Revealed: How Russian Cybercriminals Turn Cryptocurrency into Cash Through Canadian Firms

The Rise of Canadian Payment Processors for Russian Cybercrime

A financial firm registered in Canada has become the primary payment processor for numerous Russian cryptocurrency exchanges and websites promoting cybercrime services targeted at Russian-speaking customers. An investigation has uncovered that the Vancouver address associated with this company is home to numerous foreign currency dealers and money transfer businesses, none of which are actually located there.

Insights from Richard Sanders

Richard Sanders, a blockchain analyst, has spent significant time in Ukraine, studying how Russian crypto exchanges launder money for narcotics networks. Recently, he has focused on how popular cybercrime services receive payments and convert cryptocurrency revenues into cash. His research targeted 122 services that include:

• Abuse-friendly hosting providers like anonvm[.]wtf
• Sites selling aged email and social media accounts like verif[.]work
• Anonymity providers such as crazyrdp[.]com
• Anonymous SMS services like anonsim[.]net

The Role of Cryptomus

All services tested by Sanders are reportedly processing transactions through Cryptomus, a cryptocurrency payments platform based in Vancouver. It is associated with Xeltox Enterprises Ltd., a registered money service business with FINTRAC. At least 56 cryptocurrency exchanges are utilizing Cryptomus for transactions, facilitating anonymous exchanges of cryptocurrency for cash in accounts at sanctioned Russian banks.

Sanctions Evasion Tactics

In response to sanctions against Russia, major exchanges like Binance have restricted transactions involving Russian banks. However, Russian exchanges have shifted to Cryptomus, which offers a layer of obfuscation by generating new wallets for each transaction, thus complicating tracking efforts. The ease of transactions has increased as these platforms bypass Know Your Customer regulations.

Phantom Addresses and Regulatory Issues

The address for Cryptomus has been linked to numerous money services businesses, raising concerns about the legitimacy of these operations. Investigations reveal that many MSBs are clustered at the same address in Canada, which undermines the registration requirements designed to combat money laundering.

The Future of Cryptocurrency in Russia

Recent legislation in Russia has legalized cryptocurrency mining and international payments, indicating a significant shift in the country's approach to cryptocurrency. This move may enhance Russia's ability to evade sanctions and engage in trade outside the U.S.-led financial system. According to Chainalysis, Cryptomus is reportedly used for laundering money and purchasing services across various illegal activities.

The Mystery of Xeltox Enterprises

The actual presence of Cryptomus and Xeltox Enterprises in Canada remains questionable, with investigations revealing possible links to questionable entities in jurisdictions known for lax regulatory oversight. As of early 2024, Canada continues to serve as an attractive location for cryptocurrency businesses, raising alarms about potential abuses of the system.