Narcotrafficking cartel under SBU cover, levies from call centers and counterfeit euros: how a criminal empire operated in collusion with law enforcement

4 November 2026, the NABU and SAP published the second part of an investigation into corruption within security forces as part of Operation “Carthage.” Everything presented is the investigation’s version and the content of audio recordings released by the anti-corruption agencies. The pretrial investigation is ongoing. This story is not about “a few bad people.”

The video describes the economics of corruption: a price list, regular payments, address records, a single wallet, a mechanism for returning seized property through the courts. It is the regularity and system that distinguish it from isolated bribes.

A story that begins not with money, but with friendship

The first part of “Carthage,” published in September, concerned an official from the Prosecutor General’s Office who received money to cover for fraudulent call centers. The new series shows that call centers were only one branch of a much broader system. The investigation describes it as a criminal organization that included drug trafficking, counterfeit money, commissioned beatings and kidnappings. A bunch of people in uniform held it all together. In the video they are described simply: they are the ones who made everything possible.

The central figure on the recordings has the nickname Criminal. The investigation names him the founder and leader of the organization. He is a person with a criminal past: convicted three times, including for robbery, unlawful seizure of a vehicle and hooliganism.

He came to the attention of anti-corruption officers as early as 2022, when, according to the investigation, he extorted a million dollars on behalf of the SBU to avoid the extradition of a certain person. Despite his convictions, Criminal maintained close ties with law enforcement officers who, like him, are from Zhytomyr region. Those friendly ties, including with senior SBU officials, became his main capital.

The second key participant is known as the Mexican. He is, according to the investigation, the founder and head of the transnational drug cartel “Khimprom,” a Russian citizen who fled to Ukraine after being declared wanted in 2016. Since 2019 he has also been wanted in Ukraine.

That did not prevent him not only from remaining at large but also from expanding his business. After the start of the full-scale invasion the cartel did not curtail operations; on the contrary, it strengthened its influence in Ukraine and abroad. To operate safely, the Mexican needed protection, and he enlisted Criminal. The arrangement was mutually beneficial: the Mexican provided money and business, Criminal provided cover.

Interestingly, according to the investigation, the Mexican maintained contacts with representatives of the Russian FSB, and all this took place during the full-scale war. In one recorded conversation he mentions having to work with Russian “faces.” Organization members carefully concealed themselves: they constantly changed phone numbers, and new messenger accounts were given telling names that reflected their attitude toward money and security.

Criminal had two enforcers for “dirty work” nicknamed Pasha and Boxer. Price and Consultant, two police officers, were responsible for cover from the National Police. According to the investigation, Price was one of the heads of the Strategic Investigations Department, and Consultant served as deputy head of the criminal investigation unit of Kyiv region. From the SBU the organization worked with Akim, a major-general who provided protection from the attention of colleagues. Many Ukrainian media, citing sources, identify him as Serhii Duka, first deputy head of the Department for the Protection of National Statehood of the SBU. Officially, in the video NABU only names the nickname.

Call centers and a subscription to impunity

Ukrainian call centers have long been known worldwide. At first this was a local joke about Dnipro offices, and with the onset of the large-scale war they became an industry that robs people in Ukraine, the EU and beyond. The investigation found that the organization coordinated at least 52 call centers employing about 2 700 people.

The protection scheme was organized with accounting precision. Each call center paid 7 thousand dollars per month. At the start of the month Criminal provided the office addresses with their identifiers, and by the fifth the money arrived in cryptocurrency to a wallet provided in advance by law enforcement. After that the office could operate the whole month without the risk of searches. They paid separately to SBU, National Police and Prosecutor General’s Office representatives because all three structures posed a threat to the call centers. The addresses of those who paid tribute were entered in a single centralized record. This allowed control of the system and, importantly, prevented “unauthorized actions” by individual law enforcement officers at any level.

A striking episode involves a search. According to the investigation, at least from January through July 2026, Price received money to turn a blind eye to specific call centers. But one time the criminals misidentified an address, and a search was conducted at an office even though the payment should have ensured calm. In a conversation Criminal nervously asks Price whether the matter can be resolved properly, since the seizure of equipment stops the whole business. Price orders the demand to be withdrawn, but the problem remains.

A scheme for returning property through the courts then unfolds. According to the investigation, Price gave the contact of an investigator who was to prepare a letter refusing to return the equipment, because such a refusal was needed to file a complaint to the court. Price also advised filing several identical complaints to the Pechersk District Court of Kyiv so that automated case distribution would route it to a particular judge. He then asked whether the participants were ready to pay judges to issue the “right” decision. Criminal agreed. In the end the property was returned, and the funds for the “service” were transferred to the crypto wallet Price provided.

At the end of July 2026, when the president ordered an intensification of the fight against call centers and a corresponding meeting was held at the Prosecutor General’s Office, Price and Akim told Criminal that the call centers should be temporarily stopped and their secrecy increased. Akim advised hiding in safe apartments. Clients received a message saying that starting 1 August “working interaction” would cease, operations should be wound down, and messages deleted. It also warned: if anyone made information about the cooperation public or passed it to law enforcement, they would be considered a personal enemy. Other conversations in the video show that the participants treated this arrogantly: they mocked the “stories” about their own power and believed these people would remain in office from six months to two years.

U420 – a legal form, criminal content

The scandalous U420 chain of stores appears in this investigation as another business of the Mexican, in which Criminal had a share and received a monthly percentage of turnover. The essence of the business, according to the investigation, was selling a solution containing a prohibited substance. To circumvent the ban on distributing cannabis, they mixed it with other components in a formula that formally did not fall under the prohibition of Ukrainian law.

The weak point of this scheme is obvious: if the solution’s composition is declared prohibited, they would have to change the recipe and destroy existing stocks. So the Mexican asks Criminal to find a way to bribe a minister. On the recordings the participants discuss their revenues, and they are striking: turnover measured in millions per day, with prospects of reaching even larger figures by summer. In conversations they want various ministers, including the interior or health ministers, not to interfere with a ban. They express readiness to give a certain sum to a person they call “K,” and a separate sum to the person who will go speak with them.

They also discuss a proposal from other unidentified persons: let them into “partner” outlets and, in addition, “crush” competitors, supposedly in exchange for a share. The video notes that the bribery plan was not implemented, partly due to the journalistic investigation by Bihus.Info, of which the figures learned in advance.

The reaction to this investigation is the most alarming part of the whole story. The figures first discuss whether to pay, then calculate who can influence the journalists, and finally talk about violence. In one recording there is a proposal to pour acid on Denys Bihus’s face to make him “unpresentable.”

A second option: lure him abroad under the pretext of a fake exhibition in the Dominican Republic, Mexico or Cambodia. Participants consider in which of those countries it would be easier to “disappear” him. They also discuss a veteran who had been in captivity and persistently protested outside U420 stores, as well as blogger Ihor Lachenko and the outlet ProKyiv. The discussion is almost businesslike: which will be less resonant, hammers or acid, and which law enforcement officers “manage” the activists.

Subsequent events demonstratively show the level of insider information. From law enforcement the criminals learned about high-profile searches in advance. One interlocutor reports that the minister convened a meeting and ordered to “show a picture for Bihus, for society, for journalists,” so searches would touch a minimal amount of goods and “the guys were warned.” To avoid real suspicion, the participants were even prepared to offer two million dollars for the removal of someone from office.

There is a political angle to this part as well. Among the ways to secure their business they considered drafting and lobbying bills that would fully legalize marijuana in Ukraine and even planned meetings on the issue.

Counterfeit euros and violence they “covered”

This episode concerns criminal craft in its most literal sense. Detectives established that during 2026 the organization’s members set up production of counterfeit euros. In a secret location they equipped a workshop with specialized printing equipment and holographic plates. Counterfeits were produced with imitation security features so they would be hard to distinguish from genuine notes. On the recordings participants discuss colors, ink formulas, trial sheets and cutting quality, as well as denominations from the smallest up to five hundred euros. The main actors in this direction were Criminal, Pasha and Consultant, an active police officer. NABU does not disclose technical production details, and they are not needed for this report.

The most harrowing part of the video concerns crimes against life and health. The investigation established the participants’ involvement in commissioned torture, kidnappings and extortion of millions of dollars in basements. They used law enforcement cover: obtaining data from databases, access to “Safe City” cameras and information about searches.

The July 2026 episode is shown in greatest detail. Near the exit of a sports club in central Kyiv a man was attacked by three people in masks and tactical clothing. Two held him down, preventing resistance, while the third beat him with a pre-prepared metal pipe. Several weeks earlier the figures, with the help of law enforcement, collected information about the victim and planned the place of attack. Criminal’s phone contained the potential victim’s profile. During preparation Criminal repeatedly received photos of the car and the person from surveillance cameras, with access opened from the account of an employee of the SBU Department for the Protection of National Statehood. On the day of the attack Criminal informed the perpetrators that the victim would soon leave the hall.

After the attack Boxer reported that “everything’s done.” A few hours later Consultant, an active police officer, pointed out shortcomings in the operation and reassured the client: there is no plan for interception, the perpetrators were evacuated to the region. The next day he reported how the investigation was progressing and wrote that he was “carefully confusing the trail,” and the case was classified only as hooliganism. This was not an isolated story.

Pasha and Boxer already appeared in another case about the abduction of a coal-industry businessman who, according to the investigation, was held in a basement and extorted for 5 million dollars. The group carried out similar commissioned jobs even abroad, including in Vienna. In another episode recordings show participants reporting that eight people were sitting in the office they were about to enter, and then sending video messages about what had been done.

A sense of impunity was fueled by a constant leak of official information. As soon as a victim appealed to the police, the clients already knew who was investigating the case. There is even an episode from 2025 when Criminal sent Pasha a photo, likely obtained from a participant at a meeting of European law enforcement officials where they discussed him.

Anatomy of the cover-up

Criminal himself felt untouchable because he had powerful SBU support. According to the investigation, Akim knew about his activities and helped resolve issues not only within his agency but also in the Prosecutor General’s Office. People who protect you have many instruments, and the video lays them out plainly: assistance with obtaining exemption from military service, securing vehicle passes, a driver and bodyguard with SBU IDs, even a knife as a gift as a sign of favor.

Through connections Criminal received database information about people, including those who had been tortured, and letters from criminal proceedings. SBU representatives were asked for help in court cases and in lifting seizures. Criminal sent Akim a copy of the order creating a group of prosecutors in the U420 stores case, asked to be introduced to the new head of the National Police’s Strategic Investigations Department and received notices about personnel appointments. He also received from Akim information about a meeting that took place 28 May 2026 with the interior minister and the head of the National Police, and on the day SBU conducted searches in police directorates in Ivano-Frankivsk, Ternopil and Zhytomyr regions, Akim allegedly explained that he was “dealing” with the “slippery ones.” 23 July 2026 Criminal, with Akim’s assistance, visited the SBU central apparatus building.

The investigation emphasizes: SBU employees knew that Criminal was close to the Mexican, and by helping him they helped the Mexican. They were paid regularly for this. The recordings discuss transfers in tens and hundreds of thousands, and for the period from 16 October 2025 to 25 April 2026, a single crypto wallet designated by Criminal received 3 million 750 thousand USDT. In addition to paid services there were “free” ones: one interlocutor says that when certain groups of real competitors were visited by other chekists, SBU officials simply told them not to interfere.

Participants in the organization understood they could be exposed at any moment, so they prepared backup options in advance. One even threatened to publish sensitive information about illegal activities of law enforcement. In the recording he contemptuously names corrupt officials and says that is why he “insured himself”: the materials on high-ranking officials, he claims, were his guarantee of safety.

The video at the end of this section asks a straightforward question the authors do not answer. Most economic crimes are not under NABU’s jurisdiction; other law enforcement agencies were supposed to detect and investigate them. But the activity went on for years. Why was it not stopped earlier? That question, the authors say, remains open.

Attack on NABU’s independence

The video’s finale returns us to what it essentially began with: Criminal’s friends in the SBU. The investigation asserts that among them were senior officials involved in an attempt to deprive NABU and SAP of their independence in the summer of 2025. It seemed the agreements with representatives of various law enforcement bodies worked, but NABU and SAP remained outside them.

The final episode illustrates how the system worked against those who could break it. In a recording a participant says he knows about fabricated evidence in the case against NABU employees: in his words, the FSB loaded a phone for a case related to Uzbekistan and Dagestan, and they even asked to find a person to send to Dagestan. He is ready to testify to NABU. Learning that someone involved in this story decided to contact the anti-corruption bureau, the organization’s members took measures to stop him. One says he will “shut his mouth” before he is taken from there. Criminal forwards this message to Akim, a senior SBU official, to warn him and coordinate countermeasures.

This segment best explains why the series made such a resonance. According to the investigation, the state not only ignored crimes: its security forces collected money for silence and worked against those who could expose it, while the bureau and the prosecutor’s office charged with uncovering such schemes became targets.

The video leaves an unanswered question: why did this go on for years? The answer will be sought not only by the court but by society itself when it assesses whether institutions are ready for their own cleansing. The authorities have already reacted: the SBU reported dismissals of senior officials mentioned in the investigation. But only the trial will mark the final point.