Treasury Sanctions Crypto-Funded Exploit Ring Trading Stolen US Cyber Tools
The U.S. Department of the Treasury announced on Feb. 24 that its Office of Foreign Assets Control (OFAC) designated a Russian exploit broker network under the Protecting American Intellectual Property Act (PAIPA). The action targeted Sergey Sergeyevich Zelenyuk, his company Matrix LLC operating as Operation Zero, and five affiliated individuals and entities.
Treasury described the move as a “first-ever action under the Protecting American Intellectual Property Act.” Secretary of the Treasury Scott Bessent stated:
“If you steal U.S. trade secrets, we will hold you accountable.”
He added: “Treasury will continue to work alongside the rest of the Trump Administration to protect sensitive American intellectual property and safeguard our national security.”
The department detailed: “Among the exploits that Operation Zero acquired were at least eight proprietary cyber tools, which were created for the exclusive use of the U.S. government and select allies and which were stolen from a U.S. company.” Officials also noted: “Williams stole several proprietary cyber tools from the company between 2022 and 2025 and sold them to Operation Zero in exchange for millions of dollars paid in cryptocurrencies.”
The case coincides with a Department of Justice (DOJ) and Federal Bureau of Investigation (FBI) investigation into Australian national Peter Williams, who pleaded guilty on Oct. 29 to two counts of theft of trade secrets.
OFAC imposed the sanctions under Executive Order 13694, as amended by Executive Order 14306, citing cyber-enabled activities that threaten U.S. national security and economic stability. The Department of State simultaneously sanctioned Zelenyuk, Operation Zero, and UAE-based Special Technology Services LLC FZ under PAIPA, marking the first designations under that statute. Additional designees include Marina Evgenyevna Vasanovich, Azizjon Makhmudovich Mamashoyev, Oleg Vyacheslavovich Kucherov, and Advance Security Solutions. As a result, their U.S.-linked assets are blocked, and U.S. persons are generally prohibited from engaging in transactions involving the sanctioned parties, with potential civil or criminal penalties for violations.
FAQ 🧭
- Why did Treasury sanction Operation Zero and its affiliates?
They were accused of acquiring and trafficking stolen U.S. government cyber tools, threatening national security and economic stability. - How do the sanctions affect U.S. investors and companies?
U.S. persons are generally prohibited from transacting with the designated parties, with assets subject to blocking and penalties for violations. - What role did cryptocurrencies play in the case?
Authorities said stolen cyber tools were sold to Operation Zero for millions of dollars paid in cryptocurrencies. - Why is this action significant under PAIPA?
It marks the first designations under the Protecting American Intellectual Property Act.
