Russia recruited a Canadian teenage spy. His arrest led to a crypto money trail

(John Petalcurin / Pexels.com)

WARSAW - The Canadian teenager was getting anxious. It was May 2024, and he was in Copenhagen, running out of money after leaving Moscow a week earlier. He’d booked the cheapest room he could find in the Danish capital, but the hostel was still more expensive than he’d expected.

The teen, Laken Pavan, opened Telegram to type out a message to his handler in Russia’s Federal Security Service, which runs the country’s spy operations and is known by its acronym FSB.

“Are you able to send BTC today?” Pavan wrote to the man, using the shorthand for bitcoin. Pavan knew the man only as “Slon,” or elephant in Russian. The man had been assigned to the 17-year-old by FSB officers who had recruited the teen just weeks prior in Russian-occupied Donetsk, according to court documents reviewed by Reuters.

“I have a big problem there are no Bitcoin ATMs in Denmark,” Pavan explained in English. He’d checked around and it would be simpler in Poland, Pavan told his handler. Things were cheaper and he could more easily turn cryptocurrency into cash there.

“Check, I’ve sent you the first batch of money,” Slon replied. A minute earlier, Pavan’s bitcoin wallet showed it had received about $130 worth of the cryptocurrency.

Pavan soon responded with a photo of his boarding pass for a flight to Warsaw.

A couple days later, intoxicated and suddenly fearful, Pavan asked the receptionist of his budget hotel in Warsaw to call the police. Once officers arrived, he confessed to working with the FSB and planning to pass information about the Polish military to his Russian handler, the court documents show.

The Canadian pleaded guilty to charges of helping Russian intelligence and was sentenced in December 2024. Pavan, who turned 18 a few weeks after his arrest, is now serving a 20-month sentence in a Polish prison on the outskirts of Radom, a city 100 kilometers south of the capital.

There is no indication from the court documents that he ever obtained or passed along any sensitive information to the Russians. The term he received is even less than the usual 5-year minimum because of his age and because he admitted guilt and cooperated with the investigation, prosecutors said in a post-sentencing statement.

At a time when Europe is in a heightened state of alarm over what security agencies across the continent call Russia’s “hybrid war” of sabotage and espionage, Reuters found an emerging trend: Moscow is increasingly recruiting teenagers and complete novices.

The hybrid campaign comes as Ukraine and Russia try to strengthen negotiating positions in sporadic peace talks, which have so far produced no breakthroughs. Russian bombing attacks on Ukraine have intensified. So has pressure from Ukraine, including a surprise attack on Russian bombers after what Ukraine’s president said was months of work by intelligence operatives working inside Russia.

Since the full-scale invasion in 2022, dozens of teenagers in Ukraine and at least 12 teens elsewhere in Europe – in Germany, Poland, Britain and Lithuania – have been arrested in Russia-linked cases of sabotage and spying. Pavan’s case, reported in detail for the first time, sheds light on these covert Russian operations and their cryptocurrency trail.

The answer to why Moscow has resorted to using untrained agents lies in the mass expulsion of Russian diplomats and operatives from Europe after the start of Russia’s full-scale invasion of Ukraine in 2022. To plug the hole in their operations, Russian intelligence services have shifted to recruiting common criminals or individuals with little spycraft experience, said a senior NATO official. His statement echoed comments last year from Germany’s domestic security service. Two European security experts said teenagers are recruited because they’re vulnerable, low-cost, and often in need of money.

“These are, in many cases, not trained intelligence professionals,” the NATO official said on condition of anonymity to describe the clandestine operations.

The official expects more Russian hybrid warfare, which combines physical warfare with non-military tactics used to undermine an adversary’s security and sow distrust and confusion. “One of the main objectives of the Russian hybrid campaign is to undercut support for Ukraine, and that is both politically, in terms of creating disquiet amongst the population, but also very practically, in terms of the actual concrete support going to Ukraine,” he said.

Reuters reviewed more than 1,400 pages of Polish court documents in Pavan’s case, which includes all of the messages between the Canadian teen and his FSB handler – more than 300 in total. The messages, as well as Pavan’s testimony to prosecutors, provide a rare, unfiltered view of the sometimes-haphazard nature of such operations, where the FSB is using a mixture of threats and lukewarm incentives.

Neither the Kremlin nor the FSB responded to requests for comment from Reuters about Pavan’s case, Russia’s recruiting tactics of young people or its use of bitcoin to fund operations. Polish prosecutors in Pavan’s case also declined to answer questions about the case. Requests to the Polish detention center in Radom to speak with Pavan went unanswered.

The bitcoin transactions in the court documents allowed Reuters, with the help of blockchain analysts, to trace the payments, revealing transfers across several wallets. The analysis identified one large cryptocurrency wallet that financed the two wallets which paid bitcoin directly to Pavan. That big wallet has processed over $600 million since its creation in June 2022, four months after the start of the war in Ukraine, the analysis found. Reuters could not ascertain who operates the large upstream wallet.

European officials have pointed to Russia for sabotage including cyberattacks and arson, attempted assassinations , as well as espionage in countries allied with Ukraine. Moscow denies involvement and has called such allegations “empty” and unproven. Russia’s Foreign Intelligence Service, known as the SVR, did not comment directly on Pavan’s case and accused Europe of blindly supporting “the Kyiv regime’s terrorist methods.”

Ukraine has similarly recruited youths in Russia for sabotage there, primarily arson , according to Russia’s FSB and the Russian Investigative Committee, the federation’s main investigative authority. There is no indication those operations have targeted Russian allies, and Ukraine did not respond to requests for comment on the allegations .

A difficult life in Canada

As a child in Parksville on Canada’s western coast, Pavan was a quiet boy obsessed with the Canadian military, said his mother, Andelaine Nelson. He idolized his father, who served in Afghanistan and later worked as a combat engineer. She remembers her son researching his ancestry for hints of military service.

“He’s been lining up marbles and doing little combat things since he could sit in a highchair,” she said. As a child, he frequently accompanied his father to military events around Canada and abroad, she said.

Nelson and Pavan’s father split when he was a toddler, and her contact with her son was sporadic for most of his childhood as his father had custody . Their separation, among other family issues, had made her son increasingly angry, Nelson said. Contacted through his lawyer, Pavan’s father in Canada declined to comment about his son’s case.

At the 75th anniversary celebration of D-Day on France’s Juno Beach in 2019, Pavan, who was then turning 13, can be seen grinning next to former Canadian prime minister Justin Trudeau in a photo posted by a local news site at the time.

Pavan told prosecutors he joined the Canadian reserves in 2022, when he was 16. Nelson said her son’s dream was to work as a combat engineer like his father. Canada’s military confirmed that Pavan was a reservist from July 2022 to October 2024.

When the war started in Ukraine in 2022, Pavan at first expressed no interest, Nelson said. The court records don’t indicate why he came to embrace Russia’s cause.

Pavan and his mother fully reconnected in 2023. By the end of the year, he was debating strangers online, where he was increasingly supportive of Russia, court records show.

In dozens of public Telegram exchanges in pro-Moscow groups from December 2023 through spring 2024 seen by Reuters, Pavan voiced disappointment about his experience as a reservist in the Canadian army and said he believed Russia’s war was “justified.” By March 2024, he mentioned he had a visa for Russia, and suggested another user join the Russian military for citizenship.

According to chat logs recovered by Polish prosecutors, Pavan was also messaging moderators of Russian propaganda channels and English-speakers in Russia about fighting for Russian forces in occupied Donetsk.

Pavan’s mother said she knew nothing about his plans to travel to Russia.

“I had no idea he was even gone,” she told Reuters, only later hearing from her son that he was traveling around Europe with friends.

John Kingman Phillips, a lawyer for Pavan’s family, said Canadian authorities should have been aware of his plans to travel to Russia and Donetsk and stopped the minor from traveling. Canada’s Border Services Agency said citizens have the right to leave the country, although high-risk people could be flagged. Canada’s Global Affairs Department said it was aware of the arrest and sentencing of a citizen in Poland but declined to comment on the specifics of Pavan’s case.

Meeting ‘elephant’

On April 16, 2024, Pavan flew from Vancouver to Moscow via Istanbul and hired a driver to take him to occupied Donetsk. There, he crashed in the basement headquarters of the Interbrigades, a volunteer group, which according to the organization’s social media account was set up in 2014 to gather mercenaries to fight for Russia in Donetsk and the neighboring Ukrainian region of Luhansk and to organize humanitarian projects for civilians. The group’s name refers to the Spanish Civil War, when leftists from many countries arrived in Spain to fight for the International Brigades against Francisco Franco’s rebels.

Pavan was two months shy of 18, fair-haired and lanky. He had inquired about enlisting but was told he had to first turn 18 under Russian law, according to a message he sent a foreign fighter from Spain. For about a week, he volunteered around Donetsk with the Interbrigades and helped rebuild a school.

Wilmer Puello-Mota, an American former airman who fled to Russia after being charged with possession of child sexual abuse material, told Reuters he encountered Pavan in Donetsk, where the Canadian tried unsuccessfully to join the Russian army.

Puello-Mota, who described the U.S. allegations against him as unfair, is now serving in Russia’s military.

“Everybody he talked to down there, we told him, go home,” said Puello-Mota, whose contacts with Pavan appear in the court documents. He said Pavan did nothing more than volunteer for the Interbrigades for a day or two , as the court documents also indicated. Puello-Mota said the espionage allegations made by Poland against the teen made no sense.

In late April, Pavan was out drinking in Donetsk when he was arrested. He told Polish prosecutors he was questioned about his family and friends at the police station by men who said they were from the FSB. The men put a bag over his head and drove him to a second location, where they interrogated him again, asking also about his travel plans around Europe. None of them gave Pavan their names.

Eventually, he told prosecutors, he was taken to the Central hotel in Donetsk, a tall building with a glass facade in the heart of the occupied city. There he was grilled repeatedly by a group of at least six FSB officers and one man who said he was from Russia’s Foreign Intelligence Service. After several days, they gave him instructions.

After returning to Europe, Pavan was to lose his passport to conceal his trip to Russia and begin working for Russia’s security services.

“This work was to consist of traveling around Europe and taking photos. In Ukraine, on the other hand, I was to enlist in the Ukrainian army; I was to receive detailed instructions for this later, after arriving in Ukraine,” Pavan told Polish prosecutors, according to a copy of his testimony seen by Reuters. The teen did not speak Russian, Ukrainian or Polish.

The Russian men used a combination of threats and inducements to get him to agree, Pavan told Polish authorities. In exchange for his work, he’d get Russian citizenship and an apartment in any Russian city of his choosing. If he didn’t comply, he would be killed, he told prosecutors.

They then introduced Pavan to Slon, his FSB handler. Slon, who appeared to be in his 30s, never gave Pavan his real name. Slon did not respond to calls or to messages sent by Reuters via Telegram. Reuters was unable to contact him on his fake Instagram account.

Pavan began messaging Slon on Telegram as he prepared to leave Donetsk. At first, their messages focused mainly on food. Slon’s were sometimes in stilted English, as if he were using a translation app.

May 7

C: how are you doing with food? Is there any food left? (2:15 PM)

LP: Yes, I still have noodles left (2:16 PM)

May 8

C: Hi (9:51 AM)

LP: hey (10:11 AM)

C: Buddy, let’s meet closer to 6 pm today. Let’s go have coffee and eat pizza. (10:14 AM)

LP: ok sounds good! (10:14 AM)

C: How are you doing in general? (10:14 AM)

You’re not bored there alone (10:15 AM)

? (10:15 AM)

LP: no its fine, I just watch movies on my phone or something. (10:15 AM)

C: Well, that’s it, we’ll meet in the evening, walk around the city, take a walk, talk about our common business (10:16 AM )

LP: (10:16 AM)

Later, Pavan shared a link to a website about how the British military was no longer accepting soldiers from Commonwealth countries like Canada. It is not clear why he shared the link.

May 11

LP: I feel bad for asking, but there is no food and I ate all my noodles. Do you think we can go get Pizza quickly 3:05 PM

C: I live in another city and am already at home.

Now I’ll try to come up with something (5:05 PM)

The same day in May, Slon sent Pavan details of his flight from Moscow to Istanbul. According to the messages, Slon drove with Pavan to the bus terminal in Donetsk, where Pavan boarded a bus to Moscow. Pavan later told Polish police he was given $2,000 in cash before leaving Donetsk.

C: Good luck to you my friend, be careful, I will wait for your return with impatience here I keep my fists for you and we believe in you (9:25 AM)

LP: ok sounds good! 9:26 AM

Bitcoin payments

On May 14, Pavan arrived in Copenhagen via Istanbul. It’s not clear why the Danish capital was chosen as his destination.

Slon and Pavan messaged daily, with the FSB handler encouraging the teenager to apply for a new Canadian passport, buy a new phone, and set up a fake Instagram account for photos of his travels.

Slon also created a fake profile for himself, picking the username “@Astridjenson.dnk , ” and uploaded a photo of a blonde woman as his profile picture. Reuters identified the woman as a 20-year-old Donetsk teacher named Anastasia Protsenko, who told Reuters she was unaware her image was being used for the account and knew no one named Slon.

May 14

LP: I have two important things I need to tell to you, is it ok to sent it here? (7:34 PM)

C: a little did not understand the translation Well, tell me what things you have that you should tell me (7:35 PM)

LP: I will go to phone store, but this city is very expensive. Would it be better just to erase my current phone and change sim card? And I think I should go embassy on thursday once I get a new phone. 7:40 PM

C: my friend I said that in any case I expect improvisation on your part So look, tomorrow, don’t be lazy, walk Look at how much new phones cost, take pictures if we don’t fit into the budget What Yes, of course, we won’t have a phone about going to the embassies on Thursday, I agree with you, until now you must fully familiarize yourself with the city, at least see its surroundings, sights, take a few photos that you are in this city Was (7:42 PM) Unfortunately, I’m not there, I can’t help you there in any particular way, so you tell me what nuances accompany you in this matter, and I’ll prompt you from here (7:42 PM)

LP: Ok I will do that (7:44 PM)

C: The most important thing is that you have already done, you have arrived, so today rest, go to bed, Tomorrow we will decide on your next actions (7:44 PM)

LP: Alright (7:45 PM)

C: ️ (7:46 PM)

In Copenhagen, Pavan messaged Slon about the people he encountered. Slon seemed particularly interested in Pavan’s new friend, an American defense contractor who was traveling through Copenhagen. He encouraged Pavan to continue talking to the American without making him suspicious.

But Pavan’s money was running out fast in Denmark. He messaged his mother in Canada for funds.

“He told me he had no money, that he hadn’t been paid,” Nelson said. Until then, she thought Pavan was travelling with friends.

“I said, who’s paying for this trip because I wanted to know what was going on.”

She said her son never answered her question. After days of Pavan’s pestering, Slon finally transferred bitcoins to him on May 20. The next day, he sent more.

C: Okay, let’s act as you just said, Look, I have another $120 in my bitcoin wallet, I can send it to you in case of anything, but not today, not tomorrow, it takes time (12:00 PM)

C: then I will slowly mine money into a wallet in Bitcoin, something that will help you in the future, but it’s not fat, so on Fast Money Don’t count on, I need time for this (12:00 PM)

LP (12:02 PM)

Pavan’s bitcoin wallet shows he received bitcoin worth more than $500 from two wallets on May 20 and 21 last year. In testimony, he confirmed these payments came from Slon’s bitcoin wallets. Each time, Pav a n said, Slon told the teen his own account needed replenishing first.

At the request of Reuters, Global Ledger and Recoveris, both firms with expertise in tracing crypto movements, tracked the two bitcoin payments Pavan received using the wallet addresses listed in Polish court documents. Reuters confirmed the path of the payments.

Global Ledger said the payments to Pavan’s wallet were made after the two wallets Pavan identified as Slon’s in court documents received a similar amount of bitcoins from two intermediaries. Those, in turn, received bitcoins worth hundreds of thousands of dollars from a large wallet set up in June 2022, Global Ledger said. Recoveris also traced the payments back to the large wallet.

Recoveris also noted that outgoing transfers from the “cluster” of wallets identified through Pavan’s case took place during Moscow business hours.

In three years, the large wallet has processed bitcoins equivalent to US$600 million. Global Ledger said during that period, the wallet has transferred bitcoins to a crypto exchange called Garantex, which has been sanctioned by the European Union and the United States for its close association with sanctioned Russian banks. In March, the United States, Germany and Finland took down the online infrastructure used by Garantex.

The wallet was active as of June. Reuters could not determine the ownership of the large wallet or the two intermediary wallets that paid into wallets Pavan identified as Slon’s, or whether any were used in other sabotage or espionage cases. Global Ledger said the large wallet appeared to be funded by a major mining pool and a custodial service.

“Transactions from wallets linked to the FSB followed a structured laundering pattern, involving fund splitting, mixing with larger sums, and routing through unconnected deposit wallets,” Global Ledger wrote in its report for Reuters, noting methods commonly used to obfuscate the source and use of funds.

Ago Ambur, who until January this year served as the head of Estonia’s Cybercrime Bureau and now works as chief operating officer at the cyberintelligence firm Glazer Technologies, said the wallets and transaction patterns alone were not enough to indicate that Russia’s special services were behind them.

“Attributing a crypto activity to an adversary can be similar to finding a knife at a crime scene. It might match the type the adversary uses, but without fingerprints, DNA or surveillance footage, it remains just a clue,” he told Reuters.

Life after prison

Pavan and Slon’s last contact was on May 22, 2024, a day after the teen’s arrival in Warsaw. In their final exchange, Slon reminded Pavan to apply for a new Canadian passport, and suggested he reach out to his father and his old military commander. The messages did not explain why.

Twelve hours later, Pavan was in Polish police custody.

Phillips, the lawyer for Pavan’s family, said their aim is now to get the teen home to Canada to serve out his sentence. Pavan’s family are “devastated,” Phillips said. If Pavan is not granted early release, he is expected to complete his sentence in January 2026.

Recently, Nelson looked online and saw thousands of horrific messages under Reddit and other social media posts about her son’s case, calling him an idiot or worse. These people don’t know anything about her son, Nelson says, and have no idea how he was detained and threatened by Russian agents.

She has tried raising money so Pavan can get on his feet when he returns. The campaign she started has only raised $200.

By Mari Saito, Anna Koper, Anton Zverev, Filipp Lebedev, Polina Nikolskaya, Reuters

Additional reporting by Tom Wilson, Anastasiia Malenko and Andrius Sytas. Edited by Lori Hinnant.