Financial regulators in Canada have levied a record-breaking $176 million fine against Cryptomus, a digital payments platform that has been accused of facilitating cybercrime and money laundering. The penalties come after an investigation by FINTRAC found that Cryptomus failed to submit suspicious transaction reports in cases where there were reasonable grounds to suspect that they were related to the laundering of proceeds connected to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion.

What Happened

The Financial Transactions and Reports Analysis Center of Canada (FINTRAC) imposed a $176,960,190 penalty on Xeltox Enterprises Ltd., more commonly known as the cryptocurrency payments platform Cryptomus. The fine is a result of an investigation that found Cryptomus had failed to comply with Canadian anti-money-laundering laws in numerous instances.

FINTRAC's investigation revealed that Cryptomus had processed transactions involving wallets and entities known to be associated with darknet markets and criminal activity, including child sexual abuse material, fraud, ransomware, and sanctions evasion. In 1,068 instances, Cryptomus failed to report these transactions, which involved direct and indirect exposure to darknet markets such as ASAP Market, Mega Darknet Market, Blacksprut Market, and OMG!OMG! Market.

The platform also failed to comply with Canadian ministerial directives by not reporting 7,557 transactions originating from Iran, a jurisdiction subject to enhanced scrutiny due to its high risk of money laundering and terrorist financing. These findings are particularly concerning given the role that cryptocurrency platforms like Cryptomus play in facilitating illicit financial flows.

Background and Context

Cryptomus has been accused of enabling cybercrime by supporting dozens of Russian cryptocurrency exchanges and websites involved in ransomware, darknet markets, and sanctions evasion. In December 2024, KrebsOnSecurity covered research by blockchain analyst and investigator Richard Sanders, who spent several months signing up for various cybercrime services and tracking where their customer funds go from there.

The 122 services targeted in Sanders's research all used Cryptomus, and included some of the more prominent businesses advertising on the cybercrime forums. These platforms were built for Russian speakers and advertised the ability to anonymously swap one form of cryptocurrency for another. They also allowed the exchange of cryptocurrency for cash in accounts at some of Russia's largest banks – nearly all of which are currently sanctioned by the United States and other western nations.

Sanders found at least 56 cryptocurrency exchanges were using Cryptomus to process transactions, including financial entities with names like casher[.]su, grumbot[.]com, flymoney[.]biz, obama[.]ru, and swop[.]is. These findings highlight the need for robust anti-money laundering (AML) and counter-terrorist financing (CTF) controls in the digital asset ecosystem.

Why it Matters to the Industry

The Cryptomus case is a watershed moment in the intersection of cryptocurrency, cybercrime, and regulatory enforcement. The technical and operational details of the violations provide a comprehensive view of the evolving threat landscape and the sophisticated tactics, techniques, and procedures (TTPs) employed by cybercriminals.

This case serves as a reminder that adult-industry platforms and operators must prioritize AML and CTF controls to prevent their services from being used for illicit activities. The industry must also be vigilant in monitoring its supply chain and ensuring that it is not inadvertently facilitating cybercrime or money laundering.

What Comes Next

The $176 million fine imposed on Cryptomus is a significant step towards holding cryptocurrency platforms accountable for their role in facilitating illicit financial flows. However, this case also highlights the need for continued regulatory scrutiny and enforcement action to prevent these types of violations from occurring in the future.

Key Facts

  • Cryptomus was fined $176 million by FINTRAC for violating Canadian anti-money-laundering laws.
  • The platform failed to submit suspicious transaction reports in cases where there were reasonable grounds to suspect that they were related to the laundering of proceeds connected to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion.
  • Cryptomus processed transactions involving wallets and entities known to be associated with darknet markets and criminal activity.
  • The platform failed to comply with Canadian ministerial directives by not reporting 7,557 transactions originating from Iran.
  • At least 56 cryptocurrency exchanges were using Cryptomus to process transactions, including financial entities with names like casher[.]su, grumbot[.]com, flymoney[.]biz, obama[.]ru, and swop[.]is.

The Cryptomus case serves as a warning to the adult-industry platforms and operators that they must prioritize AML and CTF controls to prevent their services from being used for illicit activities. The industry must also be vigilant in monitoring its supply chain and ensuring that it is not inadvertently facilitating cybercrime or money laundering.