
In this special edition of the “Smashing Security” podcast, cybersecurity veterans Graham Cluley and Carole Theriault welcome back author and journalist Jamie Bartlett – host of “The Missing CryptoQueen” podcast.
Jamie tells us about his new book, which shares more details about the disappearance of cryptocurrency scammer Dr Ruja Ignatova, and the subsequent hunt by law enforcement.
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
I'm not Graham Cluley, but Carole Theriault.
And I'm so glad we were able to finally get you on the show, Jamie.
And as Carole says, coming up this week, we're not having the usual shenanigans. It's going to be a little bit different.
Instead, we're going to speak to Jamie about the podcast, about the great book, about the latest developments in the hunt for the missing crypto queen.
I did one back in 2014 about the darknet, which was all new and exciting back then.
So I suppose I've always written about, accidentally really, written about weird things on the internet and sort of criminal behavior on the internet.
And well, this one might be the biggest one of all.
As they say, everyone who owned bitcoin in 2014 would've either sold it or lost it by now anyway. So 2014 is the year and bitcoin's just about breaking into the mainstream.
You've had the Cyprus banking haircut. Bitcoin is $500. Dr.
Ruja Ignatova, an unknown but brilliant Bulgarian-German businesswoman, turns up out of nowhere and basically says, "You guys have all missed bitcoin.
It's the future, but it's too late for you. It's too expensive. But the good news is I've created a better one, a newer one, an easier one that's designed for the masses.
Bitcoin is really for technical geeks and nerds." It's all complicated to use. But mine, OneCoin, is simple. It's usable. It's user-friendly. It's designed for the man on the street.
And it's very cheap at the moment. So get in early and it'll change your life.
And within 18 months, we're talking about something like a million people had invested well over a billion euros. It would end up being close to 4 billion euros. In this new bitcoin.
And they would have the OneCoin in their wallets on a website.
They would watch the price go up and up and up, talk excitedly about what color Bentleys they were going to buy when they finally sold those OneCoin back into real money.
And then Dr. Ruja Ignatova boards a Ryanair flight from Sofia, Bulgaria to Athens, Greece and is never seen again.
There's no real technology behind it. The price is completely fabricated. You can't turn it back into real money. The maths don't work. Dr.
Ruja Ignatova doesn't know anything about technology anyway." So there were warning signs. There were certainly warning signs.
But obviously, her disappearing act was the biggest warning sign of all. She disappears.
At the beginning, people think she's off on a maternity break, or she's going on holiday, or she'll be back in a month.
Because, you know, the crypto world is full of eccentric characters.
One of the unusual things about OneCoin, as I remember, was that it was a pyramid scheme.
It wasn't just a case of investing in OneCoin, it was recruit other people to invest in OneCoin as well.
So although the book and podcast is called The Missing Crypto Queen, I suppose it should be called The Missing Multi-Level Marketing Queen, but it wouldn't have the same ring about it because that's really what it was.
It was a multi-level marketing scam. You remember Avon and Tupperware and Amway and— Oh yeah, my mom was a— my mom did a bit of Avon selling, so I remember it really clearly.
You'd buy some perfume, then you'd get your friends around, sell them some perfume, and get a 10% commission.
And then you try to get those people that had bought the perfume to sell perfume themselves to their friends and family, and you'd get a commission of all the sales from the people you'd recruited.
So the whole thing grows very quickly, like a grand pyramid. The thing is, that is a legitimate but controversial business model, this MLM.
As long as you've got a real product and you're selling it to real people and that's how you're making your money, it's above the law. But she was selling really thin air.
People were only making money from the commissions of the people they were recruiting. They weren't really buying anything.
Do you think that initially, her and her colleagues were thinking, well, we will build some cryptocurrency infrastructure, but it's just more exciting to begin with the marketing of it and the promotion of it.
And we'll introduce that bit later.
Like, we'll raise a load of money from people, we'll bring all the money in, we'll build some sort of crappy bitcoin fork.
Yeah, we'll promote it to the moon, we'll pretend it's amazing, and it will probably collapse, but by which point we'll be able to put it down as an honest failure.
But who knows, maybe it could turn into something good.
Well, I don't think they ever intended it to be a multi-billion-dollar, one-million-person— I think they thought it was— in 2017, but also when they started in 2014, there were a lot of initial coin offerings where companies would— crypto companies would turn up, say, we're going to revolutionize web storage using blockchain.
They'd raise loads of money. It would collapse. And they'd say it was an honest failure. Maybe we did promise a bit too much, but this is a risky business. It's speculative investment.
And I wonder whether she thought that is how they'd get away with it. It would be that.
It would be put down as a €5, €10 million honest mistake, and she'd disappear, and no one would notice.
But what happened was I think they did originally have a bitcoin fork, a kind of copy of the bitcoin blockchain.
And it was generating coins at sort of 10,000 coins per every 10 minutes. She was selling a million coins a day because it had grown so quickly.
So she was selling coins that didn't exist on this blockchain she had. And because of the multi-level marketing, it wasn't bought and sold through an exchange site.
It was sold in these weird packages that you'd sell to your friends and family.
So she started off selling real, quote unquote, real coins, but very soon she was selling completely fake coins. And by which point it was too late to turn the ship around.
Does that make sense? Yeah, yeah.
But if you're selling something like, you know, coins that you— that people don't even know how to go check, you know, and go do any due diligence on—
It was just a number on a screen to them.
Now, they did have for a short period, and actually, as I've gone into the book, there's a lot more nuance in the story.
They called it an independent boutique exchange site where some users could exchange some coins for real money. Never more than a tiny fraction of what they held.
But that was like a Ponzi payout, really. It was just to essentially convince people, right, that this was real.
It was a very clever, clever sort of piece of— clever piece of business, I suppose.
And I felt like even though the podcast is 9 episodes long, it must run to 6 or 7 hours now, I felt like we're scratching the surface so much of it.
So it felt like there was so much more material.
And then also I thought, if I write a book and I get really into the details of it, I can then use that in future episodes of the podcast.
So it almost becomes one big, you know, the missing crypto queen is a huge story and there's all different formats that you can put it out on.
And then I suppose there's just the old-fashioned business thing, which is the podcast is really popular and they wanted me to write a book. Because that's what's going on now.
That's where stories are breaking on podcasts, and podcasts are really good format, aren't they, to get long-form crime stories out? And so it sort of made sense as well.
No one wants to hear my new stuff, that difficult second album. Yeah, yeah. But the thing is, you probably only get a story like this once in your entire writing life.
So much of your hunting is actually phoning people, looking at marine tracking software, phoning up people trying to persuade you to talk about who they spotted on a flight or not.
And searching for someone who doesn't want to be found is incredibly difficult. We probably weren't really helped by COVID, to be honest, because everything just ground to a halt.
We couldn't go anywhere. We had loads of trips lined up, and all of them got canceled. Who's thinking about the community of people searching for criminals? No one. We've suffered too.
And in fact, she probably better than fine 'cause she could have wandered around in a face mask openly and no one would've noticed.
And I would imagine if you're someone like the missing Crypto Queen who has stolen effectively billions of dollars, you know, I saw one news report where they thought maybe she was the richest criminal who's alive.
I mean, this is a swimming pool, penthouse suite in a really fancy part of Kensington, but it was owned by a Guernsey offshore company that in turn was owned by 3 other Guernsey offshore companies that weirdly we managed to track it all down and work out the sale, and we still don't even know whether for sure she owns it or not, or whether the police have issued some kind of seizure on it.
We don't know. We've been knocking on the door and everything.
I mean, we literally have been out there, but also maybe have more interest in terms of the hunt, because she's not hiding there.
Is a mansion in Dubai that we managed to find simply from one Instagram post that her brother posted.
He posted a selfie and tagged it as Sofia, Bulgaria. It was on his birthday, and it was so obviously not there. It was clearly the Gulf.
There was a mosque minaret in the background and skyscrapers. And it's always been rumored that she might have been hiding out in Dubai and she had a secret property there.
So I sent it to someone that used to work for Bellingcat, and I said, do you reckon you could tell me what city this is in?
And then literally a week later, he sent me back— not only the city, the actual address of the property based on one photo, because he used Google Earth and reverse image searching and geometry and was matching up trees and walls with satellite imagery and found out literally to the meter where that photograph was taken.
People could start matching the trees up with aerial photos and find my address. I'm not even joking, people can do that.
We knew she'd bought it when she bought it, and it tallied up and it was the same price. So we're thinking, that's maybe where she is.
So we actually sent around a Deliveroo driver with some Krispy Kremes while we were on the phone, banging on the door, but no one answered.
Bitwarden is an open-source cross-platform password manager trusted by millions of individuals, teams, and organizations worldwide for secure password storage and sharing.
Not only does Bitwarden offer enterprise-grade security conducting regular third-party security audits, and is compliant with Privacy Shield, HIPAA, GDPR, CCPA, SOC 2, and SOC 3 security standards.
This is pretty slick stuff. You can get started with a free trial of a Teams or Enterprise plan at bitwarden.com/smashing. That's bitwarden.com/smashing.
Or you can try it for free across devices as an individual user. That's bitwarden.com/smashing. And massive thank you to Bitwarden for sponsoring the show.
The Cybersecurity Inside podcast is a fantastic resource for anyone in the business world, whether you're a security expert or not.
It's relevant to anyone really who wants to be informed and stay ahead in this space. Intel's Thom Garrison and Camille Morhardt host the show.
And well, they bring you the most important and timely security topics as well as other industry experts for insightful conversations. So what do you get on this podcast?
Well, Cybersecurity Inside breaks down complicated tech talk into plain English, helps listeners keep up to speed on topics like cybernetics, intelligence systems, NFTs, federated learning, all in ways that we can all understand.
So make sure to add Cybersecurity Insight to your regular podcast list, find out more, and check out an episode right now at cybersecurityinsight.com/smashing.
That's cybersecurityinsight.com/smashing. And thanks to them for supporting the show.
At G2's highest-rated cloud compliance software, Drata streamlines your SOC 2, your ISO 27001, your PCI DSS, your GDPR, and your HIPAA compliance.
Plus, it provides 24-hour continuous control monitoring so you can focus on scaling securely. Drata is the only compliance automation platform with a private tenant database.
They say it's like having your cake and securing it too.
Countless security professionals from companies including Notion, FullStory, and BambooHR have shared how crucial it is to have Drata as a trusted partner in their compliance process.
Listeners, you can get 10% off Drata and waived implementation fees by visiting smashingsecurity.com/drata. That's D-R-A-T-A. And thanks to Drata for sponsoring the show.
So the FBI, do they acknowledge that you're probably the world's most knowledgeable person when it comes to the Crypto Queen?
English, of course. So they don't even know what I know, and I've never spoken to them. People often say like, oh, if they called you, have you phoned them up?
But for journalists to be in touch with the FBI and sharing information with them isn't, you know, you don't really do that sort of thing. They've never contacted me.
But the weirdest thing is, like, 3 days after my book was published, a big announcement is made. Dr. Ruja Ignatova is added to the FBI's top 10 most wanted fugitives list.
I wonder whether they thought, oh, there's this author, and knowing authors, our job is to get this mugshot and this information about Ruja to as many people as possible.
If we put this out when an author has published a book, he's going to go out there and talk to every media outlet in the world about it. So this is really good timing.
How many OneCoin are they offering as a reward for—
So maybe I'll just scoop the cash when they read the book. But the thing is, I think that number is quite telling.
So Europol put her on their top 10 most wanted list as well, or most wanted criminals list, about 6 weeks ago. And they offered €5,000. Tells you everything.
I think the difference in that number really matters, 'cause I'm going after different people. I think the German authorities were the ones behind the Europol notice.
I think they're after members of the public. They call them super recognisers, ordinary people who might have just spotted her and have an incredible eye and memory for faces.
But the $100,000 from the FBI, I think that's targeted more at, okay, not sort of powerful backers that she might be paying off, but a bodyguard or a driver or a chef or someone who works in a port authority who, for whom it's actually a bit risky.
They might lose their job if they grass her up, but it might actually be worth it.
So I think that to me says they do believe that she is moving around, that she has a small entourage with her of staff, and that's who they're targeting.
Now, both the FBI and Europol have said people— her and people she's with are likely to be armed. So you've got to also be a little bit careful.
That's not out of fear, it's out of a lack of evidence, because it's very hard to sort of journalistically prove person X, Y, or Z, powerful politician A, B, or C, is being paid off by this criminal.
You know, what sort of evidence do you need for that, and who's going to give it to you? It's impossible. But there is, there are some indications.
I mean, the FBI has said that her head of security, they believe, is Bulgaria's most infamous drug trafficker of all time, a guy called Harastaforis Amanatidis Taki, who lives in Dubai, who's Bulgarian Greek and runs smuggling routes.
And you know, this is an extremely serious criminal, so they're the sorts of people we know she's involved in.
And the scariest thing is you start tapping into what you suspect might be money launderer maps.
So you start finding strange companies she owns and that they're connected to other companies, and other criminal groups are using similar companies at similar addresses.
And that's where it gets scary because you don't even really know who you might be dealing with or who you might be exposing and how serious that might be.
There are bits of the story that I think we're still digging away at that potentially are even more sort of scary, if you like, because the money is— when you're talking about multi-billions of dollars, you don't just become a businesswoman and make billions of dollars and just carry on with your life and buy a few nice yachts.
I mean, you've got to start moving serious amounts of money, and that sucks you in to this world of the sort of super rich and organized crime.
And then it gets really dark really quickly.
The reason is we were very worried when we first started the podcast, and we were just— prayed that it would be successful because we just thought that the bigger the story gets, the safer we're going to be, because these people are business people.
They are— they're not stupid, and they won't target you or attack you or anything like that if it doesn't make sense for them from a business perspective.
As soon as the podcast became successful, I actually thought, you know what, I think we're going to be fine because it would be very stupid for anyone to cause us trouble.
But you do get very, very paranoid. And even if you are just paranoid, you think— you think you're being followed. You think people have worked out where you live.
You look at dodgy people turning up outside your house and wonder if they've been sent over by their private investigators going through your bins.
You know, you start to become extremely paranoid. Well, you know all the debates about encryption. Nothing to hide, you know, nothing to hide, nothing to fear, that kind of thing.
That is such a load of rubbish.
I could not have done any of this if I thought we had really weak encryption, because I'm not— because I'm worried about the government, although I am, but I'm worried about the other people that might want to get to me.
And so I was always so grateful to use sort of extremely, extremely powerfully encrypted services, messaging apps and so on.
But the scariest moment, would you believe it, was actually a— was a false alarm. It was the day the podcast came out.
Someone started 3 o'clock in the morning banging on my door and screaming, get the F out of your house, get the F out of your house.
They were like, okay, so what really would you like us to do about it? Yeah, well, not in a mean way, but they just didn't know what I was talking about.
But it was just someone at the wrong address. I'm not exaggerating. That really happened the day it came out.
That was probably the scariest because it— because that's what paranoia does to you.
Because it's very hard to disappear for that long, even with all the money, the plastic surgery, the fake documents. However, two things make me think it's more likely she's alive.
And that is, one, we have received several extremely credible tip-offs, people who have said, looked me in the eye and said, I saw her, it was her, I've looked at the picture, that's her, someone told me it was her, that kind of thing.
And the fact that the FBI and the Europol both put her on the list, I don't think they would if they had reason to believe she was dead.
And if she was dead, I think they would know.
But my best hunch on the available evidence was that she was spending a lot of time on a yacht in the either the Mediterranean or the Black Sea, or somehow moving between them, often staying quite far out in international waters.
So if you're more than 12 nautical miles out at sea, technically you're nowhere really. I mean, no police force has formal legal authority over you.
I mean, they could come and swoop you, but it is actually quite difficult. It's hard to investigate, and the jurisdictional question is quite complicated.
But she would come in periodically and make land.
There are routes that you can take when you come into land from international waters on superyachts. You know, it's a completely different world.
And I've spoken to quite a lot of yacht experts who explain this.
So I know it sounds Hollywood, but that is my, by no means certain, and not even more than 50% sure, but of all the different things that I've heard and seen and the tip-offs I've had, multiple tip-offs from multiple totally independent places have placed her on yachts or at ports, let's say.
So ports and yachts multiple times in the last couple of years. It doesn't mean that's where she always is, but that is one place that she has been.
Because there's a lot of money that people have been scammed out of, a lot of people who obviously couldn't afford it.
And it's so I don't know whether her getting caught will make so much difference to the state of her assets as it stands, because I think a decent number of her assets have been identified.
It is very, very slow and difficult to freeze them, to sort of take control back over them. I mean, who actually will do that?
I suppose the law firms representing a coalition of victims can try, make a case, but then they've got to decide how to redistribute what they get. And on what basis do you do that?
And it's a very, very slow and difficult process.
Her former security head, a man called Frank Schneider, who incredibly— I mean, this story has barely been picked up, but he is a former top, top spy from Luxembourg.
He worked as director of operations, became her head of security, has been indicted by the US, and is now fighting extradition.
I mean, the French authorities have agreed to send him over, but he's fighting it. So we're talking about, talk about who's wrapped up in this.
A former top European spy has been indicted for money laundering, and he said in a recent interview that there's over a billion dollars of her money in accounts around the world.
Wow. So there's— the assets are out there. We're going to slowly start identifying them.
But as for how we actually work out who gets it and how much they get, that's a very long process because the problem here is that many of the victims were also themselves perpetrators.
That's why pyramid schemes are so bad, because they turn a victim into a perp. Because a lot of people who invested in turn recruited, and it kind of complicates matters.
It also makes people very unwilling to come forward because they're so guilty about what they did.
Ruja managed to fool a million ordinary people because it was ordinary people putting €2,000, €5,000 in.
It wasn't SoftBank or a big, you know, a big institutional investor putting in hundreds of millions. So it's quite a different type of scam. And the numbers involved are also giant.
There's usually two ways of working out the size of a Ponzi scheme, and one is how much money was actually put in. And we talk at least €4 billion.
That's from official accounts that have been leaked that we have. Some people, including a top promoter, says it's as much as €15 billion was put in.
It's very hard to work this out, but the other way is to work out how much money did investors believe they had. Because to them, it was money in their pocket almost.
They believed they owned it. And then you're talking of a scam that's possibly hundreds of billions.
Ruja, the missing crypto queen, make her come out of hiding, but also make yourself a nice bit of cash as well. What I'm thinking is you could start some NFTs, some Dr.
Ruja NFTs, which use her image and maybe rather those monkey, the crazy ape NFTs, and randomly change her.
Sometimes she's got a sailor's cap on, sometimes she's got a pipe or whatever it might be.
And she then is so infuriated about this infringement of her likeness and wants to cash in that she comes out to take you to court.
Because had you done this as an independent person, you may have had more freedom to do things, but also less backing, right? Less support.
And I'll be honest with you, when you're, because I'm brought in as like a freelance person, so I'm sort of, I'm brought into the BBC fold and then I get all the protections the BBC offers, you know what I mean?
And it's not just, it's brilliant journalists around you that are checking things too, and the editorial policy people who work out whether something's fair and balanced and the legal checks that you get and the weight of the BBC.
And people will phone you because they trust the BBC. I mean, yeah, then they still do. I know a lot of people complain, but people on the whole still do. So I am so grateful.
There were things we wanted to do that I just would have loved to have gone on, you know, totally undercover and turned up, banged on doors.
But there are some very, very strict rules for the BBC to do that sort of thing.
To trick someone, entrap someone, lie to someone, the hoops you've got to go through to be allowed to do that for the BBC. Yeah, it's very hard.
And as an individual, I could have just done stuff, but overall, it's definitely, definitely— I'm glad I went that way.
It will be for sale for the recommended retail price of £15.99 plus 5 OneCoin, because that's how they actually do it. And then all your— all, I suppose, all the usual places.
Yeah, so wherever you get your books, all the usual places, all the good and bad bookshops out there.
If anyone wants to follow you online, Jamie, what's the best way for folks to do that? Find out what you're up to.
Because after seeing that picture of Constantinople, Molotov from the back garden where they identified his, where we identified his house.
And don't forget to ensure you never miss another episode, follow Smashing Security in your favorite podcast app, such as Overcast, Apple Podcasts, and Spotify.
And of course, to our wonderful Patreon community, it's thanks to them all that this show is free.
For episode show notes, sponsorship information, guest list, and the entire back catalog of more than 283 episodes, check out smashingsecurity.com.
Hosts:
Graham Cluley:
Carole Theriault:
Guest:
Jamie Bartlett – @JamieJBartlett
Show notes:
- The Missing CryptoQueen podcast — BBC.
- The Missing CryptoQueen book — Penguin.
- Missing Cryptoqueen: FBI adds Ruja Ignatova to top ten most wanted — BBC News.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
- Support us on Patreon!
Sponsored by:
- Bitwarden – Password security you can trust. Bitwarden is an open source password manager trusted by millions of individuals, teams, and organizations worldwide for secure password storage and sharing.
- Drata – Put Security and Compliance on Autopilot. Build trust with your customers and scale securely with Drata, the smartest way to achieve continuous SOC 2, ISO 27001 & HIPAA compliance.
- Cyber Security Inside podcast -bringing you the most important and timely security topics as well as other industry experts for insightful conversations.
Follow the show:
Follow the show on Bluesky at @smashingsecurity.com, on the Smashing Security subreddit, or visit our website for more episodes.
Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!
Warning: This podcast may contain nuts, adult themes, and rude language.

There are so many other bitcoin scams in this world.
Personally, I'm waiting for a movie about usi-tech.
To my knowledge, this is the second biggest bitcoin fraud after onecoin.
And I`m really curious who will play Mr. Jicha, the founder of usi-tech.
There are rumours that he is out of Brazil and now living by celine jicha in Europe.