Global Corruption and Organized Crime Network

The US government's financial crime enforcement posture likely is shifting toward geopolitical alignment rather than universal rule-of-law application. The pattern across three independent tracks — DOJ moving to dismiss Adani bribery charges after a direct DOJ-Adani lawyer meeting (May 2026), the Kostin VTB sanctions case placed on hold (July 2025), and Venezuela's acting president Rodriguez receiving US sanctions relief (April 2026) — is inconsistent with independent procedural anomaly and reflects coordinated policy direction. The competing hypothesis — that each case is an isolated procedural outcome — is weakened by the concurrent timing across structurally independent prosecutorial, regulatory, and diplomatic tracks. Confidence is moderate because enforcement durability is a HIGH-sensitivity/LOW-confidence assumption: the pattern may normalize if career DOJ staff resistance prevails or political direction changes before the mid-term period.

North Korea's Lazarus Group / TraderTraitor cluster almost certainly is operating cryptocurrency theft as deliberate state financing strategy rather than opportunistic criminal activity. The $2.6B 2025-2026 haul — Bybit ($1.5B, Feb 21 2025, FBI-confirmed), Drift Protocol ($285M, executed via 6-month social engineering from fall 2025), and KelpDAO ($290M, Apr 18 2026) — requires organizational patience, technical sophistication, and operational security incompatible with a criminal-opportunist profile. The alternative hypothesis — uncoordinated state-tolerated criminal groups rather than state-directed operations — is inconsistent with FBI attribution and coordination across multiple independent targets. Confidence is high: FBI confirmation (Reuters/AP/BleepingComputer Feb 27 2025), TRM Labs independent on-chain analysis, and 38 North geopolitical analysis all converge.

Non-US judicial systems very likely are accelerating prosecution of kleptocrats and corrupt networks independent of US enforcement posture, representing a sustained structural shift. Evidence includes: Bangladesh death sentence against Hasina (Nov 2025) plus 26 additional years across corruption cases; Albania arrest and indictment of former president Meta (2024-2025); UK conviction and sentencing of all six members of the Roussev GRU-linked spy ring (May 2025); Tulip Siddiq receiving two Bangladesh in-absentia convictions. The alternative hypothesis — these are unrelated coincidences — is inconsistent with the geographic breadth (South Asia, Balkans, Eastern Europe, UK) and the structural shift toward in-absentia sentencing that allows prosecution to proceed despite subjects' non-cooperation or foreign refuge. Confidence is high because the evidence base is multi-jurisdictional and independently corroborated.

Tether (USDT) very likely is the primary financial intermediary for transnational criminal organization cash flows, human trafficking payment networks, and sanctions evasion schemes. The ICIJ Coin Laundry investigation documented $1.4B+ in confirmed illicit flows; OFAC designated 6 Ethereum wallet addresses for Sinaloa Cartel drug laundering (May 20 2026); and the FinCEN/OFAC GENIUS Act proposed rule (May 2026) specifically targets stablecoin AML/CFT compliance gaps that Tether occupies. The alternative hypothesis — illicit actors preferentially using Bitcoin or other transparent-chain assets — is inconsistent with USDT's pseudonymous stable-value properties uniquely suited to criminal cash management. Confidence is moderate because ICIJ Coin Laundry captures a documented subset of flows and total TCO USDT utilization is likely materially higher than documented.

Arkady Rotenberg's network very likely represents the highest documented instance of wartime oligarch domestic asset capture in the dataset. Western sanctions compelled Natalia Rotenberg's UK corporate dissolution (four companies, Upper Ribsden Surrey, 2022-2023) while simultaneously enabling Arkady to capture Rosimushchestvo control (Dec 2025) and acquire Tatspirtprom — one of Russia's five largest alcohol producers — through FAS-approved channels (Jan 2026). The competing hypothesis — independent commercial transactions not reflecting sanctions-enabled redistribution — is inconsistent with the correlation between UK dissolution dates (2022-2023) and Russian domestic acquisition acceleration (2025-2026). Confidence is moderate because the Rosimushchestvo control mechanism (payroll influence rather than formal ownership) has not been independently confirmed outside The Insider's Dec 2025 investigation.

The US government likely has a narrow and time-limited window to consolidate influence over post-Maduro Venezuela under Delcy Rodriguez before Chavista hardliner resistance succeeds in reversing her US alignment. Lifting Rodriguez's sanctions (April 1 2026) and recognizing her as legitimate authority represents accelerating US-Venezuela normalization; Miami Herald reporting (~May 7 2026) confirmed Chavista hardliners are fracturing over her US ties. The alternative hypothesis — that Rodriguez's alignment is stable and irreversible — is inconsistent with the structural dynamics of a Chavista coalition that derives identity from anti-US posture. Confidence is moderate due to the rapid pace of events and limited evidence base for Rodriguez's internal political durability.

The Kostin SDNY case (1:24-cr-00091-GHW) is likely the highest-value indicator for whether US enforcement geopolitical selectivity is structural or temporary. If the trial resumes with a scheduled date before December 2026, hypothesis KJ_001 is weakened. If the trial remains on hold through the Trump administration's mid-term period, the selectivity pattern is strengthened. The March 27 2025 warrant and April 14 2025 suppression motion indicate the case was procedurally active before the hold — suggesting the hold is externally motivated rather than internally routine. This judgment is inherently forward-looking with LOW confidence in either direction until observable evidence materializes; it is included as a watch indicator rather than a concluded finding.

Jan Marsalek very likely has transitioned from a financial fugitive to an active GRU intelligence asset operating under Russian state protection in Moscow, based on PBS Frontline's Oct 2025 confirmation that he is living openly in Moscow as a GRU handler. The alternative hypothesis — that Marsalek is merely sheltered by Russia as an institutional embarrassment — is inconsistent with the 'living openly' characterization and GRU handler role, which implies active operational employment. This has significant implications for the Roussev Bulgarian spy ring and very likely parallel networks still under Marsalek's management. Confidence is moderate because PBS Frontline is a reliable secondary source but the GRU handler designation has not been confirmed by primary intelligence record.