Cryptomus & Cybercrime: Cashing Out in Russian Banks

The KrebsOnSecurity investigation uncovers a complex network of Russian cryptocurrency exchanges, cybercrime platforms, and payment processors that enable sanctioned Russian banks to continue operating in global finance. At the center of this scheme is Cryptomus, a Vancouver-registered Canadian company facilitating anonymous crypto-to-cash conversions to launder funds and convert crypto into cash at sanctioned Russian banks, highlighting loopholes in global financial oversight.  

How Russian Cybercrime Services Use Cryptocurrency  

• 122 cybercrime services were analyzed, including bulletproof hosting, fake accounts, proxy providers, and anonymous SMS platforms. 
• All of these services processed payments through Cryptomus, which claims to be a legitimate crypto payments platform.
• These platforms allow anonymous swaps of cryptocurrency into cash deposited in Russian bank accounts, many of which are under Western sanctions.  

Cryptomus and Canadian Registration Loopholes  

• Cryptomus’ parent company, Xeltox Enterprises Ltd., is registered as a Money Service Business (MSB) with Canada’s FINTRAC. 
• Its listed Vancouver address (422 Richards St.) is linked to dozens of shell companies, many of which have no physical presence.  
• Investigations revealed clusters of MSBs at single addresses, raising concerns about money laundering and regulatory abuse.  

Sanctions Evasion and Russian Crypto Policy  

After Binance and other exchanges restricted Russian users in 2023, many platforms migrated to Cryptomus.  

• Cryptomus generates new wallets for each transaction, making tracking difficult.  
• Russia legalized crypto mining and international payments in 2024, signaling a pivot toward crypto as a tool to bypass sanctions. 
• Blockchain analysts warn that this integration strengthens Russia’s ability to conduct non-dollar denominated trade.  

Shell Companies and Global Risks 

• Cryptomus and Xeltox appear connected to shell entities in the UK, Cyprus, and Western Sahara, often directed by young or inexperienced individuals. 
• Chainalysis reports Cryptomus is used by ransomware groups, narcotics networks, darknet markets, and fraudsters.  
• Canada’s lax oversight of MSBs makes it an attractive jurisdiction for crypto laundering operations.  

Conclusion  

This investigation highlights how cryptocurrency payment processors like Cryptomus exploit regulatory loopholes to facilitate sanctions evasion, cybercrime financing, and money laundering. The findings underscore the urgent need for stricter oversight of MSBs and international cooperation to close gaps in crypto regulation.