This week, Canada's financial watchdog delivered a substantial enforcement action against Cryptomus, a digital payments processor that facilitates transactions for numerous Russian cryptocurrency exchanges and illicit marketplaces. The $176 million penalty stems from the platform's failure to comply with Canada's money-laundering prevention requirements. The action comes roughly ten months after investigative reporting revealed that Cryptomus maintained a Vancouver address shared by dozens of unrelated foreign currency dealers and cryptocurrency services that had no physical presence there.

On October 16, the Financial Transactions and Reports Analysis Center of Canada (FINTRAC) announced a $176,960,190 penalty against Xeltox Enterprises Ltd., the entity operating under the Cryptomus brand.

FINTRAC's investigation determined that Cryptomus neglected to file suspicious activity reports in situations where substantial evidence indicated involvement in child sexual abuse material trafficking, fraudulent schemes, ransomware-related payments, and circumvention of international sanctions.

Given that numerous violations in this case were connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action

Sarah Paquet, director and CEO at FINTRAC

Widespread Use Among Cybercrime Services

Research conducted by blockchain investigator Richard Sanders, published in December 2024, documented the platform's central role in the cybercriminal ecosystem. Sanders examined 122 illicit services and discovered that all of them relied on Cryptomus for payment processing. His investigation identified several categories of criminal infrastructure utilizing the platform:

  • Hosting providers marketed as abuse-tolerant or "bulletproof," including anonvm[.]wtf and PQHosting
  • Marketplaces distributing compromised credentials such as aged email accounts, banking information, and social media profiles, exemplified by verif[.]work and kopeechka[.]store
  • Services providing anonymity tools and proxy access, such as crazyrdp[.]com and rdp[.]monster
  • Platforms offering untraceable SMS capabilities, including anonsim[.]net and smsboss[.]pro

Sanders additionally identified at least 56 cryptocurrency exchanges processing transactions through Cryptomus. These platforms, designed primarily for Russian-language users, included entities such as casher[.]su, grumbot[.]com, flymoney[.]biz, obama[.]ru, and swop[.]is. According to Sanders's findings, these exchanges marketed themselves as enabling anonymous cryptocurrency swaps and offered cash-out services to accounts at major Russian banks, most of which face Western sanctions.

Industry Response and Enforcement Concerns

When asked about FINTRAC's enforcement decision, Sanders expressed frustration with the timeline and questioned whether the penalty would prove effective as a deterrent.

I have no idea why they don't just sanction them or prosecute them. I'm not let down with the fine amount but it's also just going to be the cost of doing business to them.

Richard Sanders

The $173 million penalty represents a substantial enforcement action by FINTRAC standards. In the previous year, the agency issued 23 penalties totaling less than $26 million combined. However, Sanders contends that FINTRAC must expand its focus to address other questionable money service businesses registered in Canada that may serve as laundering conduits for Russian and Iranian operations.

Broader Pattern of Shell Operations

A July 2024 investigation by CTV National News and the Investigative Journalism Foundation uncovered a systemic problem: multiple money service businesses incorporated at identical addresses across Canada, frequently without the knowledge or authorization of the property's actual occupants.

The investigation revealed that the registered address for Cryptomus's parent company, Xeltox Enterprises, served as the official location for at least 76 foreign currency dealers, eight money service businesses, and six cryptocurrency exchanges. The physical location—a three-story structure formerly used as a bank, now containing a massage therapy clinic and shared office space—showed no evidence that any of these registered entities actually conducted business there.

Journalists also documented a second cluster of 97 money service businesses registered at a commercial office address in Ontario, despite finding no indication that any of these companies had ever contracted for services at that location.

Source: Krebs on Security