U.S. Treasury Sanctions Operation Zero for Trafficking Stolen Cyber Tools Purchased With Cryptocurrency

The U.S. Treasury Department has imposed sanctions on Russian company Operation Zero and its alleged operator, Sergey Sergeyevich Zelenyuk, accusing them of purchasing stolen cyber tools with millions of dollars in cryptocurrency and reselling them to malicious actors. According to the Treasury’s Office of Foreign Assets Control (OFAC), the software in question was originally developed for the exclusive use of the U.S. government and select allied nations.

Officials say the sensitive national security tools were stolen by Australian national Peter Williams, a former employee of the defense contractor that created the software. Williams pleaded guilty last year to selling trade secrets related to the government-developed cybersecurity technology. Authorities allege that Operation Zero later acquired the stolen tools through cryptocurrency transactions and offered them for resale, potentially enabling the exploitation of critical software vulnerabilities.

Treasury Secretary Scott Bessent stated that the department will continue working with the broader administration to protect American intellectual property and defend U.S. national security interests. The sanctions mark the first designations under the Protecting American Intellectual Property Act, signaling a stronger federal response to cybercrime and the illicit trade of sensitive technologies.

As a result of the sanctions, U.S. individuals and businesses are prohibited from engaging in transactions with Zelenyuk, Operation Zero, or entities connected to them. OFAC also warned that secondary sanctions could apply to parties facilitating dealings with the sanctioned individuals.

The Treasury Department further alleged that Operation Zero used social media platforms to recruit hackers and cultivate relationships with foreign intelligence agencies. While officials confirmed that cryptocurrency was used in the transactions, no specific wallet addresses were publicly blacklisted.

The move underscores growing concerns about cryptocurrency’s role in cybercrime, intellectual property theft, and the global market for stolen hacking tools.