The Special Prosecution Office of the Republic of Kosovo (PSRK) has officially requested that the Basic Court in Prishtina order a 30-day detention period for three primary suspects arrested during the high-profile police crackdown codenamed Operation “Mega.”
The defendants—Spartak Dërmaku, Blerim Krasniqi, and Arian Alijaj—face grave charges including organized crime, large-scale money laundering, extortion, fraud, and the financing of international terrorism.
The official investigative files, secured by “Betimi për Drejtësi,” expose a highly complex transnational criminal infrastructure spanning Kosovo, Switzerland, Germany, North Macedonia, and Liechtenstein.
1. The Crypto Scam and Kidnapping in Tophane
The criminal syndicate operated a systemic fraud scheme targeting wealthy European citizens and businesses. The primary case features a Swiss-based victim, F.H., representing the legal entity “Richard Efis/Amfico S.A.”
The "Mega" Fraud & Extortion Loop
[ Swiss Firm: Amfico S.A. ] ──► (Transfers Cash for Crypto) ──► [ "Tresor Exchange" (Prishtina) ]
▲ │
│ ▼
[ Kidnapping & Extortion ] ◄── (1 Million Euro Demand) ◄── [ Ghost Accounts Closed (No Receipts) ]
- The Bait: The syndicate lured F.H. into purchasing hundreds of thousands of euros worth of Bitcoin (BTC) and USDT.
- The Ghost Invoices: When the Swiss firm demanded official fiscal receipts for the financial transactions, the suspects created fictitious bank accounts. Once the victim’s funds were wired and withdrawn in cash, the suspects completely deactivated and erased the ghost accounts, refusing to provide documentation.
- The Violent Escalation: In September 2023, while F.H. was visiting family in Kosovo, the suspects tracked him down. He was forcefully bundled into a vehicle by suspects including Median Abazi and Arian Alijaj, driven to the Tophane neighborhood in Prishtina, and brutally beaten.
- The Ultimatum: While assaulting him, the gang issued a chilling death threat:
“Bring us 1 million euros by tomorrow, or we will kill you. We won’t use a gun like those two people in Skopje; we will cut off your head and the heads of your family with a knife.”
2. Laundering via “Tresor Exchange”
The financial engine behind this syndicate was “Tresor Exchange,” a cryptocurrency exchange shop operated by Dërmaku and Alijaj in the heart of Prishtina.
| Layering Mechanism | Assets Converted | Intercepted Footprint |
| International Scams | European victims were defrauded via domestic and international digital schemes. | Funds converted directly into digital crypto assets to completely obscure the original source of the illicit money. |
| Cash & Luxury Goods | Cryptocurrencies were liquidated back into large amounts of physical paper cash. | Massive cash conversions were reinvested into high-end asset acquisitions, including a fleet of luxury vehicles. |
| The FBI Intervention | $152,720 USD in digital funds has been frozen. | Digital trail cracked following a formal forensic intelligence document handed over by the US FBI on June 1, 2026. |
3. The Terrorist Financing Network on Telegram
The most alarming aspect of Operation “Mega” is the direct nexus between Prishtina’s crypto exchanges and German-speaking violent extremist groups. The PSRK, working alongside German federal authorities, uncovered that Dërmaku and Krasniqi actively funneled crypto-donations to recognized terrorist entities.
Terrorist Financing Pipeline (Telegram Channels)
[ Blerim Krasniqi ] ──► (Falsified Data / Fake Identities) ──► [ Spartak Dërmaku ]
│
┌────────────────────────────────────────────────────────────┘
▼ (Direct & Indirect Tracing Avoidance Vectors)
[ "GebtAus" Telegram Group ] ──► (Targeting German-speakers) ──► [ Funding Islamic Extremism ]
[ "Fastabiqul Khayrat" Group ] ──► (Targeting German-speakers) ──► [ Funding Islamic Extremism ]
The Intercepted Transactions (2023–2024):
- The “Mom’s Wallet” Scheme: Dërmaku registered a premium Binance exchange account under his mother’s name. From this wallet, investigators tracked transactions routed through intermediate shielding addresses: $800 USD and 350 USDT sent in August 2024, followed by separate payments of $646 USD and $972 USD in October 2024 to “GebtAus”—a radical Telegram group dedicated to fundraising for terrorist operations.
- The Macedonian Connection: Krasniqi utilized a forged North Macedonian passport under the alias “Boris Nikolovski” to register separate accounts. On October 31, 2023, he transferred funds to “Fastabiqul Khayrat,” another German-language terrorist recruitment and financing channel.
- The Intelligence File: On January 23, 2025, authorities in North Macedonia arrested Habib Ismaili for terrorism. Data extracted from Ismaili’s devices perfectly matched the fake “Boris Nikolovski” Binance wallet controlled by Dërmaku in Prishtina.
4. Weapons Seizures and Flight Risk
During the physical raids executed by the Kosovo Police, both personal weapons stockpiles and extreme operational metadata were recovered:
- Blerim Krasniqi: Digital forensics of his laptop and phones revealed extensive video and photo archives showing him posing with military-grade AK-47 automatic rifles, holding massive stacks of cash, and interacting closely with known regional religious extremists.
- Spartak Dërmaku & Arian Alijaj: Found in possession of 73 rounds of ammunition, tactical combat knives, and an unauthorized Beretta pistol with an 8-round magazine.
The Special Prosecution successfully argued before the court that if released, all three suspects present an extreme flight risk. Given the sprawling international nature of their operations, their deep networks in Switzerland and Germany, and Dërmaku’s proven ability to fabricate completely functional fraudulent identities, the state maintains that detention is the only way to prevent them from evading justice.
