The Kremlin’s Insider Trader Who Beat the U.S. Justice System

By any objective standard, Vladislav Klyushin was having a catastrophic day. The judge overseeing his case had rejected every argument from his legal team and dismissed all appeals for leniency from his supporters. She delivered a harsh sentence: an additional nine years behind bars in a U.S. federal prison, on top of an order to seize $34 million in ill-gotten assets.

Yet if the ruling left Klyushin angry or despairing, he gave no outward sign of it. The 42-year-old Moscow-based tech executive remained upbeat, quick to smile on his full cheeks and unfailingly polite—just as he had been through every step of his ordeal: his arrest near a Swiss ski resort in March 2021, his months of detainment in Switzerland, his extradition to the U.S. that December, his indictment and trial on charges of hacking and wire fraud, and his rapid conviction. One of his defense attorneys told me Klyushin “never lost confidence that the Russians would eventually bring him home.” He remained fully convinced that his Kremlin-backed protectors would ensure he never served his full sentence.

At times, that certainty came off as pure arrogance. The U.S. federal prison system held 35 Russian citizens at the time; it was obvious not all of them would be traded back to Moscow. His own family and friends were beside themselves with grief. Yet less than a year later, Klyushin was proven right. On August 1, 2024, he was released from his restraints and put on a plane bound for Moscow—one of 24 people included in the largest, most complex prisoner swap in the history of U.S.-Russia relations.

You have almost certainly heard of this high-profile exchange. It was the deal that brought Wall Street Journal reporter Evan Gershkovich and former U.S. Marine Paul Whelan back to American soil, and sent back to Russia a Kremlin-linked assassin and a deep-undercover husband-and-wife spy pair whose own children had no idea they were Russian until they boarded the flight home. In most coverage of the exchange, Klyushin was reduced to a mere footnote. That omission was understandable, but it was also a mistake—and not just because he sat at the center of one of the largest insider trading schemes in modern history.

The escalating standoff between the U.S. and Russia has played out in dozens of arenas over the past decade. Just two weeks before the 2024 swap, another American captive was exchanged; at least 10 more U.S. citizens remain locked up in Russian prisons today. Now, the Oval Office is occupied by a Kremlin-friendly president who relishes being seen as a dealmaker. One major front of this conflict is global finance, where the U.S. and its allies have increasingly cut off Russian industry from the international economy. But there are always enterprising people who find cracks in that wall—and Klyushin was clearly one of them. His $93 million scheme can be easily read as a backdoor channel to funnel capital into Russia, even amid the global sanctions blockade.

The conflict is also played out in the streets of Moscow, where secretive Kremlin security forces detain American citizens on fabricated charges, then hold them as bargaining chips to trade back for assassins, spies, and Kremlin allies. This is kidnapping, plain and simple, carried out effectively on the direct orders of President Vladimir Putin. More often than not, Americans are seized specifically for their value as exchange assets to win back people like that Kremlin assassin, or Klyushin, this convicted financial criminal. He was not at the very top of Moscow’s exchange list, but he was far closer, and far more important to the Kremlin, than either side has ever publicly admitted.

The rags-to-riches fairy tale

To the outside world, Klyushin lived a classic rags-to-riches fairy tale, preserved on soft-focus wedding footage. In a wedding montage later obtained by U.S. prosecutors, Klyushin dives into a country club pool; his fiancée Zhannetta sips pink champagne on an outdoor draped bed covered in chiffon and roses; he picks her up in a white Porsche convertible. She looks stunning in a backless gown; he is handsome, if a touch goofy, in a tuxedo with a subtle mullet cut. They dance, laugh, and gaze out at the fireworks lighting up their picture-perfect night. “I do not know a more decent person than my husband,” Zhannetta later wrote to the judge in Klyushin’s case.

The couple had three children together, adding to the two Klyushin had from a previous marriage. By all accounts, he was a devoted father—a stark contrast to his own childhood, where he never met his biological father, and his stepfather was killed in a car robbery when Klyushin was 14. He climbed out of childhood poverty to build multiple businesses. First he worked in construction and marketing, then he founded an IT firm called M13, which sold media and internet monitoring software to Russian government agencies.

Early clients in 2016 included Russia’s Ministry of Defense and the executive office of the presidential administration, where Putin’s head of propaganda became a key backer of M13. According to one Russian local news report, the company’s software was used to monitor hundreds of Telegram channels for the Kremlin, which was growing anxious about the spread of “unverified or deliberately false information.”

Klyushin’s ascent was rapid, bringing in more than $30 million in government contracts over a decade. That success confused many of his industry peers. (“The company and its owner are unknown to most in the Russian IT community,” a leading Russian business journal noted in 2021.) But it earned him influence and powerful supporters. He funded the arts and paid to repair the roof of a monastery on Moscow’s Lubyanka Street, just a few blocks from the headquarters of Russia’s top spy agency, the FSB.

One friend later praised Klyushin as an “eco-activist” (for planting “several spruce trees in a yard”) and a “devoted animal lover” (whose “favorite pet is a dog”). “Broad-minded, well-read, educated,” gushed a family friend who was also his tennis coach. An M13 employee said a conversation with Klyushin “is like getting a lesson from a guru.”

Moscow is full of entrepreneurs who get rich by currying favor with the government; Klyushin seemed to reach an even higher tier of access. He and M13 grew so close to Moscow’s power brokers that one independent media outlet suggested he was one of the creators of an anonymous pro-Kremlin Telegram channel with nearly 200,000 followers. Klyushin denied the claim and successfully sued the outlet for defamation over the insinuation.

Klyushin’s most impactful professional relationship was with Ivan Ermakov, an internationally notorious hacker. It is unclear when the two first met, but by April 2018 they were close enough to go heli-skiing together. Ermakov, then 32, had large, youthful brown eyes that made him look a full decade younger than his age, and he had previously served in Unit 26165 of Russia’s main military intelligence agency, the GRU. In cybersecurity and political circles, this unit is better known as “Fancy Bear,” infamous for hacking the networks of Hillary Clinton’s 2016 presidential campaign and the Democratic National Committee—attacks that helped tip the 2016 U.S. election in Donald Trump’s favor.

U.S. prosecutors alleged in 2018 that Ermakov personally carried out some of Fancy Bear’s break-ins. This was around the same time Ermakov and Klyushin attended the World Cup together in Sochi. That October, Ermakov was indicted again for a series of Fancy Bear hacks targeting the 2016 Summer Olympics, and he landed a spot on the FBI’s Most Wanted List. Klyushin kept a copy of the FBI wanted poster in his iCloud account.

The $93 million hack-and-trade scheme

At the time, Ermakov was acquiring information that would become the foundation of Klyushin’s next big moneymaking venture: profiting off the U.S. stock market. According to encrypted chats later obtained by prosecutors, Klyushin soon opened a brokerage account through a Danish company, which Ermakov and an M13 employee used to trade a wide range of stocks, spanning real estate firms, natural gas companies, and food service businesses.

At first, the venture struggled. The chats show mistimed trades, miscommunicated company data, and misread price movements. “The market behaves strangely,” Ermakov wrote at one point. “We suck,” complained an M13 employee. But the successful trades almost always shared a common pattern: they were made right before companies released their scheduled public earnings reports. It was as if Klyushin’s circle had access to non-public, privileged information.

Which, prosecutors say, they did.

Broadly speaking, insider trading falls into a few categories. The most common type is what prosecutors often call “golfer cases,” where an executive at a public company slips confidential information to a friend on a golf course, who then trades on that tip. It is illegal but usually limited in scope: one insider, one company. (Even golf legend Phil Mickelson paid back more than $1 million tied to one such case in 2016.)

A rarer, far more damaging variant involves exploiting a weak point in the flow of financial information to steal confidential data on dozens, hundreds, even thousands of companies all at once. This is exactly what happened in the early 2010s, when a Ukrainian hacker broke into press release distributors like PR Newswire and stole pre-publication data on dozens of companies. That hack generated an estimated $30 million in illegal profits. For reasons that remain unclear, Klyushin kept a printout of an article about the PR Newswire hacker in a pink translucent folder. Someone took a photo of that article sitting next to a bottle of rosé.

Investigators believe Klyushin and Ermakov’s insider trading scheme launched in early to mid-2018. (The details below come from court records, trial transcripts, and evidence submitted during Klyushin’s trial.) That was when very unusual activity started showing up on the networks of Donnelley Financial Solutions, a document management firm that prepares earnings reports for large public companies. On May 9, the account of long-time Donnelley employee Julie Soma began downloading a flood of confidential financial reports prepared for client companies. That was something she “never” did, Soma later testified. The browser and operating system data linked to the burst of activity on her account also did not match her normal usage. On top of that, all the downloads happened late at night, long after Soma would typically stop working from her home in Richland, Washington.

Several other Donnelley accounts also showed abnormal activity, and at least one Donnelley-linked laptop based in London was found to have a suspicious tool installed. This program allowed remote control of the computer, tried to steal usernames and passwords from Donnelley’s internal networks, then covered its tracks by deleting system logs. Finally, the tool tried to connect the laptop to a fake domain, investmentcomp.com—a classic hacker tactic to secretly siphon data from a target’s system.

In November, a Donnelley competitor was also breached. At Toppan Merrill, investigators later found that a tool called DirBuster was guessing dozens of file names and network paths per second to find vulnerable entry points. Other malicious software mirrored the activity seen on Donnelley’s systems.

Meanwhile, Klyushin’s investments were growing. He bought stock in semiconductor manufacturers, roofing suppliers, and a company that makes wakeboarding boats. At almost every turn, two of Ermakov’s associates from St. Petersburg, Mikhail Irzak and Igor Sladkov, bought the exact same stocks. (Irzak, Sladkov, and Ermakov were all indicted alongside Klyushin.) The volume of their trades often far outstripped Klyushin’s. When he bought 1,350 shares of Tesla just ahead of its earnings report one fall, the St. Petersburg pair bought 16,300. Klyushin earned an estimated $9,000 from the deal; they walked away with more than $145,000.

Prosecutors never proved a direct link between Klyushin and Ermakov’s St. Petersburg associates, but one of the pair had M13’s internal messaging app on his iCloud account, despite never being an employee or client of the firm. A U.S. Securities and Exchange Commission economist later calculated the odds of the group’s trading patterns being a coincidence at less than one in a trillion.

The scheme attracted more outside investors. Ermakov and Klyushin shared their trading tips with these new clients and took a 60% cut of any profits the outside investors earned. One new investor ran an audiovisual and IT company that M13 had recently pitched a white-hat hacker-for-hire service to. Two other investors were described by Klyushin’s attorneys as old friends of his: former mining executive Aleksandr Borodaev and Boris Varshavskiy, who holds the “Gold Badge of Distinction of Russian Coal” and briefly served as ecology and natural resources minister for a region in southern Siberia.

“I did the math for Boris,” Klyushin texted Ermakov in May 2019. “The profit comes to 198% … Boris earned $989k on a $500k investment … They don’t even ask why.” (Neither Borodaev nor Varshavskiy was charged in the U.S., and the trial never proved either knew about the insider trading scheme.)

Ermakov responded with a thumbs-up and three laughing-crying emojis. The pair grew closer over this period, hitting saunas together, going out for dinners with the M13 team, and texting about their favorite TV shows. Klyushin was a huge fan of Billions, the hit series about a hedge fund manager who built his fortune on insider trading.

On July 16, 2019, the Julie Soma account at Donnelley Financial downloaded an upcoming press release from sneaker brand Skechers. The document—one of more than 2,000 files illegally downloaded using Soma’s credentials—showed that Skechers’ second-quarter business was far stronger than market analysts expected. “We buy SKX today,” Ermakov wrote in the encrypted chat that morning of July 18, referencing Skechers’ ticker symbol on the New York Stock Exchange. The St. Petersburg pair bought 130,000 shares; Klyushin bought almost 50,000; his mining friends bought 77,500. Earnings were officially released at 4:05 pm ET that day. Skechers stock jumped from $34 to $39 a share. Klyushin’s group sold off almost all their positions immediately.

Klyushin was elated. “So … What did we earn today? Our comrades are asking,” he wrote in the encrypted group chat, and posted photos of Borodaev and Varshavskiy. Ermakov, who had been comfortable talking about outside investors for months, was growing nervous. He told Klyushin to stop sharing that kind of information. “Vlad, you are exposing our organization. This is bad,” he wrote. “That’s how they get you and you end up as a defendant in a courtroom.”

The hostage machine

A month later, former U.S. Marine Trevor Reed was arrested in Moscow and sent to a state psychiatric facility. “There’s blood all over the walls where prisoners had killed themselves or killed other prisoners,” he later told CNN. “The toilet is just a hole in the floor and there’s, you know, crap everywhere, all over the floor, on the walls. There’s people in there that walk around, they look like zombies.”

A similarly terrifying ordeal had already unfolded for Paul Whelan, another former U.S. Marine. He had traveled to Russia for a friend’s wedding when FSB agents burst into his hotel room and accused him of espionage. He was sent to a former gulag that once held World War II prisoners and given a job sewing buttons onto winter uniforms. He was allowed one cold shower per week. Meals consisted of “bread, tea, and a watery fish soup that seemed better suited as cat food,” according to The New York Times.

Reed and Whelan were two of four U.S. citizens arrested by Russian authorities during Trump’s first term, all on what appeared to be the flimsiest of false pretenses. The Kremlin made clear to the White House that some or all of the Americans would be released—if the U.S. handed over a number of high-profile Russian criminals in return. Moscow and Washington had traded captured spies on and off for six decades, but this was something new. It had all the hallmarks of a ransom operation.

Meanwhile, the SEC was picking up on clues that a group of Russians was carrying out highly suspicious stock transactions that clearly looked like insider trading. It was not long before the FBI was brought into the investigation. Special Agent B.J. Kang took lead on the case. Kang is best known for leading the probe that inspired Billions, Klyushin’s favorite show, and he was already working on another insider trading investigation with two prosecutors at the U.S. Attorney’s office in Massachusetts. Since this case looked similar, he brought them on board.

Seth Kosto had spent years prosecuting insider trading and bank fraud cases. Stephen Frank, a former Wall Street Journal reporter, had led the investigation into the “Varsity Blues” college admissions scandal. Together, the three dug into the case. After noticing the patterns—multiple trading accounts making parallel moves, all focused on quarterly earnings—the team quickly realized they were looking at large-scale fraud. “And it was across industries and different kinds of companies,” Frank told me. “The immediate thought we had was, ‘This is likely to be some sort of a hack.’”

After further analysis of market patterns, it became clear that all the illicitly traded companies shared another common trait: their financial filings were all published by either Donnelley or Toppan Merrill. When investigators approached the two companies, their executives initially did not believe they had been hacked. The companies launched internal investigations that scrutinized their own employees first.

Federal investigators, meanwhile, ran a series of “pen registers”—tools that reveal connections between accounts without accessing their content—to figure out who in Russia was orchestrating the trades. They narrowed their focus to the St. Petersburg pair. Mikhail Irzak claimed to work in marketing. Public records show Igor Sladkov was a prolific entrepreneur with interests in restaurants, residential real estate, non-alcoholic beverages, and media buying.

Investigators got a warrant to access Sladkov’s i