A 44-year-old Ukrainian national has admitted in US federal court to his role in the Conti ransomware operation, one of the most destructive cybercrime enterprises ever to weaponize Bitcoin as its payment rail. Oleksii Oleksiyovych Lytvynenko entered a guilty plea on June 12 to conspiracy to commit wire fraud, a charge that carries a maximum sentence of 20 years in federal prison.

Lytvynenko’s involvement with Conti began in September 2021, when he contributed to the development of a malware loader and managed stolen data from 12 victims. Eight of those victims were based in the United States. His sentencing is scheduled for September 10, 2026.

From Ireland to a US courtroom

Lytvynenko was arrested in Ireland in July 2023, roughly a year after Conti officially dissolved. Then came a prolonged extradition process that didn’t deliver him to US soil until October 2025, more than two years after Irish authorities picked him up.

Conti ran a ransomware-as-a-service model, essentially franchising its attack tools to affiliates who would do the dirty work of infiltrating networks. The playbook was double extortion: encrypt the victim’s data so they can’t access it, then threaten to publish it online unless they pay up.

The group infected over 1,000 networks globally and extracted at least $150 million in ransom payments, predominantly in Bitcoin.

Conti’s rise and messy collapse

Conti operated from early 2020 until mid-2022. The group targeted hospitals, corporations, and government agencies with equal enthusiasm.

In early 2022, shortly after Russia invaded Ukraine, a trove of internal Conti communications was leaked online. The leak exposed the group’s internal structure, its Bitcoin wallet addresses, and the identities of some members. The group publicly dissolved in mid-2022.

Lytvynenko’s specific role, building a malware loader and managing exfiltrated data, places him in the operational middle of the organization. Controlling stolen data from a dozen victims means he had direct access to the leverage Conti used to extort payments.

What this means for crypto and ransomware enforcement

Bitcoin’s role as the preferred payment method for ransomware groups like Conti has been one of the most persistent PR problems for the asset class. Bitcoin’s transparency — every transaction lives on a public ledger — has actually helped law enforcement trace funds in many cases.

Blockchain analytics firms have become essential partners for law enforcement, tracing Bitcoin flows from ransom payments through mixers and exchanges to identify the humans behind the wallets.

Lytvynenko was arrested in 2023, extradited in 2025, and pleaded guilty in 2026. US prosecutors are still successfully pursuing Conti members four years after the group dissolved.