On July 6, 2018, a Brooklyn federal jury convicted two men on charges of securities fraud, wire fraud, money laundering and computer intrusion. Vitaly Korchevsky, 53, a former Wall Street hedge fund manager-turned Pennsylvania pastor, and Vladislav Khalupsky, 47, a Ukrainian national, earned as much as $30 million making stock trades based on information stolen from leading financial newswires by Ukraine-based hackers. The verdict marks the first U.S. criminal convictions for insider trading based on information stolen by hackers.
According to court documents, the defendants orchestrated a multinational criminal enterprise implicating more than a dozen individuals. The heart of the scheme involved Ukraine-based hackers accessing computer systems belonging to several industry-leading financial news services. The hackers deployed a range of infiltration techniques, including brute force attacks, SQL injection attacks (a method of exploiting SQL, a common database programming language) and social engineering. Working from a “shopping list” of target companies provided by the defendants, the hackers stole more than 150,000 non-public press releases from the internal servers of top newswire firms. With the inside information from over 800 of the stolen press releases in hand, the defendants planned and executed trades before the press releases were made public.
The breach revealed the extent to which market-sensitive data about publically traded companies is often held by third parties. The listed companies whose shares were traded by the defendants had contractual relationships with major newswire providers, under which inside information (in the form of press releases) was stored on restricted, internal computer systems belonging to the newswire companies prior to dissemination. The press releases contained material non-public information relating to each company’s financial performance, quarterly earnings, year-end earnings, and future M&A activity.
The defendants paid their hacker contacts for access to the newswire servers based on a percentage of the profits earned by trading ahead of the information contained in the stolen releases. Mr. Korchevsky and Mr. Khalupsky initiated their insider trading activities in early 2010, and continued until late 2014, when law enforcement agencies began to close in. Mr. Korchevsky was arrested at his Pennsylvania home in 2015, and Mr. Khalupsky was arrested in Ukraine and extradited to the United States. At the time of his arrest, Mr. Korchevsky owned real estate in Pennsylvania and Georgia valued at $5 million and had an additional $5 million in bank and brokerage accounts. His assets were frozen by the government shortly after his arrest.
In addition to the payments they received from the defendants as a share of the profits of insider trading, the hackers advertised their stolen press releases on a criminal web forum, netting tens of thousands of dollars in exchange for granting access to the releases.
Investigators used trading records, email traffic, server access logs and other digital footprints to pull together the scheme’s various threads. This presented a difficult task, as the defendants and their hacker counterparts had often communicated in code. At trial, however, the use of coded messages was seen by the jury as a strong indicator of the defendants’ criminal intent. As prosecutor Richard Tucker explained in the government’s closing arguments: “There’s no innocent explanation for texting someone something like ‘four, parentheses, star, seven.’”
The convictions were in large part secured based on the testimony of two witnesses, Arkadiy Dubovoy and his son Igor. The pair had been central to the scheme but later “flipped” and gave evidence against their co-conspirators.
