Ruja was confident to the point of arrogance in business, but in her personal life she was clueless and wild. “It’s because I’m a Gemini,” she would tell friends when they suggested she be more careful. She should have listened to them.
Ruja had been married to Björn Strehl ever since university. Björn was one of those fortunate people who grow more handsome with age. He had always been tall and striking, but his youthful gaunt had filled out into an attractive feline appearance. His prospects were also improving, and by 2017, he’d carved out a career as a respected real estate lawyer in Frankfurt. Although not a lover of the limelight like his wife, and careful to stay out of OneCoin, Björn enjoyed Ruja’s newfound success and attended the carousel of parties, awards and events if work allowed. When Ruja addressed an audience or conducted an interview, Björn would sometimes be found sitting quietly in a corner, looking on admiringly. “She always has ideas,” he gushed to a Bulgarian lifestyle magazine in a rare interview in 2015. “And she always makes the ideas happen.… It’s really great sharing life with her.”
Ruja didn’t talk publicly about her personal affairs, a habit which probably fanned the many rumors about her love life. But it seems likely that the demands of running an international, multi-billion-dollar company were putting a strain on her relationship with Björn. Then, in the summer of 2017 things would have deteriorated further when Ruja made the mistake of falling in love with the flash Floridian financier Gilbert Armenta. What started as a casual romance in 2015 when Ruja first employed Gilbert to help her process payments via his Georgian bank gradually became something more serious. After spending most of July and August together at Ruja’s Sozopol mansion, the pair started talking seriously about leaving their spouses and moving to London.1
“She was completely obsessed with Gilbert,” a friend said later. But before she flipped her life upside down, Ruja wanted to know that Gilbert was as committed to the relationship as she was. There was something about him that made her uncharacteristically nervous. It wasn’t the first time he was tied up in a risky investment. Years earlier a Caribbean telecoms company called Curanet in which he was the main stakeholder was run into bankruptcy.2 Even as they relaxed in Sozopol, he was trying to lean on a British businessman called Christopher Hamilton who he thought owed him millions of dollars. Ruja sometimes wondered whether Gilbert was only with her for the money. Although Mark Scott was now handling most of her finances, there was still a vast amount of Ruja’s money flowing through Gilbert’s web of companies.
In late August 2017, Ruja turned to the one person she employed who could help her figure this out: former spook Frank Schneider. Frank had been managing Ruja’s reputation and security since mid-2015 and she’d come to trust him. She valued his calm professionalism and measured assessments. According to Konstantin’s later testimomy in court, it was Frank who’d suggested she travel to Bishkek to buy a Kyrgyz diplomatic passport. (Bishkek passports were famous in the private intelligence industry. For only a few thousand dollars, anyone could get a diplomatic Kyrgyz passport and use it to travel to certain places without fear of arrest—especially in and out of Russia. She acquired one that summer, shortly after the christening party.) Who better to look into Gilbert than a former spy? His 30-year career was built on finding out other people’s secrets. Ruja asked Frank to find out whether Gilbert really was going to leave his wife. (In a later response to the BBC’s The Missing Cryptoqueen podcast series, Frank Schneider denied any of the following happened.)i
Despite the technological advances of the last 50 years, the fundamentals of surveillance work haven’t really changed. The best way to spy on someone is the same as it was when Frank joined the Luxembourg intelligence agency SREL in the 1980s: sneak into their home and hide a listening device in the wall or light fitting. Even today, MI5 or the FBI still rely on “close contact surveillance” when they can’t access a suspect’s phone or emails. But it’s not only state spooks who are listening in any more; private companies and wealthy individuals spend billions each year on private intelligence firms who apply similar techniques to gather information on business rivals, critics, journalists and ex-partners. Most cities have at least one “spy shop,” where anyone can buy recording instruments disguised as calculators, outlets, or light bulbs. A decent listening device that can penetrate 12-inch-thick walls only costs around £200. For a former head of ops for SREL, covertly listening to a married couple would be child’s play.
According to later court testimony, on Ruja’s instructions one of Frank’s American contacts rented the apartment below Gilbert’s in Fort Lauderdale, Florida. He drilled a hole through the ceiling and installed a listening device strong enough to pick up Gilbert and his wife’s conversations.
Personal life aside, when Ruja returned to Sofia from Sozopol in late August 2017, she found a mixed picture. On one hand her Fenero laundromat had cleaned €350 million, she had a dozen top-end professionals working for her in London, Dealshaker was ticking over, and she had a new respectable CEO in Pitt Arens.
But she still had no blockchain, and senior promoters were getting anxious messages every day from their downlines who wanted her to publish the whole thing in its entirety rather than the tiny “display” that Bjørn Bjercke had shown was a fake.
MLM companies possess a shark-like quality. They only survive by moving forward. Even a moderately profitable year can be disastrous, because the whole industry is built on promises of “record years” and “exponential growth.” But smoke and mirrors can’t last forever, and, for the first time since mid-2015, OneCoin started to lose its momentum. There wasn’t a single moment of collapse, like when SEC agents burst into Bernie Madoff’s New York apartment with handcuffs, and OneCoin revenue was still tens of millions a month. But the gradual accumulation of broken promises, delays and blockchain rumors was beginning to bite. The online buzz was quieter and local recruitment events were a shade less energetic. Critics and regulators were becoming more outspoken. Online seminars—which had been running fully booked for months—were now only 75 percent full. MLM promoters have an acute sense for when a company is on the turn, and some of the top promoters, including Aron Steinkeller, Pehr Karlsson and the New Zealander Ed Ludbrook, started drifting off to newer, fresher projects. In early summer, Juha “Papa OneCoin” Parhiala himself, co-founder in all but name, also quietly departed. Officially it was due to poor health but there were rumors that he’d been spooked by the spate of OneCoin arrests in India. But no one knew for sure because he practically vanished overnight and wouldn’t leave Thailand.
Worse news followed when Ruja quietly dropped her IPO idea. OneCoin wouldn’t be selling shares to the public after all. In keeping with her philosophy of smothering bad news, Ruja promised the network it was because she had a better plan: OneCoin would have an Initial Coin Offering instead. (An ICO is a lot like an IPO, except it’s specifically designed for cash-strapped new cryptocurrency start-ups and has far fewer rules.) Unfortunately it would take a whole extra year.3
Just like with the xcoinx closure months earlier, investors panicked when they heard the news. WhatsApp groups were full of worried coin holders trying to figure out what it all meant. Even Kari Wahlroos—the resplendent hype-guy—seemed unsure. “We as leaders have done everything to provide the correct info,” he wrote on his Facebook page. “Now there is going to be some adjustments… I am deeply sorry.” All anyone ever wanted was to buy coins at one price and sell them again at a profit. But OneCoin, supposedly the “Bitcoin killer” for the masses, had turned into a giant Rube Goldberg machine.
In the pyramid business, products flow down but the money and the questions flow up. With Juha gone, Igor Alberts found himself at the pinnacle—a Black Diamond with a downline of thousands of investors generating over €8 million in sales a month. The chorus of questions was getting louder: When will xcoinx go back online? What’s this new ICO all about? And when can we see the blockchain? The Sapphires would ask the Rubies above them, who would ask the Diamonds above them… until it reached Igor, and the only people above him were Sebastian and Ruja.
When Igor and Ruja met at the Sofia HQ in September 2017, he told her that investors had a lot of questions. She had to tell the network exactly what was going on, especially about the blockchain. And, if possible, get her legal team to deal with Oz and BehindMLM. People were nervous, he said, including him.
“Please,” Igor said. “Show the world that we really have what we promised the people.”
“Yes, Igor, we are going to do it,” Ruja replied. As usual, she seemed confident and in control.
“When?” asked Igor. He was the one who had teams of promoters beneath him asking him constantly for updates.
“Sooner than you think. Everything will be clear at the Lisbon event.”
Lisbon was the next big OneCoin event, two weeks away. All the top leaders would be there, including Ruja herself.
Shortly after Igor left Sofia, Ruja received the recordings of Gilbert and his wife’s, Basia’s, private conversations. Just a few weeks earlier, Gilbert had been in Sozopol with Ruja, lounging by the pool and talking about their future together. But, from the recordings it was clear that Gilbert had little intention of leaving his wife. Ruja was crushed by the betrayal. She imagined Gilbert and Basia laughing at her, using her money to fund his private jet. On September 24, 2017, she phoned him.
“I love that footage where you say you aren’t going to leave your wife…” she said. “Gilbert, what the fuck is wrong with you, really? I never thought you were like a spineless asshole, are you?”
“Well, the big issue right now is—” Gilbert started.
“No need, no need!” Ruja cut back in, regaining her steel. “I know people can be weak… but I don’t deserve this and [Basia] doesn’t deserve this either… there is such a thing as personal integrity. Google it.”
But the recordings revealed something else Ruja hadn’t expected: Gilbert was in trouble with the law. It sounded like the FBI had him on a seemingly unrelated charge of extortion.4 If the FBI was on to Gilbert, how long before they were on to her too? Ruja feared the worst. The FBI would get to work on Gilbert. They’d grill him, shake down his house, clone his laptop, confiscate his phone—they’d turn him inside out and sooner or later they’d find her too.
Since 2014, there had been dozens of investigations into OneCoin, and Ruja never seemed fazed. According to one close associate, “nothing seemed to scare her.” When the UK’s FCA put up its warning notice, she called in Chelgate and Carter-Ruck and faced it down. When the German BaFin froze her money in 2016, her lawyers successfully unfroze it. She laughed off the Indian prosecutor’s indictment. But the FBI was different. Although Ruja had ceased formal promotions in the United States in mid-2015, local promoters had continued selling clandestinely. Christine Grablis, for example, who spent €15,000 in August 2015, carried on attending OneCoin meet-ups and online webinars, and, by 2017, had invested another €100,000. Having worked in banking, Ruja also suspected her Fenero laundromat might pass through the US at some point. When you transfer money between two international banks, sometimes they don’t have a direct relationship with each other. But they might both have a relationship with a large third bank, such as HSBC or the Bank of New York Mellon. In those cases, money will transfer via that bank-in-common, which is known as the “correspondent bank.” All it takes is for a single stolen dollar to pass through an American correspondent bank account and the FBI can lock on to you. Even her Bulgarian connections couldn’t protect her from them.
For the first time since she founded OneCoin, Ruja started to panic. A couple of days after their first phone call on September 28, Gilbert phoned her on a non-encrypted line. This time she wasn’t upset—she was furious. She’d told him several times to only communicate face-to-face. “Gilbert, you have to be fucking careful!” she shouted. “I can get everything I want with twenty-four hours and if I can they can too. I’m really worried—you have to be really careful with communications.”
But Gilbert was in far more trouble than Ruja realized.
Back in 2015, when OneCoin money first started flowing into his various bank accounts, Gilbert’s job was to move it from his accounts in Dubai or Singapore to his JSC Bank in Tbilisi, from where he processed the weekly commission payments for promoters. But he invested some of it too. One of the companies he invested in was a UK firm called “Viola,” run by a British businessman called Christopher Hamilton, which specialized in online payments. In November 2015, Gilbert invested $19 million in Viola. “He was a likeable chap,” Hamilton recalls, although adds he never mentioned OneCoin or Ruja. As far as he was concerned, Gilbert was an investment manager, and this was simply an investment.
According to Hamilton, a few months later, Gilbert sent Viola’s Luxembourg investment fund another large chunk of money to invest in renewable energy firms. But some of it came from a company account that Hamilton didn’t recognize. He called Armenta and demanded further information about where this money had come from—but within 24 hours Viola’s bank, HSBC, froze his account. Presumably HSBC filed a “suspicious activity report” to the UK authorities, and pretty soon the City of London police launched an investigation into Christopher Hamilton and contacted their counterparts in America responsible for white collar crime. From that point on—around February 2016—the Manhattan District Attorney’s Office had Gilbert on their radar.5
On April 21, 2016, Hamilton was sitting at his home in south Wales and heard a knock on the door. A postman delivered $30 million in banker drafts from HSBC—the money that had been frozen. Moments later a dozen officers from the City of London police turned up, seized the drafts, searched the house, arrested Hamilton and took him in for questioning. According to Hamilton he was quizzed for several hours—including about Dr. Ruja Ignatova and OneCoin. “It was the first time I ever heard of OneCoin,” Hamilton said later. It was the largest ever money seizure by the UK police, although OneCoin was omitted from the police press release—it referred instead to “overseas crime, including Ponzi schemes.”6 Shortly afterward, however, a judge at Hammersmith court ordered the money be returned to Hamilton. (It’s not entirely clear why—magistrates courts do not keep written records; Hamilton only recalls the judge had ruled the seizure as “unlawful.” Perhaps it was a technicality, or maybe the judge simply decided there was insufficient evidence of any wrongdoing on Hamilton’s part. Hamilton was never charged with any crime, and the police subsequently discontinued their investigation.) Either way, the police press release was removed from the City of London’s website.
But that wasn’t the end of the story as far as the US authorities were concerned. The Manhattan District Attorney’s Office started investigating Gilbert Armenta.
By sheer coincidence, a few months later, a compliance officer at the Bank of New York Mellon identified several large and concerning transactions that involved multiple Fenero Fund entities and a company called “International Marketing Services Pte Ltd,” or IMS, that were transferring funds via some of its correspondent banks. Another Bank of New York Mellon employee from the “suspicious activity response team” researched the company and found several articles, including on BehindMLM, that tied IMS to OneCoin.7 In December 2016, and then again in February 2017, the Bank of New York Mellon reported these “concerning” wire transfers—including the $30 million involving the Madagascar oil field deal—to the Financial Crimes Enforcement Network at the US Treasury Department.8 Although the inner workings of law enforcement are mysterious, it seems likely that this is what prompted a second investigation into OneCoin and Fenero, this one led by the US Attorney’s Office.
At some point, the US Attorney’s Office and the Manhattan District Attorney’s Office realized they were working on the same case and decided to pool their resources and make it a federal investigation. The IMS transfers, the Madagascar oil field, the suspicious millions sent to Christopher Hamilton—it was all connected to the same woman: Ruja Ignatova.9
But it was Gilbert’s behavior with Christopher Hamilton that got him. According to Hamilton, once the UK judge ordered the money be unfrozen, Gilbert demanded that he send it back to one of his banks in Belize or Georgia. Hamilton—and his lawyers—would only send it back to the United States, to an account under the name of either Zala or Fates. The standoff went on for several weeks. To move things along, in around August 2017, Gilbert hired a former army marine to follow Christopher around and send intimidating messages about the debt—including photos of his grandchildren leaving school.10 In the end, Gilbert agreed to have his money sent back to the US after all, which Hamilton did. But by then it was too late. The FBI had got wind of this behavior and started preparing charges against him.
On September 12, 2017, a New York grand jury indicted Gilbert on three counts of extortion.11 Just a couple of days later, Gilbert was arrested as he disembarked a flight in Connecticut, and immediately agreed to cooperate. The first person he told them about was Ruja Ignatova.
As Ruja lectured Gilbert about the importance of good security in their phone call on September 28, Special Agent Ron Shimko of the FBI was sitting right next to him, recording every word.
i Details about Frank’s role in spying on Gilbert are based on Konstantin Ignatov’s later testimony under oath in a US criminal case.