Cryptomus: the payment processor that facilitates cybercrime and evasion of Russian sanctions

A Canadian company facilitates transactions for Russian crypto exchanges and cybercrime services

A company registered in Canada, Cryptomus, emerges as the main payment processor for dozens of Russian cryptocurrency exchanges and sites offering cybercrime services to Russian-speaking clients. The investigation reveals that the Vancouver address declared by the company hosts dozens of other financial entities, none physically present.

Quick Response

The infrastructure of cybercrime services

Among the services analyzed are "bulletproof" hosting providers like anonvm[.]wtf and PQHosting, sites selling verified email and social media accounts like verif[.]work and kopeechka[.]store, proxy providers like crazyrdp[.]com and rdp[.]monster, and anonymous SMS services like anonsim[.]net and smsboss[.]pro. These tools were identified during investigations into disinformation campaigns funded by the Kremlin in Ukraine.

The connections with the Russian financial system

Technological analysis reveals that all exchanges use Russian email providers and are hosted in Russia or on European infrastructure controlled by pro-Russian ISPs like Selectel, Netwarm UK, Beget, Timeweb, and DDoS-Guard. The majority also use Cloudflare services, despite Western sanctions against these entities.

The ghost address in Vancouver

The registered address of Cryptomus, 422 Richards Street in Vancouver, would host at least 76 foreign exchange dealers, 8 MSBs, and 6 cryptocurrency exchanges, according to an investigation by CTV National News and the Investigative Journalism Foundation. The building, a former bank now home to a massage clinic and a co-working space, does not physically house any of these companies.

Regulatory violations and money laundering risks

Peter German, former deputy commissioner of the Royal Canadian Mounted Police, described this concentration as "an abuse of the system." Ten MSBs registered at this address have had their registration revoked, including a company with a director with an address in Russia. Others appear to have links to high-risk money laundering jurisdictions like Cyprus.

Sanctions evasion through cryptocurrencies

After Binance and other exchanges limited services for Russian clients in 2023, many migrated to Cryptomus, which generates separate encrypted wallets for each transaction. This "matryoshka" structure hinders transaction attribution, making it easier for Russians to conduct exchanges without KYC procedures.

Russia's strategic adoption of cryptocurrencies

Russia's recent legalization of cryptocurrency mining and use for international payments represents a strategic shift. According to Chainalysis, this move aims to bypass the Western financial system and facilitate trade in non-dollarized currencies, despite sanctions.

Implications for NIS2 and DORA compliance

The widespread use of these services raises concerns for companies subject to NIS2 and DORA compliance. The ability to evade sanctions through platforms like Cryptomus requires careful analysis of financial transactions and continuous monitoring of critical service providers.

The importance of SOC as a Service for early detection

Given the complex sanctions evasion scheme described, a SOC as a Service specialized in blockchain analysis could prove crucial for identifying suspicious transactions and preventing exposure to financial and reputational risks.

The need for cyber insurance for financial institutions

Financial institutions operating in this space may consider a cyber risk policy to cover potential losses resulting from sanctions violations or exposure to cybercrime services, with particular attention to the cost of cyber insurance and specific coverages for encrypted transactions.