Organizations and roles
Last reviewed August 21, 2026
The public record puts 4 organizations on this action. Operational lead: BKA. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.
Why this page names organizations only
Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.
Organizations and roles
| Emblem | Organization | Role | What the record says |
|---|---|---|---|
| Bundeskriminalamt Germany , Germany | Operational lead | Executed the seizure of the German-hosted server infrastructure and cryptocurrency. | |
| Zentralstelle zur Bekämpfung der Internetkriminalität, Generalstaatsanwaltschaft Frankfurt am Main Germany , Germany | Prosecuting | Directed the German investigation and obtained the seizure orders. | |
| United States Department of Justice United States , United States | Charging | Filed the indictment against Dmitry Pavlov. | |
| Office of Foreign Assets Control, United States Department of the Treasury United States , United States | Other | Designated Hydra and Garantex under sanctions on the same date. Recorded as a parallel action, not part of the infrastructure seizure. |
Accountability
Legal authority
German judicial seizure orders; parallel US indictment (Northern District of California)
Oversight
The record assigns prosecuting or judicial roles to ZIT.
Ongoing investigation
Group accounted for: Partial. One alleged server administrator was charged in the US and remains a fugitive. German authorities explicitly confirmed no arrests were made on the action date. The controlling operator group was never identified publicly.
This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.
Last reviewed August 21, 2026