Narcotics Cartel Under the SBU’s Roof, Tribute from Call Centers, and Fake Euros: How a Criminal Empire Operated with Law Enforcement

4 November 2026, NABU and SAP released the second part of an investigation into corruption within the security forces as part of Operation “Carthage.” Everything presented is the investigators’ version and the content of audio recordings published by the anti-corruption agencies. The pretrial investigation is ongoing. This story is not about “a few bad people.”

The video describes the economics of corruption: a price list, regular payments, address accounting, a single wallet, and a mechanism for returning seized items through the courts. It is the regularity and the system that distinguish it from isolated bribes.

A story that begins not with money but with friendship

The first part of “Carthage,” in September, was about an official in the Office of the Prosecutor General who received money to cover up fraudulent call centers. The new series shows that call centers were only one branch of a much broader system. The investigation describes it as a criminal organization involving drug business, counterfeit money, commissioned beatings, and abductions. A lot of people in uniform held it all together. The video says plainly about them: these are the people who made it all possible.

The central figure on the recordings is nicknamed Criminal. The investigation calls him the founder and leader of the organization. He is a person with a criminal past: convicted three times, including for robbery, unlawful seizure of a vehicle, and hooliganism.

He came to the anti-corruption agents’ attention as early as 2022, when, according to the investigation, he demanded a million dollars on behalf of the SBU to avoid extraditing a particular person. Despite his convictions, Criminal maintained close ties with law enforcement officers who, like him, came from the Zhytomyr region. Those friendly connections, including with high-ranking SBU officials, became his main capital.

The second key participant is known as the Mexican. He is, according to the investigation, the founder and leader of the transnational drug cartel “Khimprom,” a Russian citizen who fled to Ukraine after being declared wanted in 2016. Since 2019 he has been sought in Ukraine as well.

This did not prevent him not only from remaining at large but also from expanding his business. After the full-scale invasion began, the cartel did not scale back its activities; on the contrary, it strengthened its influence in Ukraine and abroad. To operate safely, the Mexican needed protection, and he enlisted Criminal. The arrangement was mutually beneficial: the Mexican provided money and business, Criminal provided a roof.

Interestingly, according to the investigation, the Mexican maintained contacts with representatives of the Russian FSB, and all this happened during the full-scale war. In one recorded conversation he mentions having to work with Russian “faces.” Members of the organization took great pains to conceal themselves: they constantly changed phone numbers, and gave new messenger accounts telling names that clearly reflected their attitude to money and security.

Criminal had two enforcers for the “dirty work,” nicknamed Pasha and Boxer. Price and Consultant, two police officers, were responsible for cover from the National Police. Price, according to the investigation, was one of the heads of the Department of Strategic Investigations, and Consultant served as deputy head of the criminal investigation department of Kyiv region. From the SBU the organization worked with Akim, a major general who provided protection from colleagues’ scrutiny. Many Ukrainian media, citing sources, identify him as Serhii Duka, first deputy head of the SBU’s Department for the Protection of National Statehood. Officially, NABU names only the nickname in the video.

Call centers and the subscription to impunity

Ukrainian call centers have long been known worldwide. Initially a local joke about Dnipro offices, with the start of the large-scale war they turned into an industry that robs people in Ukraine, the EU, and beyond. The investigation established that the organization coordinated at least 52 call centers employing about 2 700 people.

The protection scheme was organized with accounting precision. Each call center paid 7 thousand dollars per month. At the start of the month Criminal provided the office addresses with their identifiers, and by the fifth the money arrived in cryptocurrency to a wallet previously provided by law enforcement. After that the office could operate the whole month without the risk of raids. Payments were made separately to representatives of the SBU, National Police, and Office of the Prosecutor General, because all three structures posed a threat to the call centers. The addresses of those who paid tribute were recorded in a single centralized registry. This allowed control of the system and, importantly, prevented “unauthorized actions” by individual law enforcement officers at any level.

A telling episode involves a raid. According to the investigation, at least from January to July 2026, Price received money to overlook specific call centers. But once the criminals gave the wrong address, and the office was raided even though the payment was supposed to ensure security. In a conversation Criminal nervously asks Price whether the matter can be resolved peacefully, since seizure of equipment halts the entire business. Price orders the requirement to be lifted, but the problem remains.

Then a scheme unfolds for returning property through the courts. Price, according to the investigation, provided contact information for an investigator who would prepare a letter refusing to return the equipment, because such a refusal was needed to file a complaint to the court. Price also advised filing several identical complaints to the Pechersky District Court of Kyiv so that automated case assignment would route it to the desired judge. He then asked whether participants were ready to pay judges for issuing the “correct” decision. Criminal agreed. Ultimately the property was returned, and the funds for the “service” were transferred to the crypto wallet specified by Price.

At the end of July 2026, when the president ordered an intensified fight against call centers and the Office of the Prosecutor General held a corresponding meeting, Price and Akim told Criminal that the call centers must be temporarily shut down and conspiracy tightened. Akim advised hiding in safe apartments. Clients received a message stating that from 1 August “working interaction” was suspended, operations were advised to be wound down, and chats deleted. At the same time it warned: if anyone made information about the cooperation public or passed it to law enforcement, they would be considered a personal enemy. Other conversations in the video show that the participants treated this condescendingly: they joked that the “stories” about their power would continue, and believed that these people would remain in office from half a year to two years.

U420 – a legal form, criminal content

The scandalous U420 chain of stores appears in this investigation as another of the Mexican’s businesses, in which Criminal had a stake and from which he received a monthly percentage of turnover. The essence of the business, according to the investigation, was selling a solution containing a banned substance. To circumvent the ban on distributing cannabis, it was mixed with other components in a formula that formally did not fall under the prohibition under Ukrainian law.

The weak point of this scheme is obvious: if the composition of the solution is declared prohibited, the recipe must be changed and existing stock destroyed. Therefore the Mexican asks Criminal to find a way to bribe a minister. On the recordings the participants discuss their revenues, and they are striking: turnover measured in millions per day, with the prospect of reaching even higher numbers by summer. In the conversations they want various ministers, including the ministers of internal affairs or health, not to interfere with the ban. They express willingness to give a certain sum to the person they call “K,” and a separate sum to the person who will go talk to them.

They also discuss an offer from other unidentified persons: let them into “partner” points and, in addition, “crush” competitors, supposedly in exchange for a share. The video notes that the plan to bribe officials was not implemented, in part because of the investigative journalism of Bihus.Info, the preparation for which the suspects learned about in advance.

The reaction to this investigation is the most disturbing part of the whole story. At first the suspects discuss whether to pay, then calculate who could influence the journalists, and finally talk about violence. In one recording there is a proposal to pour acid on Denys Bihus’s face to make him “unpresentable.”

A second option: lure him abroad under the pretext of a fake exhibition in the Dominican Republic, Mexico, or Cambodia. Participants consider in which of the countries it would be easier to “close” him. They simultaneously discuss a veteran who had been in captivity and persistently protested near U420 stores, as well as blogger Ihor Lachenko and the outlet ProKyiv. The discussion is almost businesslike: what will be less resonant, hammers or acid, and which law enforcement officers “handle” the activists.

Subsequent events vividly demonstrate the level of inside information. From law enforcement the criminals learned about planned high-profile raids in advance. One interlocutor reports that the minister convened a meeting and ordered to “create a picture for Bihus, for society, for journalists,” so the raids would affect a minimal amount of goods and “the guys were warned.” To avoid real suspicion, participants were even willing to offer two million dollars to remove someone from office.

There is also a political angle. Among ways to safeguard their business they considered drafting and lobbying bills that would fully legalize marijuana in Ukraine, and even planned meetings on this matter.

Fake euros and the violence they “covered”

This episode concerns criminal trade in its most literal sense. Detectives established that during 2026 the organization set up production of counterfeit euros. In a secret location they equipped a workshop with special printing equipment and holographic plates. The counterfeits were produced with imitation security features, making them hard to distinguish from real banknotes. On the recordings participants discuss colors, ink formulas, test sheets, cutting quality, and denominations up to five hundred euros. The main actors in this area were Criminal, Pasha, and Consultant, an active police officer. NABU does not disclose technical production details, and they are unnecessary for this report.

The most harrowing part of the video concerns crimes against life and health. The investigation established participants’ involvement in commissioned torture, abductions, and extortion of millions of dollars in basements. They used law enforcement cover: obtained data from databases, access to “Safe City” cameras, and information about raids.

The most detailed episode shown occurred in July 2026. Near the exit of a sports club in central Kyiv a man was attacked by three masked individuals in tactical clothing. Two held him down so he could not resist, while the third struck him with a pre-prepared metal pipe. Weeks earlier the suspects, with help from law enforcement, collected information about the victim and planned the attack location. Criminal’s phone contained a profile of the potential victim. During preparation Criminal repeatedly received photos of the car and the person from surveillance cameras, with access opened from the account of an employee of the SBU’s Department for the Protection of National Statehood. On the day of the attack Criminal told the performers that the victim would soon leave the club.

After the attack Boxer reported that “everything was done.” A few hours later Consultant, an active police officer, pointed out flaws in the operation and reassured the client: there was no interception plan, the perpetrators were evacuated to the region. The next day he reported how the investigation was progressing, writing that he was “carefully confusing the trail,” and the case was qualified only as hooliganism. This was not an isolated story.

Pasha and Boxer had already appeared in another case about the abduction of a coal industry businessman who, according to the investigation, was held in a basement and had 5 millions of dollars extorted from him. The group carried out similar orders even abroad, including in Vienna. In another episode the recordings show participants reporting that eight people were sitting in the office they were about to enter, and then sending video messages about what had been done.

A sense of impunity was fed by a constant leak of official information. As soon as a victim turned to the police, the clients already knew who was investigating the case. There is even an episode from 2025 when Criminal sent Pasha a photo, apparently obtained from a participant at a meeting of European law enforcement officials where he himself was being discussed.

Anatomy of the cover-up

Criminal felt untouchable because he had powerful SBU support. According to the investigation, Akim knew about his activities and helped resolve issues not only within his agency but also in the Office of the Prosecutor General. People who protect you have many tools, and the video lays them out clearly: assistance with obtaining an exemption from military service, getting vehicle passes, a driver and security guard with SBU credentials, even a knife as a gift as a sign of favor.

Through those connections Criminal obtained database information about people, including those who were tortured, and extracts from criminal proceedings. He turned to SBU representatives for help in court cases and in lifting seizures. Criminal sent Akim a copy of an order to form a group of prosecutors in the U420 stores case, asked to be introduced to the new head of the Department of Strategic Investigations of the National Police, and received notifications about personnel appointments. He also received from Akim information about a meeting that took place on 28 May 2026 with the minister of internal affairs and the head of the National Police, and on the day SBU conducted raids in police directorates in Ivano-Frankivsk, Ternopil, and Zhytomyr regions, Akim supposedly explained that he was “dealing” with the “slippery.” 23 July 2026 Criminal, with Akim’s assistance, visited the central SBU headquarters building.

The investigation emphasizes: SBU employees knew that Criminal was close to the Mexican, and by helping him they helped the Mexican. They were paid regularly. The recordings discuss transfers in tens and hundreds of thousands, and over the period from 16 October 2025 to 25 April 2026, to just one crypto wallet specified by Criminal, 3 million 750 thousand USDT were received. In addition to paid services there were “free” ones: one interlocutor says that when real competitors were visited by other chekists, SBU officials simply told them not to interfere.

The organization’s members understood they could be exposed at any moment, so they prepared contingencies. One even threatened to publish sensitive information about illegal activities of law enforcement. On the recording he contemptuously names corrupt officials and explains that this is why he “insured” himself: materials on high-ranking officials, he says, were his guarantee of safety.

The video at the end of this section asks a straightforward question the authors do not answer. Most economic crimes do not fall under NABU’s jurisdiction; they should have been detected and investigated by other law enforcement bodies. Yet the activities continued for years. Why were they not stopped earlier? This question, the authors say, remains open.

An attack on NABU’s independence

The finale of the video brings us back to where it essentially started: to Criminal’s friends in the SBU. The investigation claims that among them were high-ranking officials involved in an attempt to strip NABU and SAP of their independence in the summer of 2025. It seemed that agreements with representatives of various law enforcement structures were working, but NABU and SAP remained outside them.

The final episode illustrates how this system worked against those who could destroy it. In a recording a participant describes knowing about falsification of evidence in a case against NABU employees: he says that through the FSB a phone was pumped for a case related to Uzbekistan and Dagestan, and they even asked to find a person to send to Dagestan. He is ready to testify to NABU. Learning that someone involved in this story decided to turn to the anti-corruption bureau, the organization’s members took measures to stop him. One says he will “shut his mouth” before he is taken from there. Criminal forwards this message to Akim, a high-ranking SBU official, to warn him and coordinate countermeasures.

This segment best explains why the series caused such resonance. According to the investigation, the state did not merely ignore crimes: its security structures collected money for silence and worked against those who could expose them, while the bureau and prosecutor’s office tasked with uncovering such schemes became targets.

The video leaves the question unanswered: why did all this go on for years? The answer will be sought not only by the courts but also by society itself when assessing whether institutions are prepared for self-cleaning. The authorities have already reacted: the SBU announced the dismissal of high-ranking officials mentioned in the investigation. But the final word will be spoken only by the trial.