SEBASTIAN DRACOPOL

Summary

Sebastian Dracopol, a project manager from Bucharest who presents himself as an IT professional on dracopol.com and LinkedIn, was directly involved in at least two crypto projects that collapsed after raising significant funds from investors. One of them — Online.io — was investigated and exposed by Brian Krebs, the world's most respected cybersecurity journalist, as built on the infrastructure of a botnet classified by Kaspersky as a Trojan horse.

Dracopol has erased all traces of his involvement from his public profiles. But the evidence remains.

I. Artemine — the first dead project

In September 2017, an ERC-20 token called Artemine (ARTE) appeared on the crypto market, presented as "First Self Mining Smart Contract 2.0." The ICO ran between September 14 and October 14, 2017.

The contract was deployed on Ethereum at address 0x5f6e...ea50. 2,898 genesis addresses were created, and the token reached an all-time high of $1.94.

Figure 1: Artemine (ARTE) token on Etherscan — 3,090 holders, tag "Website Down".

What happened

Developers stopped all activity in February 2018. On BitcoinTalk, investors started demanding explanations:

"What did you do with our funds, Sebastian Dracopol and the developers?" — Space-Cowboy1

The phantom account "Neal_Astartes"

When fraud accusations exploded on BitcoinTalk in June 2018, a new account appeared — Neal_Astartes (Newbie, Activity: 14, Merit: 0) — created specifically to attack investors who asked questions:

"We already have a group dedicated to find your true identity, and believe me, we will succeed [...] a long stay in jail awaits you." — Neal_Astartes

Figure 2: Artemine thread on BitcoinTalk — Neal_Astartes threats to investors.

Investors identified this account as belonging to Dracopol or the development team: Neal_Astartes posted a screenshot from an investor's Twitter account — a screenshot only Dracopol could have had, because the investor had posted that tweet after being banned from Telegram by Dracopol.

Investor testimony on BitcoinTalk

On the Artemine ANN thread, major investors came forward to describe their experience. One of them, user Space-Cowboy1, wrote a detailed account confirming that Dracopol was "Head of Development" for Online.io while simultaneously running the Artemine Telegram as its sole admin — censoring and banning investors who asked questions about the dead project.

"Seb Dracopol has constantly attempted to deny he has any direct involvement in this project, yet it has been proven he has been the main admin for the Minereum and Artemine Telegram threads; and that he constantly censors and bans concerned investors to cover up the fact there is nothing happening with this project." — Space-Cowboy1, BitcoinTalk, June 15, 2018

Figure 2b: Artemine thread on BitcoinTalk — Investor Space-Cowboy1 exposes Dracopol as "Head of Development" for Online.io, details his censorship of investors, hiding of LinkedIn involvement, and pattern of denial. Includes evidence links, YouTube video, screenshots of threats, and Telegram conversations.

"We got scammed" — Joeybeaver1

Another major investor, Joeybeaver1, posted a passionate testimony confirming that Minereum, Artemine, and Online.io were all run by the same person — Sebastian Dracopol. He describes how the developer went from "super active and very helpful" to "completely disappearing," how investors were threatened and banned for asking questions, and how evidence posted by user LGBTQ led to account bans rather than answers.

"Dan has posted a ton of evidence that show without a shadow of a doubt that Minereum, Artemine and online.io are all ran by the same person Sebastian Dracopol." — Joeybeaver1, BitcoinTalk, June 15, 2018

Figure 2c: Artemine thread — Investor Joeybeaver1 confirms Minereum, Artemine, and Online.io are "all ran by the same person Sebastian Dracopol." Describes how the dev disappeared, threatened investors, and banned anyone who spoke out.

II. Online.io — $47 million ICO that delivered nothing

Shortly after abandoning Artemine, Dracopol appeared in a much more visible role: Development Manager of Online.io.

Online.io presented itself as a blockchain platform that would eliminate ads, malware, and online tracking. The ICO ran between June 15 and July 31, 2018, with a hard cap of $50 million. According to CryptoTotem, the project raised $47,201,871.

Figure 4: "Seb_Online.io" account on BitcoinTalk — Dracopol signs as "Online.io - Development Manager".

Community warnings on BitcoinTalk

During the Online.io ICO, investors from the Artemine community came to the Online.io ANN thread on BitcoinTalk to warn potential buyers about Dracopol's track record. User LGBTQ posted a detailed warning naming Sebastian Dracopol as "Development Manager at Online.io" and exposing his role in the failed Artemine project.

Figure 4b: Online.io ANN thread — User LGBTQ warns the community about Sebastian Dracopol's involvement in the failed Artemine project.

The response from Alexandru Iulian Florea, CEO of Online.io, is remarkable. Rather than addressing the allegations, Florea claimed that Dracopol was merely a "volunteer from the community responsible to remove Spam" on the Artemine project — directly contradicting the evidence that Dracopol was the sole Telegram admin with full control. Florea vouched for Dracopol as "a correct, honest person that never scammed anyone."

Figure 4c: Online.io CEO Alexandru Florea responds on BitcoinTalk, claiming Dracopol was just a "volunteer" and "a correct, honest person." The same Florea was later exposed by Brian Krebs as the operator of the Microleaves botnet.

What was promised

"We will have the beta version of the wallet in September [2018]."

"Our development team is working full steam."

What was delivered

"Just a Development Manager"?

Dracopol's official title at Online.io was Development Manager. At Artemine, he claimed to be merely a "Telegram communications volunteer." These modest titles suggest a minor, peripheral role.

But a private conversation between a Getica member and Dragoș Inoan — Dracopol's associate and co-founder of the far-right NGO Patria Prima — paints a very different picture. Inoan states:

"Seb brought somewhere over 7 figures to them."

Figure 4d: Signal conversation — Dragoș Inoan (co-founder of Patria Prima) confirms that Dracopol "brought somewhere over 7 figures" to the Ukrainian developers. Surrounding messages censored for privacy.

Seven figures — over $1,000,000 — moved to the Ukrainian development team. That is not a responsibility entrusted to a mere "Development Manager," let alone a "Telegram volunteer." That is the role of someone who controls the money.

The pattern is consistent: at Artemine, Dracopol was officially just "the guy who managed the Telegram." At Online.io, just "Development Manager." Yet behind these deliberately vague titles, he was the one banning investors who asked questions, the one operating fake accounts to threaten people, and — as his own associate now confirms — the one moving seven-figure sums.

III. The CEO behind the curtain: Alexandru "Acidut" Florea

If Dracopol was the public face of Online.io, the man behind the project was Alexandru Iulian Florea — a person with a documented history in the world of cybercrime.

In July 2022, Brian Krebs published a major investigation: "Breach Exposes Users of Microleaves Proxy Service".

Figure 5: Brian Krebs article on krebsonsecurity.com — "Breach Exposes Users of Microleaves Proxy Service", July 28, 2022.

Figure 6: "WHO IS ACIDUT?" section from the Krebs article — documenting Florea's activity on cybercrime forums including Carder.pro (Russian carding forum) and OpenSC.

Botnet built with tools purchased from Russian hackers

Acidut's private messages from the OpenSC forum demonstrate the purchase of a licence for the Eleonore Exploit Kit — a browser exploit package used, among other things, in attacks on US government websites.

In 2011, Acidut wrote on Hackforums that he was building a botnet, generating 3,000–5,000 new bots per day. By November 2013: 26 million residential SOCKS proxies.

Kaspersky classifies the Microleaves software as a Trojan horse that "hijacks the user's internet connection as a proxy without notifying them" and disguises itself as Microsoft Windows Update.

Figure 7: "ONLINE.IO (NOW MERCIFULLY OFFLINE)" section from the Krebs article.

"Translation: If you install our proxy/CAPTCHA-solving/adware botnet on your computer — or as an exploit kit on your website — we will make millions hijacking ads, and you will be rewarded with heaps of shitcoin that will soon be worthless." — Brian Krebs

Figure 8: UK Companies House — ONLINE.IO BLOCKCHAIN TECHNOLOGIES LTD, Company number 11251601.

IV. Connections to the Russian cybercrime underground

V. He does it again: Ice Open Network

The story doesn't end with Online.io's death. Alexandru Florea, now under the pseudonym "Zeus", launched a third crypto project: Ice Open Network (ION), at ice.io.

The promised social platform is called "Online+" — exactly the same name from Online.io. The tokens are called "ICE" — the name comes directly from the original Online.io whitepaper.

Figure 9: ScamMinder rates ice.io with a trust score of 10/100 — labelled "Scam".

VI. Behavioural pattern: threaten, deny, move on

Today, Dracopol presents himself as "Senior Project, Product & Delivery Manager" on LinkedIn, with 20+ years of experience. His about.me profile still lists "ICO / Blockchain coordination" as a specialty — but without mentioning any specific project.

VII. The Online.io team — where are they now?

VIII. Patria Prima — the criminal screams "criminals"

After Online.io's collapse and erasing his crypto past from his CV, Sebastian Dracopol reinvented himself — not as an honest project manager, but as a "civic activist" through the NGO Patria Prima, founded by himself in September 2025.

Under the guise of "research" and "exposing" supposed anti-Romanian currents, Patria Prima actually functions as a vehicle for harassment, defamation, and intimidation.

Figure 10: Patria Prima homepage on Substack — Sebastian Dracopol, "President and Founding Member".

Figure 12: Valentina Dracopol — co-founder, wife of Sebastian Dracopol.

Figure 13: Dragoș Inoan — third co-founder of Patria Prima.

Attack on Getica volunteers

Figure 11: Defamation article published by Patria Prima against Getica volunteers.

IX. Dracopol confirms the Kharkiv connection

Although Dracopol has erased his Online.io involvement from all public profiles, on his Twitter account @derapaje he made a fatal mistake: he repeatedly mentioned having "friends in Kharkiv" — exactly the city where Zfort Group, the company that developed the Online.io platform, is based.

Figures 15–16: Tweets from @derapaje (May 10, 2024) — Dracopol repeatedly mentions "friends in Kharkiv". The Online.io dev team (Zfort Group) was based exactly in Kharkiv, Ukraine.

A note on the Ukrainian developers

It is important to emphasize that the Ukrainian development team — Zfort Group from Kharkiv and the individual developers listed in the Online.io team — were most likely honest professionals who were hired and paid to build software, not participants in the fraud. They were an outsourced development team doing contracted work. There is no evidence suggesting they knew about the botnet infrastructure, the Microleaves connection, or the intentions of Florea and Dracopol.

The best proof of this is Rostyslav Bortman, listed as "Ethereum Developer" on the Online.io team. After Online.io collapsed, Bortman went on to become Head of Blockchain at IdeaSoft and founded ETHKyiv — a major Ethereum hackathon series in Ukraine. In 2024, Vitalik Buterin himself attended Bortman's hackathon in Kyiv and publicly praised Ukrainian Web3 developers for their innovative contributions to the ecosystem.

A developer personally endorsed by the creator of Ethereum does not need to be associated with the fraudulent actions of his former employers. The responsibility for the Online.io scam lies squarely with Alexandru Florea and Sebastian Dracopol — the people who managed the project and the money, not the engineers who wrote the code.

X. Florea and the shadow of Russian intelligence

Alexandru "Acidut" Florea did not operate in a vacuum. His documented presence on forums like Carder.pro, OpenSC, and Hackforums places him in the same underground ecosystem as some of the most dangerous cybercriminals in history — and, by extension, within reach of the Russian Federal Security Service (FSB).

Maksim Yakubets — "Aqua"

The most significant connection runs through Maksim Yakubets (alias "aqua"), the leader of Evil Corp — described by the U.S. Department of Justice as responsible for "the world's most egregious cyberattacks", causing over $100 million in damages using the Dridex and Zeus banking trojans.

Yakubets was a core member of the Jabber Zeus crew (2009–2010) and later founded Evil Corp. He was active on the same type of underground forums where Florea operated — forums where exploit kits, botnet infrastructure, residential proxies, and pay-per-install services were bought and sold. Florea's Microleaves service offered exactly the kind of infrastructure that operations like Zeus and Dridex required: millions of compromised residential IPs to route stolen banking credentials through.

The FBI placed a $5 million bounty on Yakubets — the largest ever for a cybercriminal.

FBI Most Wanted poster — Maksim Viktorovich Yakubets, alias "AQUA". Reward: $5 million. The highest bounty ever placed on a cybercriminal.

The FSB connection

What makes this ecosystem especially dangerous is its direct ties to Russian state intelligence. In 2017, Yakubets married Alyona Benderskaya — the daughter of Eduard Benderskiy, a former officer of FSB Directorate "V" — Vympel, one of Russia's most secretive special forces units, originally created for assassinations, sabotage, and clandestine operations behind enemy lines.

According to the U.S. Department of the Treasury, Yakubets has been working directly for the FSB since 2017, stealing classified documents and conducting cyber operations on behalf of the Russian government. His father-in-law Benderskiy was sanctioned in October 2024 by the U.S., UK, and Australia for helping protect Evil Corp from law enforcement through his FSB connections.

An investigative report by Meduza revealed the quid pro quo: hackers work for the FSB and avoid attacking Russian targets; in return, the FSB does not prosecute them, allowing them to accumulate enormous wealth. Yakubets drove a Lamborghini with a license plate reading "VOR" (Russian for "thief") through the streets of Moscow, untouched by Russian police.

The Vympel connection

Vympel (Directorate V of the FSB Special Purpose Center) was established in 1981 as a KGB unit for covert sabotage and assassination. Its operatives participated in the 1979 assault on the Tajbeg Palace in Kabul and the assassination of Afghan President Hafizullah Amin. In the post-Soviet era, Vympel operatives were linked to the 2019 assassination of Chechen exile Zelimkhan Khangoshvili in Berlin. This is the unit from which Yakubets' father-in-law Eduard Benderskiy came — and through which Evil Corp's operations received state protection.

A generation of hackers turned state weapons

Yakubets is not an isolated case. He belongs to an entire generation of black-hat hackers who emerged from Russian cybercrime forums in the 2000s and 2010s and were systematically recruited by Russia's intelligence services — the FSB, the SVR (Foreign Intelligence Service), and the GRU (Military Intelligence).

The pattern is well-documented: talented hackers are identified through their criminal activity, offered a choice between prosecution and cooperation, and then integrated into state-sponsored cyber operations. Today, these same individuals and their networks are at the forefront of hybrid warfare operations against NATO and European institutions — conducting espionage, disrupting critical infrastructure, interfering in elections, and launching destructive cyberattacks against Ukraine and its allies.

Groups like Sandworm (GRU Unit 74455, responsible for the NotPetya attack and Ukrainian power grid sabotage), APT29 / Cozy Bear (SVR, behind the SolarWinds compromise), and Evil Corp itself (now sanctioned and documented as working directly for the FSB) all draw from the same underground talent pool where Florea once sold his services. The line between cybercrime and state warfare has been erased — and Florea operated on the criminal side of that line for years.

What this means for Florea and Dracopol

Florea operated in the same ecosystem, on the same forums, selling the same type of services (botnets, residential proxies, PPI schemes) that fueled operations like Evil Corp and GameOver Zeus.

Critically, the timelines overlap precisely. Florea (as Acidut) was active on underground forums from 2010 to 2017. Yakubets (as Aqua) operated the Jabber Zeus crew from 2009 to 2010, then ran Evil Corp and Dridex from 2011 onward. For at least seven years (2010–2017), both were active participants in the same Russian-language cybercrime underground — at the same time.

And their services were not just similar — they were complementary. Yakubets' Zeus and Dridex operations stole banking credentials and credit card data. To monetize stolen cards without being traced, carders need one thing above all: clean residential proxies — IP addresses that look like ordinary home users, not flagged datacenter IPs. That is precisely what Florea's Microleaves provided: millions of residential IPs, advertised openly on forums like Carder.pro, the same type of forum where stolen card data was traded.

While we have not found evidence of direct collaboration, there are reasonable grounds for suspicion that they knew each other. In a niche underground economy where one party sells stolen cards and the other sells the anonymization infrastructure needed to use them, operating on the same forums at the same time, it would be more surprising if they hadn't crossed paths.

Dracopol, as Development Manager of Florea's Online.io, was not just involved in a garden-variety crypto scam. He was embedded in a project whose founder was part of an underground cybercrime ecosystem that extends, through documented family and operational ties, directly to the Russian FSB.

XI. Conclusions

Sebastian Dracopol was Development Manager of Online.io — a project that:

1. Was founded by Alexandru "Acidut" Florea, a documented participant in Russian cybercrime forums, buyer of exploit kits, botnet operator
2. Was built on Microleaves infrastructure — classified as a Trojan horse by Kaspersky
3. Raised $47 million through ICO and delivered no product whatsoever
4. Was investigated and exposed by Brian Krebs
5. Is now dead — worthless token, abandoned website

Previously, Dracopol was involved in Artemine — a token that crashed 99.8%, whose funds disappeared, and where investors asking questions were threatened with prison through fake accounts.

His own associate, Dragoș Inoan, co-founder of Patria Prima, confirmed that Dracopol personally moved over seven figures ($1,000,000+) to the development team — a responsibility incompatible with the "just a Development Manager" defense. Someone who controls million-dollar transfers is not a peripheral figure. He is a principal.

Dracopol has erased all traces of this history from his public profiles. But the evidence is on the blockchain. The evidence is in the archived threads. The evidence is in the Krebs investigation. And now, the evidence is in the words of his own associates.

Verifiable sources

Forums (primary sources)

• Thread Artemine — BitcoinTalk
• Thread Online.io — BitcoinTalk
• Space-Cowboy1 (Dan) — Full evidence post with Telegram screenshots, threat screenshots, Artemine team emails, Neal_Astartes threats (June 18, 2018)
• Artemine thread page 1940 — Neal_Astartes threats to investors
• Online.io CEO Alexandru Florea defends Dracopol — "just a volunteer"

Visual evidence (original links — removed by platforms)

• Telegram conversation with Online.io logo and Dracopol's full name — imgur.com/a/jbnTw7k (deleted)
• Dracopol threatening investor with "authorities" — imgur.com/a/LFExhlt (deleted)
• Artemine team emails begging investor to remove evidence — imgur.com/a/74TYI5r (deleted)
• Neal_Astartes (Dracopol) threatening investors on BitcoinTalk — imgur.com/a/N2AcsGT (deleted)
• YouTube video of Dracopol harassing investors on Telegram — youtube.com/watch?v=Cnb4bbLXnRY (removed)

Note: The above evidence was originally posted by investor Space-Cowboy1 (Dan) on June 18, 2018. The Imgur albums and YouTube video have since been removed from their respective platforms. Their existence and content are documented in the BitcoinTalk thread linked above.

Blockchain data

• Artemine (ARTE) — Etherscan
• Online.io (OIO) — CoinMarketCap

Professional investigations

• Krebs on Security — Microleaves investigation
• UK Companies House — ONLINE.IO BLOCKCHAIN TECHNOLOGIES LTD
• ScamMinder — ice.io (10/100)

Yakubets — FSB / Vympel sources

• U.S. Treasury — Evil Corp sanctions (Dec 2019)
• U.S. DOJ — Yakubets indictment
• FBI Wanted — Maksim Yakubets ($5M reward)
• UK NCA — "Evil Corp: Behind the Screens" (Oct 2024)
• UK Gov — Sanctions against Eduard Benderskiy (Oct 2024)
• U.S. Treasury — Benderskiy sanctions (Oct 2024)
• Meduza — "The FSB's personal hackers" (Dec 2019)
• BBC — "UK reveals father and son at heart of Evil Corp hackers" (Oct 2024)