On November 19, 2025, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) officially added former Canadian Olympic snowboarder Ryan James Wedding and his key associates and entities to its sanctions list, freezing all of his assets within the United States and prohibiting U.S. citizens from engaging in any transactions with related parties. Following this, the U.S. State Department increased the reward to $15 million, the Mexican Embassy in China simultaneously released a whistleblowing guide, and the FBI, the Royal Canadian Mounted Police, and Mexican police launched a transnational joint manhunt—this global operation targeting the "Olympic athlete drug lord" exposed the deep-seated criminal connections between cryptocurrency and transnational drug trafficking and serial murders. BlockSec, relying on on-chain tracking technology and specialized research data, reconstructed Wedding's trajectory from a sports star to a criminal tycoon, and the complete logic behind his use of blockchain to build an "untraceable" criminal funding network.

I. From Olympic Athlete to "World's Most Wanted Fugitive"

Born in Thunder Bay, Ontario, Canada in 1976, Waddin was once a promising rising star in winter sports. With his sharp skating style and consistent performance, he successfully made it onto the Canadian national team, representing the country at the 2002 Salt Lake City Winter Olympics, where he distinguished himself in the men's parallel giant slalom event. At that time, he was one of the leading figures in Canadian winter sports, and the attention he received both on and off the field made him accustomed to the spotlight, but it also sowed the seeds of an obsessive desire for "quick success."

After the Winter Olympics, Whedin's life took a sharp turn for the worse. He rejected a contract renewal offer from the professional team, abandoned his years-long career in skiing, and turned to the high-risk business world, eventually becoming involved with a transnational drug trafficking organization. In 2008, he was arrested in California for smuggling cocaine and sentenced to four years in prison in 2010. This prison experience did not make him repent; instead, it became a "stepping stone" for him to expand his criminal network. The various criminals he met in prison laid the foundation for his later transnational drug trafficking network. After his release, Whedin completely shed his "former Olympic athlete" facade, becoming a crime boss codenamed "El Jefe" (Spanish for "boss"), and establishing a drug trafficking organization named after himself (Ryan Wedding Drug Trafficking Organization), which was recognized as an "independent criminal entity" by the US and Canadian authorities.

Waddington's criminal organization was known for its brutality and sophisticated operations. Through deep collusion with the Sinaloa Cartel in Mexico (designated a "terrorist organization" by the United States in 2024), they built a smuggling route from Colombian cocaine production sites, through Mexico, to the United States and Canada, trafficking up to 60 tons of drugs annually, with an annual value exceeding $1 billion, becoming one of the main threats to Canada's national security. To maintain his criminal network, Wadein was ruthless: In November 2023, after a batch of drugs was stolen, he ordered a massacre in Ontario, Canada, resulting in two deaths and one serious injury; between April and May 2024, his gang carried out two murders, with victims including associates who owed drug debts; in January 2025, to cover up his crimes, he instructed his men to shoot federal witness Acebedo Garcia at close range in a restaurant in Colombia. The victim was shot five times in the head and died on the spot. Wadein's lawyer was involved in the entire planning and even suggested "getting rid of the witness to drop the charges."

In March 2025, Whedin officially entered the FBI's Ten Most Wanted Fugitives list, replacing Alexis Flores, who was previously at large. Interpol simultaneously issued a red notice for his arrest. He is currently hiding in Mexico, under the protection of "General El" (édgar aarón vázquez alvarado), a key member of a local drug cartel. He remotely controls his criminal network through encrypted communication tools, while his affiliated Mexican entities, such as VRG energéticos and grupo rvg combustibles, serve as a "legal cover" for his criminal activities.

II. Money Laundering Process

According to the indictment, the Wedding criminal syndicate primarily laundered drug proceeds in US dollars, Canadian dollars, and cryptocurrencies. Specifically, regarding cryptocurrency assets, the syndicate split large sums of money into multiple smaller transfers, quickly transferring them through intermediary USDT wallets, and ultimately depositing the funds into a central Tether wallet controlled by the defendant, Wedding.

The money laundering operations were primarily carried out by SOKOLOVSKI, HOSSAIN, and CANASTILLO-MADRID, along with other individuals known or unknown to the grand jury, who were identified as members of the “Wedding criminal organization.”

Money laundering operations involving drug proceeds

d. The Wedin criminal gang would hide the huge profits from their cocaine sales in the United States and Canada in US dollars and cryptocurrencies.

e. Regarding the use of cryptocurrency: In order to conceal the original source of funds, members and associates of the Weiding criminal gang would use the complex Tether (USDT) network to carry out the following operations: (1) splitting large sums of money into multiple small transfers; (2) first transferring funds quickly through an intermediary USDT wallet, and finally consolidating them into the core Tether wallet controlled by the defendant Weiding.

f. Defendants Sokolovski, Hussein, Canastillo-Madrid, and other individuals known and unknown to the grand jury, provided services to members of the Wiedin criminal gang (i.e., defendants Wiedin and Clark)—specifically, by concealing their drug trafficking proceeds and using those proceeds to facilitate and achieve the gang's criminal objectives. The diagram below shows a simplified flowchart of this money laundering system.

The following is a detailed description of the money laundering process.

Money laundering operations involving drug proceeds

Item 71: Between September 28, 2023 and May 28, 2024, the defendant Sokolovsky received approximately 20,501,784.29 USDT transferred to his Kucoin account (-4119) from a Tether wallet (-9BU3) controlled by a member of the criminal gang.

Item 72: Between May 29, 2024 and August 15, 2024, the defendant Hussein received approximately 48,492,620 USDT transferred to his Tether wallet (-3FcL) from a Tether wallet (-79wf) controlled by a member of the criminal gang.

Item 73: Between May 29, 2024 and August 14, 2024, a member of the criminal gang transferred approximately 8,090,526 USDT from the defendant Sokolovsky's KuCoin account (-4119) to the defendant Sokolovsky's KuCoin account (-4119) via a Tether wallet (-79wf).

Item 74: Between May 29, 2024 and August 12, 2024, the defendant Sokolovsky transferred approximately 9,838,397.84 USDT through his KuCoin account (-4119) to a Tether wallet (-79wf) controlled by a member of the criminal gang.

Item 75: Between June 14, 2024 and October 1, 2024, the defendant Hussein transferred approximately 3,091,001.13 USDT through his Tether wallet (-yoQi, -MtEj) to a TRON wallet (-4n8E) belonging to the defendant Canastillo-Madrid.

Item 76: Between April 29, 2024 and October 8, 2024, the defendant Hussein transferred approximately 98.86% of his total funds (approximately 207,808,779 USDT) to the defendant Weiding's Tether wallet (-g1P1) through a Tether wallet (-yoQi).

Item 77 Public Conduct: On June 18, 2024, Bonilla transferred approximately 17,300 USDT to the defendant Hussein's Tether wallet (-yoQi) to settle his drug debts owed to the defendants Wedin and Clark.

Item 78: Between July 9, 2024 and November 5, 2024, the defendant Canastillo Madrid received approximately 507,078 USDT transferred from a Tether wallet (-rg2a) controlled by Clark into his two Tron wallets (-4n8E and -SG8z).

Item 79: Between July 12, 2024 and September 11, 2024, the defendant Canastillo Madrid received approximately 640,367 USDT from the defendant Wedin's Tether wallet (-g1P1) in his two Tron wallets (-4n8E and -SG8z).

80 Public Act: Between August 15, 2024 and September 7, 2024, the defendant, Wedin, provided approximately 564,571 USDT to victim A, who acted as an intermediary, through a Tether wallet (-g1P1), for the purchase of approximately 300 kilograms of cocaine from the defendant, Riascos, in Colombia.

Item 81: Between August 16, 2024 and September 24, 2024, the defendant Sokolovsky transferred approximately 96,698.50 USDT through his KuCoin account (-4119) to a Tether wallet (-efTu) controlled by a member of the criminal gang.

Item 82: Between June 14, 2024 and October 1, 2024, the defendant Canastillo-Madrid received approximately 3,091,001.13 USDT from three Tether wallets (-3FcL, -yoQi, -MtEj) controlled by the defendant Hussein in his two Tron wallets (-4n8E, -SG8z).

We visualize the above money laundering operation as shown in the following figure.

To further understand the source and destination of these funds, we obtained direct deposits and withdrawals (greater than US$100,000) from these addresses and created the following relationship diagram.

 The edges in the diagram represent fund flows, with colors consistent with the fund sources, and the thickness of the edges is positively correlated with the amount of funds.

Key funding points and role division

The fund flow diagram shows that HOSSAIN and SOKOLOVSKI constitute two significant fund aggregation centers, and the address cluster marked "WEDDING Conspiracy" is the main source of funds for these two centers.

This structure suggests that the WEDDING Conspiracy address cluster may be responsible for upstream fund laundering and drug trafficking functions, and continuously supplying initially obfuscated funds to downstream nodes.

In terms of capital flow, the two paths show a clear divergence:

The vast majority of funds that flowed into SOKOLOVSKI further flowed into KuCoin, indicating that it mainly played the role of completing the final cleansing and monetization through centralized exchanges;
Funds collected at HOSSAIN primarily flowed to addresses controlled by Ryan James Wedding, and were subsequently transferred to an address that has now been blocked by USDT: TK7c41TjffeDvofXfnNnKt5zn3F1w33BkF (SUSPECT-33BkF).

 Active time of SUSPECT-33BkF

 WEDDING-Yg1P1's active time

On-chain activity time analysis shows that SUSPECT-33BkF and WEDDING-g1P1 have a high degree of overlap in their activity cycles, and their time distributions are almost identical. Based on this characteristic, it can be reasonably inferred that SUSPECT-33BkF is a substitute or extended address for Wedding to continue using for money laundering activities in subsequent stages.

Further analysis of SUSPECT-33BkF using the BlockSecCompliance platform revealed the following:

99.22% of its deposits came from addresses that had been sanctioned or flagged (i.e., the Wedding-related addresses in this case);
Nearly 40% of its withdrawals went to addresses that are currently blocked by USDT.

The address's funds are highly concentrated in high-risk entities, both in terms of source and destination, further reinforcing the conclusion that it occupies a key position in the Wedding criminal organization's money laundering chain.

More analysis:

https://app.blocksec.com/phalcon/v2/address/scan/-2/TK7c41TjffeDvofXfnNnKt5zn3F1w33BkF

III. Industry Implications: Crime Prevention and Governance in the Crypto Era

The Wedin Group case is not an isolated incident. BlockSec's special research found that since 2024, transnational crimes involving privacy coins have increased by 187% globally, and the abuse of crypto technology by criminal groups has shown a trend of "professionalization, scaling, and globalization." This case not only exposes the weaknesses in the regulation of crypto assets but also provides important governance insights for the blockchain security industry and law enforcement agencies.

For ordinary users, it's crucial to be wary of the misconception that "anonymous transactions equal absolute security." The case of the Weiding Group demonstrates that even with privacy coins, transaction history can still be traced through professional technical analysis. Ordinary users who inadvertently interact with addresses linked to criminal activities may face the risk of asset freezing. It is recommended to prioritize trading on compliant exchanges, avoid platforms without KYC verification, regularly check the risk status of wallet-linked addresses using blockchain security tools, and refuse large transfer requests from unknown addresses.

For law enforcement agencies and industry, building a collaborative mechanism integrating "technology tracking + cross-border cooperation + compliance supervision" is crucial. BlockSec's experience demonstrates that blockchain technology itself is an important tool in combating crime—through technologies such as address clustering, cross-chain tracking, and behavioral profiling, it can effectively break through the "anonymous disguise" of crypto crimes. In the future, it is necessary to further strengthen cross-border judicial cooperation, establish a globally unified platform for sharing crypto crime leads, and simultaneously promote exchanges to implement "KYC + transaction monitoring" obligations, intercepting transactions involving sanctioned lists and high-risk addresses in real time to curb the flow of criminal funds at the source.

From his glorious moments on the Olympic stage to becoming a "tainted figure" on the OFAC sanctions list, Weiding's trajectory of downfall is lamentable. His story serves as a warning that the neutrality of technology needs to be properly guided, and the innovative value of cryptocurrencies should not be abused by criminal groups. BlockSec will continue to delve into blockchain security technology, building more comprehensive crime tracking models through specialized research. This will not only strengthen asset protection for ordinary users but also provide precise and efficient technical support for law enforcement agencies, driving the crypto ecosystem towards "security, compliance, and trustworthiness," ensuring that every crypto transaction can withstand public scrutiny.

Ryan James Whedin remains at large in Mexico. The U.S. State Department has increased the reward for his capture to $15 million (including $10 million from the Drug Rewards Program and $500,000 from the FBI). The Mexican Embassy in China has also launched a multilingual reporting tutorial. Any individual or organization providing valid leads (including his specific hiding address, contact information, and information about associates) that assists in Whedin's arrest can submit information and claim the reward through the following channels:

Official FBI channels: Submit anonymous leads by logging into the FBI's "Ten Most Wanted Fugitives" section on the official website (www.fbi.gov/wanted/topten);
Mexican law enforcement agencies: Submit information through the encrypted whistleblowing platform of the Mexican Attorney General's Office (FGR);
International Collaboration Hotline: Contact the Interpol Regional Office, and leads will be simultaneously sent to the joint pursuit team in the United States, Canada, and Mexico.
The FBI emphasizes that all tip-offs will be kept strictly confidential, and those who provide information can receive the reward without revealing their identity.

加密钱包MathWallet已将2022年Q4赚取收益的20%用于回购MATH并已销毁

Popular Articles