agent for Exved — one of the exchange services in Federation Tower's orbit. He holds an active California contractor's license, owns property in Florida, and maintains a public Instagram presence on the California coast. Transparency International Russia's undercover investigation documented what Paysol does and how it does it. Posing as a Hong Kong-based electronics exporter, TI Russia contacted Exved via Telegram in October 2024. Twenty-five minutes after submitting a company card, they were approved — no passport scan, no proof of beneficial ownership, no video verification — and introduced to Paysol as the payment agent.
In recordings published by TI Russia, Paysol's agents described a dual-circuit mechanism: a Russian importer pays rubles to a bank account held by a foreign-registered intermediary, which converts the funds to USDT and pays the supplier offshore. The contract makes no reference to cryptocurrency. "No bank will know. It is visible only between us," a Paysol representative told TI Russia on October 13, 2024. When asked about dual-use goods — microprocessors, telecommunications equipment — the response was a sales pitch: "multimillion-dollar annual volumes." According to OCCRP blockchain analysis, Paysol's wallets received $234,366 from sanctioned Garantex addresses on December 25, 2024, and transferred $2.66 million through a Garantex-linked intermediary on January 17, 2025. The full evidence, including named banks, recorded quotes, and the complete mechanism, is published separately in "The Kunitsa Dossier."
Before Paysol, Kunitsa ran RMA Logistics, a Moscow customs brokerage with offices in Moscow, Guangzhou, and Hong Kong. RMA held Russia's "Green Corridor" trusted-trader status — a coveted designation that allowed goods to pass through customs without physical inspection. RMA is now in liquidation. Kunitsa's next venture was Paysol — a company that navigates a different kind of regulatory boundary. Where RMA moved physical goods through customs, Paysol moves value through the banking system. Both operations require intimate knowledge of where oversight applies and where it doesn't.
His American footprint is extensive and documented entirely through public records. SK Construction in Santa Ana, California holds active California State License Board license #921058 and completed $2.4 million in wildfire rebuild projects in 2025. SQ Construction operates out of Kent, Washington. RMA Logistics Inc. (USDOT 3316938) was registered at a residential address in Westbury, New York. Property records show a residence in Lehigh Acres, Florida.
The Kunitsa family's U.S. presence extends across at least seven states in construction, trucking, and physical trades.
The enforcement gap is stark. OFAC has designated the exchanges — Suex, Chatex, Garantex, Grinex. It has designated the architects — Sergey Mendeleev, designated; Aleksej Besciokov, dead; Mira Serda and others, named on the SDN list. But it has not designated the payment agent that bridges the crypto ecosystem to the Russian banking system. Paysol is not on the SDN list. Kunitsa is not on the SDN list. SK Construction's California license is active. The Florida property is not seized.
The crypto exchange gets sanctioned. Its payment agent's CEO maintains an active California contractor's license. The full evidence is published separately in "The Kunitsa Dossier."
The Address
The sixth exchange is already running. As of May 2026, AEXBit remained accessible — on the same wallets, through the same Telegram channels, from the same building. The UK's May 26, 2026 sanctions package — the most comprehensive crypto-sanctions action any Western government has assembled — designated ABCeX, its subsidiary Aifory, its infrastructure entity Arvix, and its co-founder Mendeleev. It did not designate AEXBit.
And the infrastructure has scaled beyond anything the sanctions regime was designed to address. The A7A5 stablecoin — a ruble-pegged token issued by a Kyrgyz shell company whose registered address was a ramshackle house where no one had heard of it — processed $93.3 billion in trading volume in 2025. A Proyekt investigation published on April 29, 2026 found that A7 now handles approximately 15 percent of all Russian cross-border transactions. Its clients include Roman Abramovich — who Proyekt identifies as its "roof," the Russian criminal term for protector — former FSB director Nikolai Patrushev, Novatek CEO Leonid Mikhelson, Kremlin-linked developer Arkady Rotenberg, and Sistema conglomerate owner Vladimir Yevtushenkov. Abramovich denied the connection through a representative. Five sanctioned drone manufacturers moved hundreds of millions of rubles through the system. Its parent company, A7 LLC, is co-run by Ilan Shor, a Moldovan fugitive convicted of stealing $1 billion from three banks, and by an executive of Promsvyazbank whose father served as Russia's prime minister and then as director of the SVR, Russia's foreign intelligence service. In September 2025, Vladimir Putin personally attended A7's branch opening via video link. A former White House national security council adviser called the government's support for it "wild." This is no longer a criminal enterprise. It is a state project.
Federation Tower's crypto operations have survived five rounds of OFAC sanctions, one UK sanctions package, one DOJ indictment, one international arrest, one prison death, two Russian law enforcement raids, a domain seizure, and an FSB investigation. None of it has stopped the building from producing the next exchange. None of it has touched the offshore layer — the 2,014 shells, the Seychelles nominee chain, the two Moscow operators who administered them, the building owner who was their client, or the intermediary that also services sanctioned oil exports and sanctioned industrialists.
Two days before the UK acted, the European Union's 20th sanctions package imposed a sectoral ban on all crypto-asset service providers established in Russia or Belarus — the category-based approach that this investigation's findings implicitly support. But ABCeX's parent is El Salvadoran, Arvix is Georgian, the ownership runs through Cyprus, Seychelles, and the British Virgin Islands. None are "established in Russia." The smartest tool yet still misses the layer this investigation maps.
The sanctions regime as currently applied is designed to target entities — individual exchanges, individual operators, individual wallets. It works like antibiotics: it kills the specific infection, but it does not sterilize the environment. Federation Tower is the environment. The building is not where the crime happens to occur. The building is why the crime keeps occurring — because the same offshore infrastructure that makes the building's ownership untraceable also makes its tenants uninspectable, and the man who owns the building and the men who operate the offshore network are connected through the same law firm's leaked records.
The UK has now designated the fifth exchange. OFAC has yet to act on it. AEXBit is, as of May 2026, the sixth. It will be replaced by a seventh. The address will be the same.
Presnenskaya Naberezhnaya 12. Three hundred seventy-four meters of glass and steel, rising from the bank of the Moskva River.
The address.
This investigation is based on OFAC designations, DOJ indictments, Elliptic and TRM Labs blockchain analytics, Transparency International Russia / ICIJ / iStories reporting, Chainalysis research, ICIJ Offshore Leaks Database bulk data analysis (Panama Papers, Pandora Papers, Offshore Leaks), Danish Central Business Register (CVR) records, OpenSanctions data, Russian corporate registries, U.S. state licensing databases, FMCSA records, property records, and CrimsonVector's original research. No classified or non-public government data was used.
"The Address" is a CrimsonVector investigation. Companion articles: "The ABCeX File" | "The Kunitsa Dossier" | "Two Thousand Shells and a Mailing Address"