Computer attacks, extortion… He weighed on Alexander Vinnik, sentenced on Monday in the Paris court, as many charges as he bore pseudonyms.

The biggest trial of a cybercriminal ever held in France delivered its verdict on Monday. Russian citizen Alexander Vinnik was sentenced at first instance to five years in prison and a fine of 100,000 euros, not to mention the damages due to his numerous victims. The sentence, however, remains far from what the prosecution had requested: ten years and 650,000 euros. For lack of direct evidence, the accused was acquitted of 13 out of 14 charges. Dressed in black jogging in his Plexiglas box, Alexander Vinnik listened to the judge in almost perfect immobility. Slightly leaning towards his interpreter, he barely blinked frantically when, after the long litany of releases, he was found guilty of aggravated money laundering in an organized gang.

A gigantic washing machine

Leaving the room, in front of the cameras of the Russian media who came in large numbers, Master Belot, one of the defendant's lawyers, released what everyone had come to hear. "As regards the Locky ransomware, Alexander Vinnik has been declared not responsible." This program, active from 2016 to 2018, was triggered when opening an ordinary Word document received as an email attachment. He then took hostage, by encrypting them, all the data contained in the hard disk of the victim. These number in the thousands around the world. In France, 200 citizens and companies have declared their computers infected, not to mention institutions such as the Caisse d'allocations familiales, museums or several municipalities. To recover the encryption key, and therefore the data, some have agreed to pay ransoms demanded in cryptocurrency. According to French justice, no less than 20,000 bitcoins, or 135 million euros according to 2018 prices, were thus ransomed by Locky.

It is through cryptocurrencies that Vinnik would have amassed a fortune. It is also through them that "Mr. Bitcoin”, as it has long been called. His official job was to handle transactions on a cryptocurrency market platform called BTC-e, with a clearly opaque structure. The Russian site, hosted on servers located in the United States, operated under Cypriot law. In its legal notices, there was only a front company, based in the Seychelles. BTC-e therefore had everything to become a massive online crime laundering platform. A gigantic washing machine in which, in 2016, 95% of ransoms from malware like Locky went. The site did not even require an identity, just a nickname, to convert its cryptocurrency into rubles, dollars or euros. Result: before its servers were seized by the FBI in 2017, BTC-e became the second platform by trading volume with almost a third of the market. It reached its full extent when the pioneering service, Mt. Gox, was hacked in 2014. 850,000 bitcoins – around 2 billion euros – were then stolen. A huge digital heist which would have been, for the most part, laundered on BTC-e with the help of the accused.

If, thanks to the blockchain – a digital account ledger allowing anyone to verify its integrity – bitcoins can be tracked, a site like the one for which Alexander Vinnik worked made it possible to convert them into fiat currency in any opacity. The ransoms paid by Locky's victims arrived on the platform, were transformed and ended up in an account named "Vamnedam". Without a few mistakes by Vinnik, the investigators would not have been able to piece together any evidence against him. This account was in fact linked to the Gmail address of the accused's iPhone. This case therefore shows the extent to which justice finds itself powerless in the face of organized cybercrime.

Qualified by the prosecution as a "pirate of international stature", Alexander Vinnik is not really a computer genius. He is as self-taught in programming as in trading. It was one of the axes – chaotic to say the least – of the defense. The man who presents himself as a modest family man, widowed for a year and crippled with debts, deeply religious, living in a small three-room apartment in the suburbs of Moscow, had enlisted the services of no less than three lawyers in France , including Zoé Konstantopoulou, former Syriza MP and President of the Greek Parliament in 2015. It was in Greece that Vinnik was arrested in the summer of 2017, while he was on vacation with his family, before being extradited in France at the beginning of this year. During his arrest, the smartphone was seized, linking the accused to the ransoms of Locky, and his computer, containing in particular several complex montages of front companies. Either indirect evidence, according to his defense, for which their client could very well have been trapped. His lawyers are also planning to appeal to contest the money laundering charge, suggesting half-worded that the evidence on their client's equipment was planted by the FBI.

Because, behind Locky, the case becomes even more complicated. American justice accuses him of having laundered 4 billion dollars. In addition, the BTC-e platform is suspected of having strong ties with the Fancy Bear hacker group, those Russians close to the FSB, who are believed to be behind the manipulation operations of the 2016 US presidential campaign, in particular attacks against the Party. democrat. A portion of the funds laundered on the platform would have ended up in Russian domestic intelligence accounts. This may explain why Russia, which accuses Vinnik of a small fraud of less than 10,000 euros, is in turn fighting for his extradition.