Cyber Fraud Takedowns: A French Connection?
July 15, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
The Interpol news release came from Lyon, France. My first question was, “Did the arrest of Pavel Durov by the French judiciary in August 2024 contribute to this remarkable announcement?” It is not every day that “a global anti-fraud operation involving 97 countries and territories has led to the arrest of 5,811 individuals and the interception of USD 293 million in illicit assets.”
“Over 5,800 Arrests, USD 293 Million Intercepted in Global Fraud Bust” adds:
After an initial period of intelligence collection and exchange, participating countries took part in more than three months of operational activities. This included pro-active action against high-value targets, raiding identified premises, blocking or freezing bank accounts and virtual wallets, requesting INTERPOL Notices and Diffusions and proactively utilizing INTERPOL’s Global Rapid Intervention of Payments (I-GRIP), a stop-payment mechanism that facilitates the swift blocking of illicit financial flows of both fiat and virtual assets.
Okay, MidJourney. Good enough.
A second remarkable fact in the news release was:
Operation First Light 2026 (15 Jan 2026 – 30 April 2026), coordinated by INTERPOL, focused on combatting social engineering scams and associated money laundering activities.
That works out to about 16 weeks. Contrast that with the takedown of Cyberbunker which took more than four years, including the judicial phase.
Let’s think about what may have contributed to this dramatic acceleration of what has been a tedious, time consuming process.
One reason for the acceleration may have been better intelware. At this time, more than 100 companies provide specialized software capable of ingesting large quantities of information, analyzing the data, and generating useful outputs. I personally believe that these intelware advancements have contributed to more efficient law enforcement processes. Therefore, kudos to these innovative and usually low profile firms,.
Another reason may be the better communication flows among agencies and law enforcement units. Based on my experience, the increase in the number of information sharing mechanisms — for instance, fusion centers or similar cross agency structures — have become more effective. The idea is not a new one, of course, but setting up, staffing, and working out procedural mechanisms take time. I would suggest that these structures and the involvement of Interpol have been important components in the turbo-charging of a number of investigations.
A third reason is that training programs for cyber investigators have been improving. The topic coverage and the depth of the instruction has been increasing over time. Based on my personal observations, I would suggest law enforcement is approaching peak instructional capability. There is room for improvement, but cyber training programs are, in general, excellent. One example that comes to mind is the US Federal Law Enforcement Training Center. A high five for this entity is warranted.
There are other contributing factors. These range from certain crypto currency exchanges providing information in a more timely way to the quality of the cyber investigators themselves.
However, I want to raise the possibility of one other contributing factor. I have no first-hand data to support my view. Nevertheless, I want to explore my idea as a hypothetical.
One reason for this remarkable operation as well as a number of others announced since August 2024 is the work of the French judiciary with involvement of other French government professionals. Pavel Durov, owner and founder of Telegram, awaits trial in France. The French judicial system is able to exert its influence over those accused of a crime. The legal and bureaucratic procedures are important. An accused person who is a citizen of France can be kept in a legal plastic baggie for months or, as is the case of Mr. Durov, years. My perception of the impact of the French judiciary’s approach is to allow the defendant to experience a version of sous vide cooking. The water temperature is hot but not too hot. The cooking lasts for some time but not forever. And, only the chef makes the determination when the fish has been cooked. During this complex sequence of bureaucratic moves — think in terms of the procedures a chef learns at Le Cordon Bleu — the defendant may make an effort to cooperate.
In Mr. Durov’s case, he is providing some information to the French judiciary about certain activities taking place on the Telegram platform. Simultaneously he has been releasing technological innovations to make future cooperation with French authorities technically impossible. My view is that he is providing information about relatively low level and mid level online criminal behaviors anchored in the remarkable Telegram platform.
Stated simply, my view is that he offers information to appear to be more cooperative with the French authorities. He checks in with the French judiciary. He obtains permission to travel outside of France. He is doing what his expensive lawyers are advising him. The reality is that Mr. Durov can be kept in limbo in the plastic baggie for an undetermined amount of time. The psychological toll is probably significant even on the magnificent physical and mental specimen of the GOAT of Russian innovation, Pavel Durov.
Net net: I think the French judiciary may be an important factor in reigning in certain types of online criminal activity. I want to be clear. I don’t have any first hand data that proves that the French judiciary contributed to this remarkable operation. But Lyon is in France. The French judiciary is in France. Pavel Durov is in France. Maybe there’s a connection. My caution is that Telegram is working on systems and methods that are likely to enable new variants of online crime. Mr. Durov may be yielding some information. He is not giving up his core principles yet.
Stephen E Arnold, July 15, 2026
Telegram Note: MTONGA and Buy a Gram to Support Telegram
June 10, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
Pavel Durov has been taking leadership-type actions. He pulled crypto responsibility from the TON Foundation. The TONcoin has been rebranded at GRAMcoin. This is the original name of the firm’s push to crypto in 2019. The self-styled GOAT of Russian entrepreneurship has plans to make TON great again. Yep, MTONGA. The name reminded me of a song my mother loved. The name also inspired me and my team to write “MTONGA: Buy a Gram and Support Telegram.” I assume there will a baseball cap with MTONGA proudly displayed, T-shirts (form fitting, of course), and probably a yoga mat. Mr. Durov is an aficionado of yoga and other physical activities.
A now-removed social media post on a Russian service suggested that the name “gram” was a nod to the company Telegram Mr. Durov set up in 2013. A wag noted that it was a common term among some in Moscow for a controlled substance. The problem with use of Russian language information sources on Russian services is that content can disappear. True or false, I found the name GRAM catchier than TONcoin.
If you want a rundown of what changes Mr. Durov has planned, this article in our Telegram Notes blog will hit some highpoints. We will address the AI features after we poke around making agentic functions work. In September 2026, I have been asked to illustrate how the new AI agent performs tasks previously done by mostly human hands. We also will address in a separate post the new push by Telegram into video. Video is on the platform, but now it is a priority and not just for those with an interest in sensitive subjects in a Telegram Private Channel.
The new post also contains a line from the tune “Bongo, Bongo, Bongo” my mother found enjoyable. One word in that snippet is “bungle.”
We also include four questions that are ones we are currently researching. The article is dated June 3, 2026, but that is a function of the content management system’s penchant for requiring manual entry of dates multiple times. The story went live on Tuesday, June 9, 2026. When we have a date for the French trial, we will provide that information once the wheels of French justice have rolled around to a date. Going slow has definitely destabilized Telegram. Now Apple, another AI laggard, has pulled ahead of the tardy Telegram engineers.
Bongo, bongo, bongo, bungle for us too.
Stephen E Arnold, June 10, 2026
Enzo and Some AlphaTON-Alpha Compute Razzle Dazzle
May 20, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
I have a new post about a Telegram-centric company. The title of the article is “Enzo Villani: An AI Play with LA Style.”
Censorship is all the rage. We continue to try to work around blocks on our Telegram write ups. We have posted a new one about AlphaTON Capital aka as Alpha Compute. One of the figures who is front and center since the interesting reverse merger dumped the Uzbeki financial manager is Enzo Villani. He is a former dignitary at the hard working outfit the US Securities & Exchange Commission. In the last decade when crypto was gaining and then losing momentum for some investors, Mr. Villani was engaged in a number of financial projects. Our new write up lists some of them. We also describe Mr. Villani as a strategic decider. Tactical actions appear to fall upon the strong shoulders of the Russian Yuri Mitin and Brittany Kaiser, the former executive at the remarkable Cambridge Analytica services firm. You should be able to find a version of this write up based on my continuing research for my monograph “The Telegram Labyrinth.” Navigate to this destination.
These Telegram posts have been blocked by BearBlog, a low profile outfit not small enough to be influenced by mystical fortunes and the layoff- and innovation centric LinkedIn. Locating these posts in Yandex is a hit and miss operation. Part 2 of the Villani essay will roll out next week. Its focus is on a company that is what appears to be a variant of BusinessSetup.online in Dubai, just operating in London, England.
Stephen E Arnold, May 20, 2026
Pavel Durov: TON Foundation, Where Have You Gone?
May 13, 2026
This is another Telegram-related post.
We posted another Telegram write up the other day. “Durov and the Telegram Foundation” asks a basic hot oven question, “Is the Goat cooked?” Last week, Pavel Durov asserted his greatest of all time business and technical powers. With the toss of a horn, he snagged TONcoin, blockchain plumbing, and product control from the TON Foundation. The Goat cooked essay explores possible consequences in Switzerland, the country in which the TON Foundation was registered. The purpose of the Foundation was to assume responsibility for the Telegram crypto TONcoin. This token was originally named GRAM, but charges of improper fund raising created a legal problem for Telegram and the GOAT. The Foundation was a play to separate Telegram, the messaging service, from the crypto. With the re-taking of TONcoin and related technology and responsibilities, Swiss regulators may have cause to investigate the GOAT, the Foundation, and those involved in what was until recently the marketing and promotional arm of Telegram.
To get the complete essay and some speculation about the legal issues that can arise from this Durov decision making, Telegram Notes’ write up is a click away. Please, be aware, that since active blocking of our Telegram related content, this incarnation of our recycling of some of the material in our new monograph for law enforcement, cyber attorneys, and cyber fraud investigators renders slowly. Be patient. We are doing what we can to provide information that some folks don’t want publicly available.
Stephen E Arnold, May 13, 2026
Telegram News: A GOAT Rolls Over in Iraq
May 9, 2026
Another brief write up about Telegram.
One of my team members sent me this news item today (May 9, 2026): “Telegram Services Officially Resume in Iraq Following Regulatory Pledges.” When I think about countries hassling Pavel Durov (the GOAT of Russian innovation), Telegram (the platform with many crypto capabilities and services), and the shattered remnants of the TON Foundation — I think about France, Russia, and Switzerland. Iraq? Not so much.
According to the write up:
The Iraqi Communications and Media Commission (CMC) announced on Saturday, May 9, 2026, the official resumption of the Telegram application services across Iraq. This decision follows a period of suspension and comes after Telegram’s management provided formal pledges to comply with Iraq’s regulatory requirements and legal frameworks.
A middle eastern government professional is petting a docile, well-behaved, and rule-following pet GOAT. Some goats make great pets. Did you know that pygmy goats have to be watched because if one falls over, it cannot get up and will die in the goat pen because it cannot stand up without assistance? Thanks, MidJourney. Good enough.
It appears that Telegram, the company that for more than a decade resisted giving in to government demands that would violate Pavel Durov’s commitment to free speech and other Silicon Valley-type ideas has changed its tune. The write up points out:
…the restoration of [the Telegram] service is contingent upon the platform’s commitment to Legislative Order No. 65 of 2004. These requirements specifically address content moderation, user protection, and adherence to national security protocols. The commission emphasized that it will continue to monitor the platform to ensure these commitments are implemented effectively in real-time. … all social media platforms operating within Iraqi borders are strictly required to comply with local legislation without exception.
I don’t know much about Iraq, its government, or its regulatory power. On the surface, it seems to me that Telegram is going to provide certain information to the Iraqi government. If this is true, what does this cooperation mean for the alleged bad actors using Telegram to assist Iran in evading Western sanctions. Will these Telegram customers switch to old-fashioned banks and the systems which bird dog possible anti-money laundering and know your customer guide lines?
The news story asserts:
As Telegram becomes functional again, users are expected to see stricter adherence to legal standards regarding shared content, reflecting the government’s broader strategy to balance digital freedom with national safety.
Did Pavel Durov make this decision? Telegram is a one-man or one-GOAT operation. Was the decision made by one of his core team. What are the implications of this decision? The idea of cooperating with a government is, according to Pavel Durov, against his core principles.
In the last week, Durov took back control of the TONcoin and its technical plumbing from the TON Foundation. He also announced that the service charge or “gas fee” for crypto transactions would be reduced to make the Telegram platform the most economical crypto service layer available. Plus, he stated that the Telegram platform would validate transactions faster than other platforms’ service layer.
But Iraq?
I think that Pavel Durov, the GOAT, is using his playbook for defiant actions. If he okayed the cooperation with Iraqi officials, he must see that decision as significant as boosting the perceived value of TONcoin, preparing for the possible Swiss investigation into the dissolution of the TON Foundation, and responding to the stepped up efforts of the Kremlin to shift Russian Telegram users to the MAX messaging system. Plus, there is the upcoming trial in France on a number of alleged serious online crimes.
Maybe the Iraq decision designed to signal that he and Telegram are ready to continue the increased responsiveness to legal requests from law enforcement? Before his arrest in France in August 2024, Telegram was not the swiftest outfit in social media to respond to legal warrants. After his arrest, his willingness to cooperate increased. In fact, two high profile takedowns of criminal activity on Telegram are rumored to have been related to his new interest in cooperation. Many would cooperate, it seems to me, if the alternatives were massive fines and up to 20 years in one of France’s most salubrious prisons. Fleury is a treat I have heard.
In my Telegram Notes post, I want to consider some of the pressures upon the GOAT as a result of his financial decisions, the money in Russia he cannot access, and the hoped-for initial public offering. I think these financial pressures are likely to make Durov’s GOAT-powered decision making somewhat unpredictable.
For now, the Iraq roll over is just one more signal that the GOAT says one thing and does another.
Stephen E Arnold, May 9, 2026
Telegram and Durov: Some Fancy Dancing Kazachok Style
May 6, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
Online posts and cyber publications have hinted that changes have been afoot at Telegram. I want to comment about one story from Decrypt.co, an online information service. “TON Surges 36% as Telegram ‘Replaces’ TON Foundation” reported:
Toncoin has jumped on Pavel Durov’s pledge to slash fees to near-zero, with TON meme coins piling on gains of up to 150%.
For some, no service charges or what the crypto professional calls “gas fees” is welcome news. When crypto moves through a series of services for conversion from one coin to another, then to a specialist shop, and finally to a “nominee” or actual owner — the service charges add up. Telegram wants to reduce the pain of TONcoin-denominated transactions.
Pavel Durov demands change. Thanks, Midjourney. Good enough.
The article pointed out:
Illia Otychenko, Lead Analyst at CEX.IO, told Decrypt the rally fits a familiar pattern. “Toncoin has a history of sharp rallies whenever Telegram increases its involvement or signals deeper integration, and this move fits that pattern,” he said. “Right now, it looks more like an early-stage narrative-driven spike rather than a full fundamental repricing.” Otychenko flagged $2 as the key resistance level, a ceiling TON failed to break earlier this year, and warned that momentum indicators are flashing caution.
Got that?
Pavel Durov and his Telegram entities are taking immediate and direct action to address a number of challenges his sprawling empire faces. One of the most problematic is that “value” of the TONcoin. The TONcoin has lost considerable “value” in the last year.
A number of interesting questions arise from the announcement that the TON Foundation is now in flux or limbo. One’s point of view determines how to describe this marketing organization.
Let’s list a few of the questions that analysts and regulators are likely to ask:
- Is the TON Foundation what it said it would be when registered in Switzerland, ostensibly to take over the TONcoin, the TON blockchain, and the cheerleading for the Telegram platform?
- Will the two Telegram-linked NASDAQ companies (TON Strategy Co. and Alpha Compute) strengthen their financial positions or will losses continue to accrue?
- Will Russia’s pressure on Telegram morph into the organization’s finding itself slapped with the label “terror related”?
- Will France exert additional pressure on Telegram to shut down certain illegal activities conducted on the Telegram platform by bad actors?
- Will staff working on Telegram-related projects remain committed to the organization? Will developers building Telegram mini apps and distributed applications defect to other platforms?
- Will US super app platforms attract attention from bad actors who are looking to deploy AI-enabled agents to conduct certain illegal activities?
Net net: Telegram is pushing its “renovation and change” button. In fact, it is not pushing. It is just mashing the button repeatedly at this time.
Stephen E Arnold, May 6, 2026
Telegram Is a Frontier Opportunity for the Lederhosen Bros
April 15, 2026
Another semi-amusing post related to what is the Telegram complex. Those filters blocking our brand of fun are annoying, but we have managed to slip through the MSFT grate (not “great”) and swizzled around the BearBlog’s assertion “AI writes your stories.”
I am not sure how many people know about two interesting and very clever fellows, Manny Stotz and Oskar Hartmann. In the Telegram Notes’ post “Two Frontier Compeers,” I have summarized some general information. If you attend one of my lectures for law enforcement or intelligence professionals, you will learn that I call these pals the “lederhosen bros.” Both are Germans by birth; both find Telegram’s TONcoin crypto a “frontier opportunity”; and both have business linkages in Dubai, United Arab Emirates. Did you know that the UAE is the site of an exclusive club called “Equium”? Now you know. In addition to holding meet and greets, the members chat.
Why are bears chasing Manny and Oskar? Thanks, Venice.ai. Good enough.
If you want to know more about Manny and Oskar, navigate to our current home on the Web at this target location. If the story does not render, just write kentmaxwell at proton dot me. He will send you a text version.
Stephen E Arnold, April 15, 2026
Part III: Grachev’s Flight of the Falcon
April 2, 2026
Editor’s Note: The post about Andrei Grachev’s Falcon Finance appeared briefly on Telegram Notes. The service we used for these essays blocked the content. Then we learned that LinkedIn had blocked a short post by me and a subsequent repost by a person who follows my writings. I don’t want to speculate. I will leave that to you. Here is the original post. There are two previous essays about Andrei Grachev, a former luminary on the RACIB board in Moscow, Russia. We will re-release the blocked Telegram content probably next week. Until then, try to figure out who would want the information in this write up removed from public access. Maybe it was the nifty image of the falcon fleeing from a burning financial vehicle? Maybe it was my rhetorical style? This essay comes from my collection of notes on on-going research related to my new monograph “The Telegram Labyrinth.” The time window for the events is May 2025 to December 2025. Most of the information originated in Russian social media; for example, online articles, Telegram messages, items in PCNews.ru, and VKontakte pages. Content disappears from services in Russia and many links to the sources my team and I accessed are now offline. This approach to revisionism works quite well. I collected my notes and continue to sort and resort them. Remember, the statements in this essay are from my notes and should be viewed as working hypotheses. Verify before you trust any of my observations. These are speculations I captured as I was writing “The Telegram Labyrinth” and as I draft my 2026 lectures to cyber investigators. Keep the disclaimers in mind as you review this briefing document. Also, the blocked essay appeared prior to the Iran War. When you read this essay, the falcon could be vaporized. — Stephen E Arnold, April 2, 2026
Two 2024 Events
Event one: Andrei Grachev changed the headquarters of DWF Labs from Singapore to the United Arab Emirates in December 2024. The wheeler-dealer in high frequency trading believed that the center of gravity for crypto had centered in a country known for Burj Khalifa (the world’s tallest building) and the royal families’ supercars.
Event two: Pavel Durov, the founder of Telegram and global crypto icon, deplaned at a Paris airport and immediately arrested by the French judiciary J3 cyber crime unit. At Telegram and the TON Foundation, senior professionals started to think about the future of the global service.
Only a handful of crypto professionals noticed Grachev’s administrative change. Pavel Durov’s arrest on basket of serious cyber crime charges. Durov was a global freedom and privacy superstar. Grachev was a financial engineer with a low profile.
In my notes, I wrote: “Durov believed that the Telegram and TON Foundation would need access to the US capital markets to make TONcoin the nuclear fuel of an alternative to the centralized financial systems. The French could derail Telegram’s revenue from illegal online services. Would he need market makers to pump up the value of the TONcoin.”
Luck, coincidence, or an informed decision may have allow Durov’s and Grachev’s organizations to work together.
Why Abu Dhabi?
Grachev had been operating in the blurred boundary of legal and illegal financial activity for almost a decade. The risks for certain crypto operators were increasing in the EU. The US financial markets required conformance to what he perceived as annoying rules and regulations about crypto transactions. But he sensed he had to pull off the same trick when he dodged jail for cargo theft. In 2015, he had squirted Clorox industrial-strength sanitizer by getting a degree from MESI (Moscow State University of Economics, Statistics, and Informatics), working at Huobi Moscow, and becoming a go-to crypto trading expert on the board of the powerful, Russian state-aligned RACIB. He had a feeling he might need to pull off a similar cleaning job if his HFT operation drew scrutiny.
His game plan was simple: Stay on the offense. Keep moving forward. He had prepared for his next move. True to form, while working at one big company, Grachev occupied his spare time orchestrating his next financial company. There is little evidence that he shared his extracurricular start up work with whoever was employing him. I wrote on one of my notecards: “Don’t hire Grachev. He spends time figuring out his next move, not doing the work he’s paid to do.”
To become a more fearsome financial force, Grachev had to find a country from which to operate. He had a small office in Dubai, but that city vibrated with Telegram’s rah rah and talk of Durov’s problem in France.
Grachev determined that the UAE was the right country and Abu Dhabi the best place to set up his new financial venture. The United Arab Emirates established the ADGM or the Abu Dhabi Global Market. ADGM operates an IFV or International Financial Center and an FFZ or financial free zone. I wrote on one of my notecards: “This is a state within a state with its own commercial laws. These appear to be based on English Common Law.” Grachev’s calculus resolved to “Operate from Abu Dhabi. Get certified as a ‘legitimate’ financial operation.”
ADGM introduced the world’s first DLT Foundations Regulations in late 2023, providing a legal structure for decentralized organizations and foundations like the TON Foundation to be registered as legal entities. Grachev had concluded sometime in 2024 that his long-time partners Marco and Remo Schweizers were baggage likely to be scrutinized by some mid-level financial bureaucrat. He dumped them and the Digital Wave brand.
He signaled to the crypto and financial world:
- Grachev to run his high frequency crypto trading business within the UAE’s Financial Services Regulatory Authority. The shift meant compliance, not an offshore black ocean operation. Grachev distanced himself from the perception of some that he was a shadow operator in providing crypto liquidity services. The ADGM umbrella delivered good optics to potential investors.
- ADGM is different from Dubai’s retail-focused crypto scene. The U-turn would allow him to handle more real world assets and broader financial services from the IFC.
- Abu Dhabi’s ADGM Foundations Regulations gave his new venture a “legal personhood. This status would, in theory, protect the entity’s assets if a regulatory issue became problematic.
How Grachev Infiltrated Telegram and Its Foundation
Grachev is bright and has a thirst for knowledge. What better way to understand the operation of Pavel Durov than to get involved with the TON Foundation. It was in Dubai. How does one gain access to its Board of Directors and people like Steve Yun, Manny Stotz, et al? Answer: Money.
In late 2022, Grachev had committed $10 million to the TON Foundation to fund developers’ TONcoin-centric projects. The “donation” made him a person of importance in the TON Foundation’s universe. He absorbed information about Telegram and the Foundation.
Did he learn that the TON Foundation was going to take dramatic steps to gain access to the US capital markets? Did a member of TON Foundation’s leadership say to him, “Andrei we are going need some market making action. Do you know anybody in this business?” Maybe Grachev was in the right place at the right time? Did Grachev’s falcon DNA let him see something that would put him in the right place at the right time? Who knows? Once again his luck or insight positioned him well.
Pavel Durov was going to trial on more than a dozen serious offenses. The TON Foundation churned through management personnel. Steve Yun, the president of the Foundation, left to run TON Ventures. That entity would invest in promising companies and own a stake in them. Manny Stotz took Yun’s job as president of the Foundation. Then a couple of months later left to run the first of the Telegram/TON Foundation’s US capital market start ups. The company was TON Strategy Company. Its business model was a knock off of Michael Saylor’s Strategy Company. Instead of amassing Bitcoin, Stotz’s firm would amass TONcoin.
A third play. was to buy the shell of a publicly-listed NASDAQ company and set up a firm that would accept investments to convert fiat currency and crypto to payoffs from an artificial intelligence data center play. Telegram would purchase AI compute from the AlphaTON Capital company, and in theory other customers would flock to AlphaTON Capital for lower-cost AI compute.
On my notecards related to the post-Durov arrest period, I jotted down: “Grachev was, in effect, a TON community insider. He had a market making track record. The falcon had the mouse.” By August 2025, Grachev created DWF MaaS, an outfit he registered in the British Virgin Islands. The HFT action would be handled by DWF Labs. (The MaaS meant “market making as a service. The service, of course, was the same type of HFT activity which added “vroom” to certain crypto transactions.)
By September 3, 2025, that Andrei Grachev, acting through DWF MaaS Limited, worked a deal that would allow him to manage a second firm with access to the US financial market. The arrangement was formalized through a Treasury Management Agreement with an effective date of August 29, 2025, and was explicitly detailed in September 2025 SEC filings for what is now known as AlphaTON Capital.
How would Grachev make money from this Telegram-centric deal?
The specific terms of his compensation, as detailed in SEC filings and the Treasury Management Agreement effective August 29, 2025, included:
- Revenue Share of Proceeds: Grachev’s entity was entitled to **75% of the proceeds** raised by the company that were managed by DWF, until a $55 million funding threshold was reached.
- Equity Compensation: DWF received 160,000 AlphaTON Capital shares. These would vest over 36 months.
- Trading Profit Retention: Under the agreement, DWF MaaS was permitted to retain trading profits generated from the assets it managed until the total balance reached the cap of $150 million. After passing this milestone, DWF MaaS would share 10 percent of its profits with AlphaTON.
To focus Grachev’s attention, Yuri Mitin and his colleagues allowed Grachev to subscribe to $15 million in AlphaTON shares, effectively becoming a principal funder of the firm’s pivot to a digital asset treasury model.
On paper, the deal is good for Grachev and DWF MaaS. For AlphaTON Capital, I jotted on a notecard: “Who advises AlphaTON Capital? Captain Kangaroo?”
Luck and planning worked. Grachev had a key to the US capital markets. Then the AlphaTON Capital’s engine room burst into flame.
The “falcon” flees a sinking ship. Art generated by Venice.ai.
Who Fired Whom?
After a couple of months on the job, Grachev figured that AlphaTON Capital was a loser. In December 2025, Grachev and AlphaTON Capital ended their relationship. On December 30, 2025, Grachev received some cash (a rumored $35,000 and allegedly $15 million in value). He was cut loose, terminated, RIFed, or fired. The other possibility is that Grachev wanted out and forced AlphaTON Capital’s hand. Either way, Grachev took off.
TONcoin value had dropped. Grachev couldn’t reverse that collapse when the global market for crypto was weakening. Then AlphaTON Capital stretched the truth with its Anduril Technologies announcement and burned its credibility with investors big and small. The shares (NASDAQ:ATON) slumped. AlphaTON Capital hired a new chief financial officer. The company retained a new law firm. The fire in the engine continued to burn. I jotted down on a notecard: “The unnamed international investors will not be happy.”
As of February 2026, no one has nailed down the specific events that unraveled. Had Grachev wasted his time with his involvement with Telegram-centric activities? Did he complain? Did he rage bait on social media? Did he appear on podcasts and grill Brittany Kaiser about the Anduril misstatement? Did he snipe at Mitin’s exposure to the “international” sources of capital? Nope. Nope. Nope. Nope.
Grachev did what Grachev does: He followed his game plan. Before the AlphaTON adventure, he had set up Falcon Finance in October 2024, seven weeks after Durov’s arrest in France. The official public launch of Falcon Finance took place on April 30, 2025, following a closed beta period. The purpose of this new British Virgin Island-registered company was to create a yield-bearing stablecoin named FF$. His standard operating procedure is to have parallel activities and options for whatever fate presents to him.
In September 2025 after signing the AlphaTON Capital deal, Grachev created the FF Foundation. The Foundation would manage $FF token unlocks, distributions, and ecosystem grants. On the day he left AlphaTON Capital, the disconnect from the Schweizers occurred. Grachev was in control of his HFT machine, his blockchain technology, and other oddments required to operate a crypto business within the white lines of the UAE’s regulatory rules.
Unlike DWF Labs or MaaS, which operated as opaque trading firms, Falcon Finance is a universal collateralization layer. It enables users to mint a synthetic dollar (USDf) using a wide variety of assets—including BTC, ETH, and tokenized real-world assets (RWAs)—and earn yield (USDf) generated through documented, on-chain funding rate arbitrage and cross-exchange strategies. It functions as an “on-chain hedge fund” where the yield is passed directly to the token holder rather than being retained as firm profit.
To what end? He had been surfing jurisdictions to avoid legal action. He had numerous business entities. He had a sweetheart deal with AlphaTON Capital?
“Grachevian logic” dictated that Grachev had to move up the crypto financial food chain: From stealing cargo to HFT, from HFT to crypto market making, from market making to running a hedge fund based on his own crypto coin. He simply popped up a layer in the financial engineering universe.
His FF Foundation was needed to hold the $FF crypto tokens and provide protocol governance. Just as Durov did after his legal problems with the US SEC, Grachev created a Foundation. If Falcon Finance was taken to court in the EU or the US, the Foundation structure would in theory protect to some degree the FF crypto assets.
Plus, he could demonstrate that he could not arbitrarily manipulate the token supply, an allegation leveled at Telegram. Grachev’s Foundation uses a preset schedule for token releases, which is “audited” by third parties such as ht.digital.
His Foundation is registered under the ADGM DLT Foundations Regulations. This allows the protocol to function as a “legal person” in the UAE, enabling it to sign contracts with real-world custodians like Fireblocks and Ceffu without being classified as a traditional “investment fund.”
The Falcon Hunts Plumper, Healthier Prey
As he wound down his AlphaTON Capital work, the Falcon Fund (formally the Falcon Finance Ecosystem Fund) and the associated protocols transitioned from a high-growth “startup” phase into an institutional liquidity layer.
Grachev’s has made a clear move toward real world assets, “traditional” collateral, and regulated payment gateways. Falcon Finance wants to cut clear, straight lines through the crypto ether. The flight path seems to be a way to deflect future SEC or international regulatory scrutiny.
Grachev had taken strategic and tactical steps to convert his luck or his vision into business opportunities when he was “working” on behalf of AlphaTON Capital. I wrote on my notecards: “Maybe Yuri Mitin kicked Grachev out because he did nothing but work on Falcon Financial?”
What did Grachev do prior to his termination and dumping of past tie ups in Switzerland? He took four specific steps:
- Copy Telegram. On January 31, 2026, Grachev launched a $50 Million Ecosystem Fund. The fund would provide money to developers building on top of the Falcon protocol. Grachev modeled this upon the TON Foundation investments in its developers. The pool of money pays developers who create smart contracts that use his USDf token. Allegedly half of the capital is deployed as direct investment (USDf/USDT), while the other half consists of vested $FF tokens to incentivize long-term builders.
- Do the “Blue Chip” Collateral Boogie. He launched of two value reserves or in the lingo of the crypto crowd “Vault” products. One is a Bitcoin Vault. Bitcoin can be deposited as collateral to mint Grachev’s USDf and paying (allegedly three to five percent annual percentage rate). The approach seems to push the USDf supply past $2 billion. The other is a reserve for Tether Gold (XAUt). Grachev’s customers can earn up to a four percent return on gold-back tokens. These can be used as collateral for hedging Falcon Financial investments.
- Follow Rules. After the alleged split from the Schweizers, Falcon Financial focuses on deals that comply with UAE rules. First, Falcon Fund integrated with the Altery payment system. This firm’s payment infrastructure is regulated by the UK’s Financial Conduct Authority. In effect, anyone with USDf tokens can use traditional banking systems to obtain fiat currency. Grachev, therefore, is working within anti-money laundering and know-your-customer rules. Without this institutional customers would shun Grachev’s Falcon Fund. Second, shortly before the split with AlphaTON Capital and the Schweizers, Grachev worked a deal to accept CETES or Mexico’s Certificados de la Tesorería de la Federación as collateral. This “play” may be one of the first use of Mexican debt as a security deposit to back on-chain loans or synthetic assets. Grachev’s Falcon Fund appears to move sovereign debt from an emerging market into decentralized finance (DeFi) system. Grachev’s action uses sovereign debt to back the synthetic dollar, positioning USDf as a competitor to traditional fiat-backed stablecoins like USDC.
- Do Magic. In early January 2026, the FF Foundation passed its first formal governance proposal called FIP-1. Control of the “system” consolidated power within a core group of committed holders. The idea is that people with skin in the game would direct the FF Foundation’s activities. Instead of Grachev running the show, people with committed capital would convert money for access to the $FF token. In exchange for “committed” money, these people would get a higher yield and voting power. Instead of the shadowy whales beneath the Telegram interface, the FF Foundation put the prey in a fish bowl.
What’s Next?
I want to mention a fact about the Eurasian kestrel or falcon. The bird has the ability to see ultra violet light. If you are a vole or a mouse, you typically mark your territory with urine. Most cannot “see” the trace. What does the falcon see? Answer: Bright territorial markings. The falcon uses this ultraviolet vision know where to wait for its next meal to appear.
Grachev may have a similar special gift. As he moved from stealing a shipment of goods to immersing himself in high-frequency crypto trades, he was able to profit from his current activities. He then monitored for indications of another opportunity. The lessons learned from his 2022 to 2025 linkage with Telegram-centric activities provided useful information. He took his payoff to go away, but he had spotted an even bigger opportunity to profit. His Falcon Finance operation was sitting in a garage in Abu Dhabi. Technicians had set up the system. Blockchain was working. Smart contracts were ready to deploy. Governance plans were locked and loaded.
When his departure from AlphaTON Capital occurred, Grachev climbed in his new, registered, squeaky clean Falcon Financial vehicle, and drove to the headquarters of his next big play.
Was he embarrassed by his termination at AlphaTON Capital? No. He had his next opportunity revved and ready. Was his distraught at cutting ties with his multi-year partners Marco and Remo Schweizer? No. He had something bigger and potentially more profitable to run. Had he become the elite financial professional with access to the rich and powerful? Not yet, but he was in a position to move up in the financial system.
A mistake in the game he is playing might hood the falcon. Instead of flying free, he could spend the rest of his life in a cage. This business quest is underway now.
Stephen E Arnold, March 9, 2026, Reposted on April 2, 2026
Telegram Updates Available for March 17, 2026
March 17, 2026
Informal write ups about Telegram and its associated entities.
We have posted some new stories about Telegram. These are part of our Telegram Notes’ series.
The new additions are:
Skolkovo’s Microwaved Shells Recipe. The focus is on Moty Cristil and the AlphaTON Capital firm
?-Note: Telegram Ads Now Illegal… in Russia. A person or company buying advertising on Telegram can be in trouble in Russia.
?-Note: Kremlin Steps Up Telegram Pressure. The Kremlin has fined Telegram for being Telegram.
We will be lecturing about Telegram at the 2026 National Cyber Crime Conference. Attendees receive a copy of my new book “The Telegram Labyrinth.”
Stephen E Arnold, March 17, 2026
Part II of Our Andrei Grachev Essay Now Available
March 4, 2026
![green-dino_thumb_thumb[3]](https://www.arnoldit.com/wordpress/wp-content/uploads/2026/03/green-dino_thumb_thumb3.gif "green-dino_thumb_thumb[3]")
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
This is Stephen E Arnold. Part II of my Andrei Grachev essay is live. You can find "Part II. Grachev Aloft: Watching for HFT Prey" on the Bear Blog service. Like the other posts in my "Telegram Notes," I have adopted a very different style from that in my new book "The Telegram Labyrinth." No paywall, no ads, no registration.
Stephen E Arnold, March 4, 2026
-
- Subscribe to Beyond Search
Feature archive
News archive
-
