Nexo co-founders and executives charged as an organized crime group in Bulgaria

Kosta Kanchev, Antoni Trenchev,Trayan Nikolov and Kalin Metodiev have been charged

Nexo co-founders and executives charged as an organized crime group in Bulgaria

Charges ignite political firestorm in the country, while the company continues to operate worldwide

Kosta Kanchev, Antoni Trenchev,Trayan Nikolov and Kalin Metodiev have been charged

© nexo.careers


"We continue to sleep peacefully! Nexo to the Moon!", wrote Nexo's customer relations director Mariusz Winiarczyk in the internal chat, hours after the Bulgarian Prosecutor's Office, DANS and the National Investigation Service (NIS) began raiding the crypto company's offices in Sofia, as well as the homes of its founders and directors. Winiarczuk also tells his colleagues how, in his words, DANS and "two girls from the prosecutor's office" asked him "Where are your keyboards?", "what are those buttons on the desks and why is there so much food in the office?" "I thought eventually someone would jump out and say, 'Smile, it's a hidden camera!', he wrote.

However, there is no hidden camera, and when on the following day, four people from the company, including co-owners Antoni Trenchev and Kosta Kanchev, were accused of being an organized criminal group (OCG) operating on the territory of Bulgaria, the UK, Switzerland and the Cayman Islands, the idea of peaceful sleep became an illusion. The charges are for the purpose of money laundering, banking without a license, financial crimes and computer fraud.

From there, the story splits in two. In Bulgaria, where the services of the Nexo platform are not offered, a storm is brewing, mainly a political one, because of the donations of the company's employees to center-right party Democratic Bulgaria.

Outside Bulgaria, however, another storyline is developing. Where Nexo actually operates as a business, the company continues to exist in a parallel reality. The international and crypto media only paid attention to the search of the offices, but after that the topic quickly died, and the accusations regarding an organized crime group did not break through. More attention is being paid to the story that Nexo is suing the Cayman Islands over a denied license as a virtual currency operator.

Nexo itself continues to function. The company's explanation is that the Bulgarian prosecutor's office and the state are corrupt, and the charges are trumped up. And since the first two statements are true, they make the third one seem plausible. In fact, however, these are factors independent of one other - the prosecutor's office can be corrupt and still have legitimate arguments. The accusations and what has been shown by the prosecutor's office so far, together with information from Capital, indicate that the investigation is not a Bulgarian solo action. British and Israeli security services are also involved in the operation.

According to data Nexo publishes daily via accounting firm Armanino, its assets are down about 25% in a week, but only if measured in bitcoins, from 134,000 bitcoins before the stock to 104,000 dollars on Wednesday. However, the outflow appears to have stalled as there was no movement on Tuesday. At the same time, measured in dollars, assets remain almost unchanged - about 2.2 billion dollars. The reason: the prosecutor's action coincided with a spike in cryptocurrency prices, fueled by comforting inflation news.

These numbers show how special Nexo's business really is. Less than a year ago, the company managed $12 billion in assets. Today they are five times less. Even measured in crypto, the crash is significant. No bank could survive such a shock in such a short time, but Nexo does. This somehow undermines another favorite analogy of media outlets close to the prosecution - that Nexo is more or less the same type of pyramid as Ruzha Ignatova's OneCoin. The difference couldn't be more obvious: even after the crackdown by the Bulgarian authorities, customers have access to their crypto-assets, can sell them and get their money back.

Accusations in future uncertain tense

After Ivan Geshev's announcement that the prosecutor's office was "investigating a unique case, not only in Bulgaria, but also on a global scale", the state prosecution announced that "accusations have been brought against four people in the Nexo case".

The names of the four defendants were not announced, but it was hinted several times that they included the company's current co-founders, Antoni Trenchev and Kosta Kanchev. From the statement of the director of the National Investigation Service (NIS) and deputy chief prosecutor Borislav Sarafov, it became clear that all four were banned from leaving Bulgaria, although two were declared wanted, and there are reports that they may not be in the country. According to information from the investigators, their initials are K.K., A.T., T.N. and K.M.

Capital confirmed that in addition to Trenchev and Kanchev, the initials fit two directors in the company - Trayan Nikolov and Kalin Metodiev. Kosta Kanchev is named as the suspected organizer of the possible "criminal group" - according to documents, he is the actual owner of the Bulgarian registered company NDS EOOD in which practically all of the approximately 600 employees of Nexo are employed. After the press conference of the prosecutor's office, it was reported in the media that those named as perpetrators are suspected of money laundering, tax crimes, computer fraud and unlicensed banking. And although there is clarity about the exact persons charged, what exactly it is that they have done is much harder to understand.

According to the prosecutor's office, the alleged organized crime group operated from 2018 until January 12 2023 on the territory of Bulgaria, the United Kingdom of Great Britain and Northern Ireland, Switzerland and the Cayman Islands. Again, according to the prosecutor's office, those named as defendants "joined together in concert and with a selfish goal" - to commit crimes in the country and abroad.

At the moment, however, the only charge is the organization with a purpose to commit certain crimes. This is a specialized criminal branch in its own right and carries a penalty of 3 to 10 years in prison. There is no claim, however, that the crimes (which were the group's target) were committed at this stage. According to unofficial data from the prosecutor's office, there will be no indictment for "at least six months" in the future.

And although the Bulgarian media immediately connected the company with "financing of terrorism", there is no such accusation. The spokesperson of the chief prosecutor, Siika Mileva, said only that "a client who used the Nexo platform has been officially declared a person who financed terrorist acts," Mileva said. The prosecution emphasized that it was working with foreign partner services on the case. According to unofficial information, those are The Israel Money Laundering and Terror Financing Prohibition Authority, as well as the British services.

Meanwhile, the British National Crime Agency (NCA) has confirmed that it is aiding the Bulgarian investigation. With the clarification that they cannot give more details and the dissemination of such can only happen via the Bulgarian authorities, a spokesperson for the NCA commented on an inquiry by Capital: "We work closely with the Bulgarian authorities, including the National Investigation Service (NSI), to fight serious and organized crime. To help with this investigation, we share experiences of how cybercrime groups operate, offer advice and help in using tools and techniques to stop this type of activity. Cybercrime transcends borders, so international cooperation is a must here."

What remains to be answered is whether the aid comes because it was requested by Bulgaria, or the country took over an already started initiative because the accused are Bulgarian citizens and the operational office of the company is located in Sofia.

A business with problems or an OPG with a little bit of business

Current Bulgarian action may be the sharpest against the company yet, but it is certainly not the first trouble for the company. Over the years, Nexo has had many problems in various countries as well as accusations from investors. Some have turned into lawsuits, some haven't, but either way the company name has always been divisive. Some users are not just customers, but outright fans of the company - or "Nexonians," as it calls them. Others believe the company is lying about its fortunes and operating as a bank, stock exchange and hedge fund at the same time. Due to its convoluted structure, operation through multiple companies in different jurisdictions, as well as the lack of consolidated financial statements, it is difficult to assess with certainty anything about its financial health and the sustainability of its business model.

A raid on all Nexo offices and directors' homes was conducted last week
Photographer: Надежда Чипева

What Nexo does

Nexo's main activity is divided into two: the company gives loans and accepts deposits. The loan product works by having the user put in crypto as collateral and withdraw cash against it in hard currency - typically around 50% of the value of the collateral. The loan is paid back with interest. If, while in collateral, the cryptocurrency loses a large percentage of its market price, the user must put in more collateral. However, if the price goes up, the customer may end up making a profit when paying off the loan, even after paying interest.

The deposit product works as customers deposit crypto assets and receive interest while they are locked up. This product is also the main reason Nexo had problems in the US. Some elements of the deposits raise doubts, such as the offered interest of up to 12% for stablecoins, whose value is equal to the dollar, euro or pound. These rates had a somewhat logical explanation in a constantly growing cryptocurrency market, but not in a collapsing market. In addition, Nexo initially advertised its products as interest directly on the dollar for example, but subsequently, to avoid regulatory attention, changed the advertisement to USDx, which is presented as a corporate stablecoin. However, such stablecoins cannot be found listed for trading on crypto exchanges or crypto trackers, and the company declined to answer questions about them, such as which blockchain they are on. According to a former Nexo employee, such stablecoins do not exist, and when a customer deposits dollars, the app says USDx, but in practice there is no digital asset.

Apart from the main product, the company also has an exchange service, which is suspected of extracting income by betting short and long positions against the movement of the cryptocurrency market.

The prosecutor's office is apparently aware, at least to some extent, of even the unofficial allegations against the company. During the press conference the day after the raid, Borislav Sarafov mentioned "suspicions of market manipulation". Such doubts do exist, but they fall in the unregulated crypto space and therefore could not be prosecuted as crimes, much less under Bulgarian law. This seemingly peculiar situation is quite normal for the current stage of development of the crypto market - there, in practice, financial operations are carried out without any rules for government authorities and/or regulators to control. Fast and big profits come with big risks of all kinds, and the history of Nexo (and many of its competitors) is full of proof of that.

However, with the exception of the accusation of carrying out banking activity without a license, the actions of the Bulgarian prosecutor's office do not overlap with what is happening abroad. The most high-profile case against the company was filed by New York prosecutors in September 2022 over the company's deposit product and failure to comply with a work ban from 2021.

As Capital wrote at the time, the more notable aspect of this case was the documents released by the various regulatory bodies - a total of nine states have taken coordinated actions against Nexo. They shed little light on the company's finances and business beyond speculation and advertising campaigns. Most important is the claim by Kentucky regulators, who say that Nexo's corporate cryptocurrency, which is used inside the platform but is also traded on some exchanges, is 95% owned by the company and therefore has a real market capitalization of $0 and not 400 million, as stated. Without them, according to the regulator, Nexo is bankrupt.

Nexo settled with the US authorities just a week after the raid by Bulgarian authorities, accepting to pay 45 million dollars in penalties and leaving the American market. The company says that the settlement is evidence that there is no criminal activity raging, just regulatory hiccups.

The company's eponymous Nexo token is also the subject of another lawsuit by three Irish entrepreneurs who claim their accounts were first frozen and they were then extorted by Nexo to sell their tokens for 40% of their actual value. Their claim, filed in a British court in late 2022 but involving a 2021 case, is for at least $60 million.

These cases are different because they relate to specific transactions and company products. The Bulgarian prosecution, on the other hand, outright states that the co-founders and directors "joined together" to form a criminal operation. One case involves a business that may have broken the law. In the other case, it is a criminal group that also does business on the side.

The Bulgarian accusations are different, which does not automatically mean that they are not valid. Equally valid are the doubts as to whether such an investigation is too tall an order for the Bulgarian prosecutor's office and investigation - both from a legal and a technological point of view. And most of all - whether the underlying motives of the prosecutor's office for the noisy raid are not led by a desire to attack DB and WCC - the two parties that are most actively working for reform in the judicial system and openly seek the resignation of the chief prosecutor Ivan Geshev. Providing a presentation of selected transactions a day after the offices were searched suggests someone else did some of the homework for the prosecutor's office, which says it has only been working on the case since September.

An even more uncertain future

The two narratives will likely also have two different endings. From a business perspective, Nexo's future looks uncertain. The reason is not so much the prosecutorial action in Bulgaria, which so far fails to bring down the company, although it introduced an element of unpredictability and a political angle with unclear effects. According to many crypto market watchers, Nexo's future has been uncertain before, but the OPG allegation adds a whole new element of uncertainty. Last year, when the company's competitors began to go bankrupt one by one, logical questions arose as to whether the same would not happen to the Bulgaria-based company, considering that the business models were practically identical. The data from the Kentucky regulator further reinforced these doubts because two other crypto companies, Celsius and FTX, went bankrupt largely due to the misleading value of their corporate cryptocurrencies.

One missing element along these lines came a week before the raid of the offices in Sofia. After Nexo proposed to acquire peer company Vauld in July, negotiations were to last two months. Instead, they dragged on for almost six months, only for Vauld CEO Darshan Bathija to reject the offer on January 6. The reason: Nexo has not answered the questions about its own finances and specifically the doubts that the Bulgarian company is, in fact, bankrupt.

The pressure on Nexo from a purely business perspective is now twofold. The cryptocurrency market may have rallied over the past week, but few indicators suggest the recovery will be lasting. Still, this jump allowed the company to catch air and remain operational. Of course, the big factor in this case is that the wider crypto sphere stays out of the story of an organized crime group. If Antoni Trenchev and Kosta Kanchev were to find themselves wanted at international level, it would change the entire media landscape outside of Bulgaria.

The Bulgarian angle is a completely different matter because it is political. Until now, Nexo was a company known in Bulgaria mostly for its advertising campaigns. There will now be a temporary committee in parliament dedicated to its case, although the 48th National Assembly is likely to be dissolved very soon. In both the commission and the upcoming election campaign, one can expect that the narrative will not change much - if someone has ever spoken to an accused person, their work is not clean either.

"It's time to change the narrative," wrote Nexo co-founder Antoni Trenchev on January 10th as his new year's resolution. Whatever the future holds for Nexo and the accusation against it, one thing is certain: Trenchev's 2023 resolution has been fulfilled. The narrative has definitely changed.

"We continue to sleep peacefully! Nexo to the Moon!", wrote Nexo's customer relations director Mariusz Winiarczyk in the internal chat, hours after the Bulgarian Prosecutor's Office, DANS and the National Investigation Service (NIS) began raiding the crypto company's offices in Sofia, as well as the homes of its founders and directors. Winiarczuk also tells his colleagues how, in his words, DANS and "two girls from the prosecutor's office" asked him "Where are your keyboards?", "what are those buttons on the desks and why is there so much food in the office?" "I thought eventually someone would jump out and say, 'Smile, it's a hidden camera!', he wrote.

However, there is no hidden camera, and when on the following day, four people from the company, including co-owners Antoni Trenchev and Kosta Kanchev, were accused of being an organized criminal group (OCG) operating on the territory of Bulgaria, the UK, Switzerland and the Cayman Islands, the idea of peaceful sleep became an illusion. The charges are for the purpose of money laundering, banking without a license, financial crimes and computer fraud.

By using this site you agree to the use of cookies to improve the experience, customize content and ads, and analyze traffic. See our cookie policy and privacy policy. OK