U420, “Mexican” and counterfeit euros. The people, threats against Bihus and Operation Carthage

Public-source analysis, checked on 5 November 2026, including NABU’s announcement of five suspects. Investigative allegations are not findings of guilt. Web graphics and the English PDF use English; the Polish PDF contains Polish versions.

U420, a currency workshop and a system of protection

Ukrainian investigators connect the U420 retail network, a clandestine counterfeit-euro workshop and discussions of violence against journalists through overlapping participants and alleged protection by public officials. Materials released on 4 November and five notices of suspicion announced on 5 November 2026 describe a much wider investigation than a controversy over cannabis-themed “souvenirs”. [1][2]

Two aliases provide the main connection. Ukrainska Pravda identifies “Mexican” as Russian citizen Yegor Burkin, also known as Yegor Levchenko, and identifies “Kriminal”, citing law-enforcement sources, as Andriy Osipov. According to the investigation as reported, the former controlled U420 while the latter held a stake and received a share of turnover. Those are allegations, not findings of guilt. [5]

NABU, Ukraine’s National Anti-Corruption Bureau, and the Specialised Anti-Corruption Prosecutor’s Office describe a new organisation uncovered within Operation Carthage. Its activities allegedly included scam call centres, drug sales, counterfeit currency and cigarettes, and violence. Investigators say it had at least 12 participants and bought protection from representatives of the SBU security service, police and Prosecutor General’s Office. [1]

The common mechanism matters more than a shared brand. If established in court, the allegations would show officials protecting several criminal revenue streams at once. They do not imply that every shop employee, advertising influencer or official in those institutions knew about the currency workshop or the threats. Individual acts and knowledge must be proved separately.

What the five notices of suspicion establish

On 5 November NABU announced suspicion against an alleged organiser, a senior SBU official, a senior National Police department official, a deputy head of a criminal-investigation division in Kyiv region and a subordinate of the organiser. Its public announcement describes positions and roles rather than a complete named list. [2]

The organiser’s listed qualifications include organising an offence under Article 199(3) of Ukraine’s Criminal Code. The regional police officer is accused, among other acts, of assisting an offence under the same provision. Other qualifications concern criminal organisation, corruption and torture. The announcement does not assign every listed offence to every suspect. [2]

Article 199 covers counterfeit currency, including foreign currency, but is broader than euros alone. Linking the legal qualification to the reported workshop episode supports the conclusion that counterfeiting is part of the investigation. A notice of suspicion remains different from an indictment or a conviction. [24][9]

U420: products, laboratory tests and an important timing issue

Bihus.Info’s original reporting preceded the November disclosures. On 23 March the newsroom described purchases at three Kyiv U420 shops and testing through private and state laboratories. It said a forensic centre’s examination identified a synthetic cannabinoid in products marketed as souvenirs. [3]

The newsroom also reported a crucial qualification: the substance entered the prohibited list on 5 February, while the samples had been purchased several days earlier. A positive laboratory result cannot, without checking the applicable date and rule, prove that each sale was already unlawful when made. The reporting raised the possibility of changing formulations in response to successive prohibitions. [3]

In April Bihus.Info published police correspondence saying an investigation concerning U420 had existed since July 2025 and that reporter Svitlana Stetsenko’s complaint had been added to it. The newsroom criticised a later police response for repeating the network’s description of itself as CBD cafés and franchise shops while failing to address the supplied examination results. That criticism is the newsroom’s assessment of the response. [12]

On 14 April National Police officially announced searches and referred to criminal organisation, drug trafficking and money laundering proceedings. It said documentation of shop activity had been underway since December 2025. July and December may describe different procedural stages; they should not be silently merged into a single date. [13]

On 22 April police publicly described U420 as a project of Khimprom, the group also transliterated from Ukrainian as “Chimprom”. Police described its leader as a Russian citizen known as “Mexican”, abroad and internationally wanted since 2019. The November disclosures therefore did not create the first public connection between the shops and that environment. [4]

Why Denys Bihus became a target

Denys Bihus founded Bihus.Info, but the U420 reporting was a team effort, including work by Svitlana Stetsenko. Presenting the story as a personal dispute with a shop owner obscures its public-interest purpose: documenting products and obtaining a response from state institutions. Detector Media also reported on Stetsenko’s work and subsequent harassment. [25]

Radio Svoboda’s account of the released materials describes pressure intended to stop publication, followed by discussion of threats and violence if persuasion failed. It also reports investigators’ account of advance warnings about searches presented as a response to media attention. These details come from the released investigation as described by that outlet. [6]

Interfax-Ukraine reports a conversation attributed to “Mexican” discussing an acid attack on Bihus. The described objective was permanent disfigurement and preventing him from continuing to appear on camera. The agency also describes a suggestion to consult people in relevant structures. That account does not independently establish that such consultation occurred. [7]

Channel 24 describes another scenario: inviting the journalist to an event in the Dominican Republic or Mexico as a pretext for kidnapping him. Public discussion of that idea is not proof that an invitation was sent, executors were recruited or an operation began. The Institute of Mass Information separately recorded the acid-attack threat in connection with the U420 investigation. [26][27]

Threats and violent plans are not a proven murder contract

The material is exceptionally serious. It nevertheless does not justify replacing the reported facts with a different, more categorical claim. The public sources reviewed do not establish that a contract to murder Bihus was agreed and put into effect. They support reporting that participants, according to investigators’ released materials, discussed kidnapping and brutal violence against him.

A separate passage concerns veteran and former Russian prisoner of war Viktor Lakhno, known as “Leleka”, who opposed U420. Censor.NET describes talk of acid or hammers and his public account of threats and offers of money. Graphic language in different recordings must not all be attributed to a single intended victim. [8]

Counterfeit euros: shared participants, different responsibilities

Rakurs’s account of the NABU/SAP materials describes a hidden workshop established in 2026 with printing equipment and equipment intended to imitate banknote security features. It identifies “Kriminal”, “Pasha” and the police officer “Consultant” as principal figures in that episode. [9]

Babel reports discussion of denominations from €5 to €500. That describes the range discussed; it does not prove that each denomination was successfully produced, circulated or seized. Reports about proposed quality and production cannot replace forensic examination or seizure records. [10]

This is where the shortcut “Mexican printed euros” becomes misleading. The workshop is attributed to people within the same network as U420 and “Mexican”, but the currency episode assigns central roles to other participants. Organising, financing, supervising and distributing counterfeit notes are distinct responsibilities requiring individual evidence. [5][9]

Ukrainska Pravda’s 5 November overview also mentions notes taken to Germany. That is a significant international lead, attributed here to that publication. The reviewed public material did not reveal a separate German police or Europol announcement identifying a seized batch as the product of this particular workshop. [11]

What remains unknown about the workshop

Public accounts reviewed do not resolve its exact location, the total face value produced, completed sales or independent assessment of quality. Nor did the newsroom identify a public European case reference linking a specific foreign seizure to this production. “Factory” is therefore a journalistic description of the workshop, not demonstrated industrial output.

Counterfeiting and money laundering are also different activities. One creates imitation means of payment; the other disguises criminally derived value. Their appearance in the same investigation does not justify adding a proposed face value to alleged bribes and presenting the total as verified criminal turnover.

The alleged protection system

Ukrainska Pravda describes “Prais” as protecting call centres from the police side, “Consultant” as handling security and selected activities, and “Akim”, a senior SBU official, as shielding the organisation from other members of the service. [14]

The same publication reports at least 52 call centres with around 2,700 workers and an alleged monthly protection charge of $7,000 per office. Addresses and identifiers were reportedly collected centrally and payments made in cryptocurrency. Those figures concern the reported call-centre protection system; they are not established U420 profits or counterfeit-euro production totals. [14]

Names, aliases and procedural status

The official 5 November announcement lists roles. Media identifications, often based on unnamed law-enforcement sources, supply the names below. A search, a mention in a recording and formal suspicion are different procedural facts. [2][29]

Yegor Burkin / Yegor Levchenko — “Mexican”

Ukrainska Pravda identifies the Russian citizen described as Khimprom’s leader. In the reported investigation he controlled U420 and discussed violence against people exposing the network. Police had already described the leader as abroad and wanted since 2019. His appearance in the organisation’s narrative does not mean he was detained alongside the five people in the November announcement. [4][5]

Andriy Osipov — “Kriminal”

Osipov connects the alleged commercial interests, institutional protection and currency workshop. Media describe him as the organiser and a participant in U420. Slovo i Dilo, citing anti-corruption law-enforcement sources, names him among the five people given notices of suspicion. Workshop reporting identifies “Kriminal” alongside “Pasha” and “Consultant”. [5][9][29]

Osipov also appeared in an earlier, separate case concerning a demand for $1 million in exchange for claimed SBU influence and help avoiding extradition to Russia. Ukrainska Pravda describes his detention and custody decisions. That alleged demand is not the value of counterfeit production. The outlet attributes investigators’ access to senior officials to examination of his phone, citing its sources. [35]

Serhiy Duka — “Akim”

Ukrainian outlets identify “Akim” as an SBU general and first deputy head of its Department for the Protection of National Statehood. He allegedly shielded the organisation from the service’s attention. Media name him among the five new suspects. The official announcement assigns the corresponding senior SBU role a criminal-organisation qualification; it does not assign every currency or violence allegation to him. [2][11][29]

Volodymyr Tsenov — “Prais”

Tsenov is described as first deputy head, and acting head, of the National Police Department of Strategic Investigations. He allegedly protected scam call centres. Media identify him as another of the five suspects; the official announcement gives criminal-organisation and improper-benefit qualifications for the corresponding departmental role. Call-centre protection is not evidence that he personally printed banknotes. [2][11][29]

Oleksandr Demyanchuk — “Consultant”

Media identify him as a deputy head of a division in the Kyiv regional police criminal-investigation directorate. His role is particularly relevant to the currency episode: “Consultant” appears in workshop accounts, while NABU lists assistance in an Article 199 offence for the corresponding police role. The full-name identification comes from media reporting rather than an official named list. [2][9][29]

“Boxer” and “Pasha”: limits of identification

Slovo i Dilo names boxing-club founder Oleksandr Rybalko among the five suspects. Hromadske Radio, relaying identifications by the Mezha anti-corruption centre, calls “Boxer” Vitaliy Rybalko. That first-name discrepancy remains unresolved here. A similar surname or an unrelated online portrait cannot settle it. “Pasha” appears in the workshop episode, but the reviewed sources did not provide equally strong confirmation of his full identity. [29][30][9]

This is not a list of convicted people, nor an exhaustive list of everyone mentioned in Carthage. Membership, protection, assistance in counterfeiting and execution of violence each require separate proof.

Davyd Arakhamia: two separate strands

Davyd Arakhamia, head of the Servant of the People parliamentary faction, appears in discussion of the disclosures. His name must be separated from procedural decisions and from what other people say they intend to do.

Ukrainska Pravda’s overview mentions a proposed conversation with Arakhamia. That is a lead concerning possible access to a politician. It does not establish that a meeting occurred, that he accepted a benefit, knew about the workshop or participated in violent plans. NABU’s announcement about the five suspects does not include a parliamentarian. The reviewed material contains no official confirmation that Arakhamia received a notice of suspicion in this U420 and counterfeit-euro episode. [11][2]

Separately, on 4 November the Anti-Corruption Action Centre, AntAC, reported that the High Anti-Corruption Court upheld its complaint. According to the organisation, judge Markiyan Halabala ordered acting prosecutor general Anton Kovalsky to register information about a possible offence involving Arakhamia. AntAC’s complaint concerned alleged payments to MPs for parliamentary votes. Ukrainska Pravda also reported the development. It is a separate “envelopes” strand, not a finding about U420 financing. [31][33]

AntAC had previously reported a NABU response explaining that the required registration by the prosecutor general was needed before investigators could examine the complaint concerning an MP. The organisation presents correspondence, but is also the complainant; its account is not a substitute for complete court records. [32]

Registering information about a possible crime permits investigation. It is neither a finding of guilt nor a substitute for formally notifying a person of suspicion. Describing Arakhamia as a suspect in the U420 affair would therefore go beyond the material verified here. The supported account is narrower: his name appears in reporting about other people’s planned contact, and a separate court-related development concerns possible parliamentary corruption. [2][11][31]

Even proof of unlawful voting payments would not automatically prove involvement in counterfeiting. Conversely, a participant’s claim about a political contact requires investigation of whether contact happened and what it concerned. A persuasive map of names is not yet a reconstruction of criminal responsibility.

Ministers mentioned in recordings

The materials also concern attempts to influence decisions on restricting substances sold through U420. Ukrainska Pravda describes discussion of government figures while expressly noting that transfers of bribes to ministers had not been established. An intention discussed by suspects does not even establish that an actual proposal reached its intended recipient. [11]

Participants may exaggerate their contacts, invoke names or discuss unfulfilled intentions. A name in someone else’s conversation does not prove receipt of a benefit. Questions about protection are justified; categorical accusations require an identifiable act and supporting evidence.

The SBU response

On 4 November the SBU officially said its head Oleksandr Poklad had removed two senior officials from their positions. It pledged cooperation with NABU and SAP and referred to contacts with foreign partners regarding other jurisdictions. Poklad also called on “Mexican” to come to Ukraine and submit to law enforcement. [15]

That is a confirmed institutional response, not an admission of guilt by the removed officials or proof that the case is complete. It does not identify Europol as a partner in the currency episode. The meaningful test is preservation of evidence and independent adjudication, beyond the announcement of removals.

INTERPOL: an earlier wanted-person lead, not a new confirmed euro operation

On 22 April Censor.NET reported a briefing at which senior National Police official Maksym Tsutsikiridze discussed earlier attempts to secure the Khimprom leader’s extradition. According to the reported statement, an INTERPOL Red Notice remained active and additional suspicion information would be transmitted through the appropriate channels. This is a Ukrainian official’s statement reported by media, not fresh November confirmation from INTERPOL itself. [17]

The international-search strand thus predates the workshop disclosures. It does not establish that an earlier notice covered counterfeit-euro production alleged in 2026. Its identity, underlying case and current scope must not be inferred simply from a nickname.

INTERPOL explains that most Red Notices are available only to law enforcement. Absence from its public website therefore does not establish that no notice exists. The organisation also directs questions about specific cases and extradition to the responsible national authorities. [18]

A Red Notice is not an international arrest warrant overriding domestic law. It requests location and provisional arrest, with legal consequences determined by each country. It does not convict the person concerned or replace national extradition procedures. [28]

What still needs confirmation

Four separate facts matter: the identity covered by a notice, the authority and underlying case, the notice’s current status, and the legal basis for any detention in the country of residence. The April statement does not fully answer those questions for November. In particular it does not say whether later currency allegations were added to the earlier search. [17][28]

INTERPOL facilitates police cooperation; it does not run a Ukrainian criminal trial in NABU’s place. An extradition request needs action by competent authorities and consideration under the receiving country’s law. Reports of residence in Mexico and the nickname “Mexican” establish neither Mexican citizenship nor successful service of an extradition request. [18][28]

The newsroom found no public INTERPOL announcement confirming its participation in the newly disclosed U420, currency-workshop and journalist-threat episode. No individual response was obtained from the organisation. Operational information exchange may be confidential, so absence of an announcement proves neither involvement nor non-involvement.

Europol: relevant competence does not establish participation

Europol serves as the European Central Office for combating euro counterfeiting. A 2019 announcement concerning a separate darknet operation describes that function. It is evidence of competence, not evidence about Operation Carthage. [19]

An operational and strategic cooperation agreement signed with Ukraine in December 2016 provides a framework for information exchange against serious crime. The framework alone does not show that Europol participated in this specific Ukrainian investigation. [20]

No reviewed public Europol announcement directly connected the agency to U420 or this workshop. There is consequently no basis here for a claim that “Europol dismantled Mexican’s euro factory”. A useful unanswered question is whether Ukrainian investigators transmitted banknote samples and information about distribution abroad.

For context, the European Central Bank reported 444,000 counterfeit euro notes withdrawn in 2025, equivalent to 14 per million authentic notes in circulation. Those general figures have no established connection to this workshop and must not be represented as its output. [21]

Carthage is wider than one automatically shared case number

On 5 September NABU described a group allegedly led by a Prosecutor General’s Office official, collecting money for call-centre protection and laundering assets. On 22 October it announced another suspect in that strand. The 4 November announcement expressly describes a new organisation within the same operation. [22][23][1]

The operation’s name therefore does not make every report the same charge, participant list or criminal-proceeding number. The prosecutorial strand and the newly disclosed network should remain connected in context without being collapsed into a single undifferentiated allegation.

Chronology

• 23 March 2026: Bihus.Info reports laboratory findings concerning U420 products. [3]
• 14 April: National Police announce searches of the network. [13]
• 22 April: Police publicly connect U420 with Khimprom. [4]
• 5 September: NABU describes the prosecutorial call-centre protection strand. [22]
• 22 October: Another notice of suspicion in that strand. [23]
• 4 November: New materials link U420, violent plans and counterfeit foreign currency. Separately, AntAC reports the court development concerning Arakhamia. [1][31]
• 5 November: NABU announces five suspects, including Article 199 qualifications. [2]

The central question: who enabled the system?

The material supports a serious account of overlapping people and protection mechanisms linking U420, threats against Bihus and an alleged euro workshop. It does not justify making every person a shop owner, printer, bribe payer and murder contractor simultaneously.

If proved, the institutional scandal would concern the ability to purchase several forms of state protection: information about police interest, warnings about investigative action and shielding of different criminal businesses. In that model corruption is infrastructure enabling several revenue streams to coexist.

The next evidential questions are concrete. Who financed and supervised the workshop? Where did the notes go? Can they be matched to seizures abroad? Who knew of the plans concerning Bihus and Lakhno? Did discussion become preparation or execution? Which people acted and which merely appeared in others’ boasts?

Answers require case records, forensic analysis, traceable financial flows and judicial scrutiny. The strongest supported conclusion needs no invented sensation: Ukrainian investigators connect U420’s business environment with people suspected of counterfeiting and planning violence, including allegations about officials whose duty was to protect society.

How this article was researched

Official investigative announcements describe investigators’ allegations, not independent judgments of guilt. Several media accounts rely on the same released NABU/SAP material and are not separate evidential confirmations. The newsroom did not independently authenticate the complete recording, interview suspects or obtain individual responses from INTERPOL and Europol. Agency-related conclusions are limited to public sources. Photographs are identified separately from AI-generated conceptual illustrations.