The Fall of an Olympian: BlockSec Tracks the Ryan Wedding Crypto Crime Network

On November 19, 2025, the U.S. Treasury's OFAC sanctioned Ryan James Wedding, a former Canadian Olympic snowboarder, along with his key associates and businesses. This action froze all their assets in the U.S. and banned Americans from doing any business with them.

Soon after, the U.S. State Department raised the reward for his capture to $15 million. The Mexican Embassy published guides on how to report tips. Simultaneously, the FBI, the Royal Canadian Mounted Police (RCMP), and Mexican police launched a joint global hunt. This operation against the "Olympian Drug Lord" reveals the dark link between cryptocurrency, drug trafficking, and serial murders.

Using advanced on-chain tracking and specialized research, BlockSec has meticulously traced Wedding’s path from a sports star to a notorious crime boss. Our analysis explains exactly how he leveraged blockchain technology to build a "hidden" network for illegal money laundering, focusing on the Ryan Wedding crypto crime network.

From Olympic Star to "Most Wanted" Criminal

Ryan James Wedding, born in 1976 in Thunder Bay, Ontario, was once a promising star in winter sports. With his sharp skills and steady performance, he made the Canadian National Team, representing his country at the 2002 Salt Lake City Winter Olympics in the men's parallel giant slalom. At that time, he was a prominent face of Canadian winter sports. He loved the spotlight, but this attention also fueled a dangerous desire for quick success.

After the Olympics, Wedding’s life took a sharp turn. He turned down offers to stay on the team and left his skiing career behind, joining the risky world of business instead. Later, he linked up with international drug traffickers. In 2008, he was arrested in California for smuggling cocaine and sentenced to four years in prison in 2010. However, prison did not reform him. Instead, it became a launching pad for his crime career, where he met other criminals who helped him build a future drug network. After his release, he dropped his "Olympic athlete" mask completely, adopting the nickname "El Jefe," which means "The Boss" in Spanish. He formed the Ryan Wedding Drug Trafficking Organization, which authorities now list as a major crime group.

Wedding’s group is known for being violent and highly organized. They work closely with Mexico’s Sinaloa Cartel, which the U.S. labeled a terrorist organization in 2024. Together, they move cocaine from production sites in Colombia through Mexico and finally into the U.S. and Canada. They traffic about 60 tons of drugs a year, generating over $1 billion annually. This illegal business poses a major threat to Canadian national security.

Wedding uses deadly force to protect this network. In November 2023, he ordered an attack on a family in Ontario due to a stolen drug shipment. This brutal attack killed two parents and left one person badly hurt. Between April and May 2024, his gang committed two more murders to punish individuals who owed drug debts. In January 2025, he attempted to cover his tracks by ordering the killing of a federal witness, Acevedo Garcia, in Colombia. The victim was shot five times in a restaurant and died instantly. Wedding’s lawyer even helped plan this crime and suggested killing the witness to make the charges go away.

In March 2025, Wedding was officially added to the FBI’s Ten Most Wanted Fugitives list, replacing fugitive Alexis Flores. Interpol also issued a Red Notice for his arrest. Today, he is believed to be hiding in Mexico, protected by a high-ranking cartel member known as "El General." Wedding runs his crime network remotely using encrypted messaging apps and utilizes Mexican companies like VRG Energéticos and Grupo RVG Combustibles as legal fronts to hide his criminal activities.

Unpacking the Ryan Wedding Crypto Crime Network's Money Laundering Process

The indictment states that the Wedding criminal group launders drug profits using U.S. dollars, Canadian dollars, and cryptocurrency. For their crypto assets, they employ a specific method to obfuscate the transaction trail. They break large amounts of money into many small transfers, moving these funds quickly through intermediate USDT wallets. Ultimately, all the money arrives in a central Tether wallet that Wedding controls directly. This sophisticated approach is a hallmark of the Ryan Wedding crypto crime network.

Several key individuals handle these laundering tasks. The main operators are Sokolovski, Hossain, and Canastillo-Madrid. They work alongside other individuals, some known and some unknown to the grand jury. Together, they serve as members of the "Wedding Criminal Organization."

Laundering of Drug Proceeds: The Crypto Flow

The official indictment details the intricate steps taken by the Ryan Wedding crypto crime network to launder their illicit gains:

• Concealment: The Wedding Criminal Enterprise would conceal the significant proceeds of its cocaine sales in U.S. and Canadian dollars and cryptocurrencies.
• Sophisticated Tether Network: With respect to the use of cryptocurrencies, to obscure the original source of the funds, members and associates of the Wedding Criminal Enterprise would use a sophisticated Tether network to: (1) break large amounts of money into smaller transfers and (2) quickly use intermediary USDT wallets to move funds before ultimately reaching a hub Tether wallet controlled by defendant WEDDING.
• Key Operators: Defendants SOKOLOVSKI, HOSSAIN, and CANASTILLO-MADRID, and others known and unknown to the Grand Jury, would serve as members and associates of the Wedding Criminal Enterprise, namely, defendant WEDDING and Clark, by concealing their drug trafficking proceeds and by using those proceeds to facilitate and further the objectives of the enterprise. A truncated flow chart illustrating this laundering system is depicted in the diagram below.

The text below describes the specific details of the money laundering process as outlined in the indictment.

LAUNDERING OF DRUG PROCEEDS: Overt Acts

• Overt Act No. 71: Between September 28, 2023, and May 28, 2024, defendant SOKOLOVSKI received in his Kucoin account (-4119) approximately 20,501,784.29 USDT from a Tether wallet controlled by a member of the conspiracy (-9BU3).
• Overt Act No. 72: Between May 29, 2024, and August 15, 2024, defendant HOSSAIN received in his Tether wallet (-3FcL) approximately 48,492,620 USDT from a Tether wallet controlled by a member of the conspiracy (-79wf).
• Overt Act No. 73: Between May 29, 2024, and August 14, 2024, a member of the conspiracy used a Tether wallet (-79wf) to send approximately 8,090,526 USDT to defendant SOKOLOVSKI's Kucoin account (-4119).
• Overt Act No. 74: Between May 29, 2024, and August 12, 2024, defendant SOKOLOVSKI used his Kucoin account (-4119) to send approximately 9,838,397.84 USDT to a Tether wallet controlled by a member of the conspiracy (-79wf).
• Overt Act No. 75: Between June 14, 2024, and October 1, 2024, defendant HOSSAIN used his Tether wallets (-yoQi and -MtEj) to send approximately 3,091,001.13 USDT to one of defendant CANASTILLO-MADRID's TRON wallets (-4n8E).
• Overt Act No. 76: Between April 29, 2024, and October 8, 2024, defendant HOSSAIN used a Tether wallet (-yoQi) to send approximately 98.86% of its total funds, that is, approximately 207,808,779 USDT, to defendant WEDDING's Tether wallet (-glPl).
• Overt Act No. 77: On June 18, 2024, Bonilla transferred approximately 17,300 USDT into defendant HOSSAIN's Tether wallet (-yoQi) to settle a drug debt with defendant WEDDING and Clark.
• Overt Act No. 78: Between July 9, 2024, and November 5, 2024, defendant CANASTILLO-MADRID received approximately 507,078 USDT to her two TRON wallets (-4n8E and -SG8z) from a Tether wallet controlled by Clark (-rg2a).
• Overt Act No. 79: Between July 12, 2024, and September 11, 2024, defendant CANASTILLO-MADRID received approximately 640,367 USDT to her two TRON wallets (-4n8E and -SG8z) from defendant WEDDING'S Tether wallet (-g1P1).
• Overt Act No. 80: Between August 15, 2024, and September 7, 2024, using a Tether wallet (-glPl), defendant WEDDING provided Victim A, who was acting as an intermediary, with approximately 564,571 USDT to purchase approximately 300 kilograms of cocaine from defendant RIASCOS in Colombia.
• Overt Act No. 81: Between August 16, 2024, and September 24, 2024, defendant SOKOLOVSKI used his Kucoin account (-4119) to send approximately 96,698.50 USDT to -efTu (a Tether wallet controlled by a member of the conspiracy).
• Overt Act No. 82: Between June 14, 2024, and October 1, 2024, defendant CANASTILLO-MADRID received approximately 3,091,001.13 USDT into her two TRON wallets (-4n8E and -SG8z) from three Tether wallets controlled by defendant HOSSAIN (-3FcL, -yoQi, and -MtEj).

We have visualized the money laundering process in the chart below, leveraging BlockSec's on-chain analysis capabilities.

We meticulously analyzed the direct deposits and withdrawals for these addresses, enabling us to understand the origins and destinations of the funds. We focused on transfers exceeding $100,000 to construct the comprehensive relationship map shown below.

Key Funding Nodes and Roles within the Crypto Crime Network

Our relationship map clearly shows that Hossain and Sokolovski act as two major collection centers for illicit funds. Most of the money flowing into these centers originates from a group of addresses labeled as the Wedding Conspiracy. This group appears to manage the early stages of money laundering and drug deals, processing initial funds before forwarding the "cleaned" money to the next nodes in the chain.

The money then moves in two distinct directions from these points:

• Most of the money sent to Sokolovski eventually flows into KuCoin. This indicates that his primary role is to utilize a centralized exchange to finalize the laundering process and convert cryptocurrency into fiat currency.
• The funds sent to Hossain mainly move to addresses controlled directly by Ryan James Wedding. From there, the funds were sent to a specific address: TK7c41TjffeDvofXfnNnKt5zn3F1w33BkF (SUSPECT-33BkF). This address has since been blocked by Tether.

On-chain analysis reveals that SUSPECT-33BkF and WEDDING-g1P1 were active during almost identical periods. Based on this, it is reasonable to conclude that Wedding used SUSPECT-33BkF as a backup or extension address to continue his money laundering operations within the Ryan Wedding crypto crime network.

Further analysis of SUSPECT-33BkF using the BlockSec Compliance platform reveals more critical details:

• Approximately 99.22% of the incoming funds originated from sanctioned or flagged addresses, all linked to Wedding in this case.
• Nearly 40% of the outgoing funds were sent to addresses that are currently blocked by Tether.

Both the source and the destination of these funds are heavily tied to high-risk groups. This confirms that this address plays a pivotal role in the money laundering chain of the Ryan Wedding crypto crime network.

Conclusion: Defending Against Crypto Crime in the Digital Age

The Ryan Wedding case is not an isolated event. BlockSec research indicates that international crimes involving privacy coins rose by 187% in 2024. Criminal groups are becoming increasingly professional and global in their use of cryptocurrency. This case highlights critical gaps in regulation and offers valuable insights for law enforcement and blockchain security firms.

For everyday users, it is crucial to avoid the misconception that "anonymous" means "safe" in the crypto space. This case unequivocally proves that experts can still trace transactions. If a user inadvertently interacts with a criminal address, they risk having their assets frozen. It is best practice to use regulated exchanges and avoid platforms that do not require identity verification. Regularly checking your wallet for risks with security tools like BlockSec's offerings is also a smart move.

For law enforcement and the industry, coordinated action is essential. BlockSec’s work demonstrates that blockchain technology, while used by criminals, is also a powerful tool to fight crime. By grouping addresses and tracking cross-chain movements, we can effectively unmask criminal activity. In the future, countries must enhance data sharing and compel exchanges to monitor transactions in real-time. This proactive approach will help stop illegal funds at their source, dismantling sophisticated operations like the Ryan Wedding crypto crime network.