Funds from $577M HashFlare crypto Ponzi scheme move for the first time in over three years

A wallet tied to Sergei Potapenko and Ivan Turõgin’s HashFlare fraud has become active for the first time in over three years, adding a wrinkle to prosecutors’ submission of appeals to keep the Estonian nationals behind bars for 10 years. 

Federal prosecutors are attempting to overturn the current “lenient” sentence for the HashFlare fraud case, which was a $577 million crypto mining Ponzi scheme that defrauded 440,000 investors. 

What was HashFlare? 

HashFlare was a cloud mining platform launched in 2015 that sold contracts and promised customers a share of profits from cryptocurrency mining. Between 2015 and 2019, HashFlare collected more than $577 million from roughly 440,000 investors around the world. 

The problem was that HashFlare did not have the computing power to keep up. Court filings reveal that the operation ran at about 1% of the Bitcoin mining capacity it claimed. Instead of mining crypto, the company showed customers fake online dashboards with made-up performance data that falsely reported mining activity and returns. 

When investors asked to withdraw their money, the founders bought Bitcoin on exchanges to pay them, making the operation a classic Ponzi scheme. 

The founders, Sergei Potapenko and Ivan Turõgin, used investor funds to buy real estate, luxury cars, expensive jewelry, and chartered private jet trips. Acting U.S. Attorney Teal Luthy Miller called it “a mirage of cryptocurrency mining.”

The pair also raised at least $25 million through another venture called Polybius, pitched as a blockchain-based bank. No bank was ever created, and no dividends were paid.

Fraud fund movement 

Now, a cryptocurrency wallet connected to the HashFlare investment fraud has moved 10,600 ETH, worth about $18.5 million, after being inactive for roughly 3.5 years. The transfer was flagged by on-chain investigator ZachXBT, with security firm Cyvers helping to identify the activity. 

The funds were sent to two recipient addresses and then began moving through instant exchange platforms called HiFiSwap and Near Intents. Investigators say the entity started converting the funds from Ethereum to Bitcoin. 

The specific address linked to the movement was identified as 0xff575a22975cc413771825eb84c163189a4d5d22, with 0xd0eafd5c03b24c2f54c579745cacbffe4c6df2d19973e55d52a5f40aa1d89e0 being the transaction hash. 

Prosecutors fight to overturn underwhelming sentence

Both men pleaded guilty in February 2025 to conspiracy to commit wire fraud and were sentenced by the U.S. District Judge Robert S. Lasnik to 16 months in prison, which they had already served in custody. 

Each of them was ordered to pay a $25,000 fine, complete 360 hours of community service, and serve three years of supervised release back in Estonia. Prosecutors had asked for 10-year prison terms. 

Judge Lasnik called it a “difficult sentencing” due to his concern about treaty transfer logistics. He warned that without an approved transfer to Estonia, the defendants would face a harsher prison term than comparable American white-collar offenders, followed by indefinite immigration detention before deportation.

Federal prosecutors filed a notice of appeal in late August 2025, challenging the sentence as too lenient. 

Legal experts are split on whether the appeal will succeed because the Ninth Circuit typically defers to district judges unless a sentence falls outside reasonable bounds. However, experts also warn that light sentences for large-scale fraud could undermine deterrence against future crypto crimes. 

As of now, both defendants are expected to return to Estonia to serve their supervised release terms. 

Victims are to be fully compensated from the more than $400 million in assets forfeited as part of the plea deal, but the DOJ has not yet announced a timeline for distributing the assets.

The smartest crypto minds already read our newsletter. Want in? Join them.