SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Researcher traces payments for 122 cybercrime services to one Vancouver processor
Blockchain analyst Richard Sanders found all 122 cybercrime services he tested take payments through Cryptomus, a processor that lists a Vancouver address. A CTV and IJF count found at least 90 registrations at the same street address.
The Watch · Security desk
Four figures. Sanders says all 122 cybercrime services he tested pay through Cryptomus, and his data shows at least 56 crypto exchanges using it. CTV and IJF found at least 90 registrations at 422 Richards St., including at least 76 foreign currency dealers.
- 122 services Services tested, all via Cryptomus, claim 2 Per Sanders
- 56 exchanges Crypto exchanges using Cryptomus, claim 6 At least, per Sanders's payment data
- 90 registrations Registrations at 422 Richards St., claim 21 At least
- 76 dealers Foreign currency dealers there, claim 15 At least, per the CTV and IJF inquiry
| Figure | Value | Note | Claim |
|---|---|---|---|
| Services tested, all via Cryptomus | 122 services | Per Sanders | 2 |
| Crypto exchanges using Cryptomus | 56 exchanges | At least, per Sanders's payment data | 6 |
| Registrations at 422 Richards St. | 90 registrations | At least | 21 |
| Foreign currency dealers there | 76 dealers | At least, per the CTV and IJF inquiry | 15 |
What happened
- The tested services include bulletproof hosting such as anonvm[.]wtf and PQHosting, sellers of aged accounts, proxy providers and anonymous SMS services.
- At least 56 exchanges also use Cryptomus, according to Sanders's payment data. They target Russian speakers and cash out to large Russian banks, nearly all of them sanctioned by the US and other western nations.
- All of those exchanges use Russian email providers, and most are hosted in Russia or by Russia-backed ISPs such as Selectel, Netwarm UK, Beget, Timeweb and DDoS-Guard.
- Cryptomus' website says its parent, Xeltox Enterprises Ltd., formerly certa-pay[.]com, is registered as a money service business with Canada's FINTRAC.
- In July, CTV National News and the Investigative Journalism Foundation documented dozens of Canadian cases where several MSBs share one address, often without the occupant's knowledge or consent.
Why it matters
- capability The inputs for large-scale anonymous social media campaigns, meaning hosting, aged accounts, proxies and SMS numbers, can all be paid for through one processor, according to Sanders's data.
- exposure Two links in the chain sit in Western jurisdictions: the Canadian-registered processor and the San Francisco content delivery network that nearly all 56 exchanges use. The email, hosting and bank links are Russian or sanctioned.
- constraint CTV and the IJF found registrations at shared Canadian addresses often exist without the occupant's knowledge. Cryptomus' FINTRAC listing and Suite 170 address do not by themselves show who runs it.
Cryptomus says it is a cryptocurrency payments platform based in Vancouver, British Columbia [3]. Sanders, a blockchain analyst who advises the law enforcement and intelligence community [20], signed up for the services and tracked where customer funds went [18]. He describes the customers differently. "Unfortunately, it is next to impossible to find any goods for sale with websites using Cryptomus, and the services appear to fall into one or two different categories: Facilitating transactions with sanctioned Russian banks, and platforms providing the infrastructure and means for cyber attacks," he told KrebsOnSecurity [10]. Cryptomus did not respond to multiple requests for comment [11].
Sanders reached these services from the disinformation side. He first came across some of them while investigating Kremlin-funded efforts in Ukraine, because they are useful for assembling large-scale, anonymous social media campaigns [5]. In 2023 he spent most of the year in Ukraine mapping Russian exchanges that launder money for narcotics networks [17]. The cybercrime revenue he is tracing now also ends at Russian exchanges [1].
At the payment layer the chain narrows to one company. Cryptomus is the one name common to both groups: the 122 services in Sanders's sample [2] and at least 56 exchanges [6]. In our view that makes it the narrowest point in the chain. The 122 are the services his research targeted [19], so "all 122" is a count inside his sample, not a market-wide figure.
The address needs the same care. CTV National News and the Investigative Journalism Foundation found at least 76 foreign currency dealers registered at 422 Richards St., along with eight MSBs and six cryptocurrency exchanges [15]. That is at least 90 registrations [21]. KrebsOnSecurity reported that none of the dealers, transfer businesses and exchanges tied to the address are physically located there [16]. Cryptomus and its FINTRAC listing give its registered address as Suite 170 at 422 Richards St. [13].
What to watch
- Whether FINTRAC or other Canadian authorities act on the Cryptomus registration or the listings at 422 Richards St.
- Whether the 122 services move to another processor after publication, which a repeat of Sanders's payment tracing would show.
- Whether Cryptomus answers the requests for comment it has so far left unanswered.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A financial firm registered in Canada is the payment processor for dozens of Russian cryptocurrency exchanges and websites selling cybercrime services aimed at Russian-speaking customers, new research finds.
- [2]
According to Sanders, all 122 of the services he tested are processing transactions through a company called Cryptomus.
- [3]
Cryptomus says it is a cryptocurrency payments platform based in Vancouver, British Columbia.
- [4]
The 122 services include bulletproof hosting providers such as anonvm[.]wtf and PQHosting, sellers of aged email, financial or social media accounts such as verif[.]work and kopeechka[.]store, proxy providers such as crazyrdp[.]com and rdp[.]monster, and anonymous SMS services such as anonsim[.]net and smsboss[.]pro.
- [5]
Sanders said he first encountered some of these services while investigating Kremlin-funded disinformation efforts in Ukraine, as they are all useful in assembling large-scale, anonymous social media campaigns.
- [6]
Sanders said the payment data he gathered shows at least 56 cryptocurrency exchanges are currently using Cryptomus to process transactions.
- [7]
The exchanges are built for Russian speakers and advertise anonymous swaps between cryptocurrencies. They also allow the exchange of cryptocurrency for cash in accounts at some of Russia's largest banks, nearly all of which are currently sanctioned by the United States and other western nations.
- [8]
An analysis of the exchanges' technology infrastructure shows all of them use Russian email providers, and most are hosted directly in Russia or by Russia-backed ISPs with infrastructure in Europe, such as Selectel, Netwarm UK, Beget, Timeweb and DDoS-Guard.
ReportedSupportedSource: KrebsOnSecurity, reporting analysis of the exchanges' infrastructureView cited source - [9]
Nearly all 56 exchanges used services from Cloudflare, a content delivery network based in San Francisco.
ReportedSupportedSource: KrebsOnSecurity, reporting analysis of the exchanges' infrastructureView cited source - [10]
"Unfortunately, it is next to impossible to find any goods for sale with websites using Cryptomus, and the services appear to fall into one or two different categories: Facilitating transactions with sanctioned Russian banks, and platforms providing the infrastructure and means for cyber attacks," Sanders told KrebsOnSecurity.
- [11]
Cryptomus did not respond to multiple requests for comment.
- [12]
Cryptomus' website says its parent firm, Xeltox Enterprises Ltd. (formerly certa-pay[.]com), is registered as a money service business with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).
- [13]
The Cryptomus website and its FINTRAC listing say the company's registered address is Suite 170, 422 Richards St. in Vancouver, BC.
ReportedSupportedSource: Cryptomus website and FINTRAC listing, as reported by KrebsOnSecurityView cited source - [14]
A July investigation by CTV National News and the Investigative Journalism Foundation documented dozens of cases across Canada where multiple MSBs are incorporated at the same address, often without the knowledge or consent of the location's actual occupant.
ReportedSupportedSource: CTV National News and the Investigative Journalism Foundation, as reported by KrebsOnSecurityView cited source - [15]
The CTV and IJF inquiry found 422 Richards St. was listed as the registered address for at least 76 foreign currency dealers, eight MSBs, and six cryptocurrency exchanges.
ReportedSupportedSource: CTV National News and the Investigative Journalism Foundation, as reported by KrebsOnSecurityView cited source - [16]
KrebsOnSecurity reported that an investigation into the Vancouver street address used by Cryptomus shows it is home to dozens of foreign currency dealers, money transfer businesses and cryptocurrency exchanges, none of which are physically located there.
- [17]
Sanders spent most of 2023 in Ukraine, traveling with Ukrainian soldiers while mapping the shifting landscape of Russian crypto exchanges that are laundering money for narcotics networks operating in the region.
- [18]
For the past several months, Sanders has been signing up for various cybercrime services and then tracking where their customer funds go.
- [19]
The 122 services targeted in Sanders' research include some of the more prominent businesses advertising on cybercrime forums today.
- [20]
Richard Sanders is a blockchain analyst and investigator who advises the law enforcement and intelligence community.
- [21]
At least 90 registrations are listed at 422 Richards St.
Sources
1 independent publisher whose own reporting we read for this story.
- krebsonsecurity.comKrebsOnSecurity
1 article · October 11, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Money services business regulationFollow
- Cybercrime payment infrastructureFollow
- Sanctions EvasionFollow
- Bulletproof Hosting InfrastructureFollow
Entities
- CryptomusFollow
- Richard SandersFollow
- KrebsOnSecurityFollow
- FINTRACFollow
- CloudflareFollow
- Investigative Journalism FoundationFollow
- CTV National NewsFollow