Canada Imposes $176 Million Fine on Cryptomus for Aiding Cybercrime Operations

Canadian regulators have imposed a record-breaking $176 million fine against Cryptomus, a cryptocurrency payments platform accused of facilitating transactions linked to cybercrime, sanctions evasion, and illicit online activities. The Financial Transactions and Reports Analysis Center of Canada (FINTRAC) announced the penalty against Xeltox Enterprises Ltd.—the company operating as Cryptomus—after determining that it repeatedly failed to report suspicious transactions involving proceeds from child exploitation, fraud, and ransomware.

The enforcement action, finalized on October 16, marks one of the most significant anti–money laundering penalties in Canadian history. FINTRAC’s investigation found that Cryptomus ignored clear red flags in transactions tied to criminal enterprises. “Given that numerous violations were connected to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action,” said Sarah Paquet, the agency’s director and CEO.

Cryptomus, which operates globally but lists a Vancouver address, was previously exposed in a 2024 investigation by cybersecurity journalist Brian Krebs. His reporting revealed that the platform served as a hub for dozens of Russian-language cryptocurrency exchanges and websites offering cybercrime tools. Among the 122 illicit services identified were providers selling stolen accounts, “bulletproof” hosting infrastructure, and anonymous communication services. Blockchain researcher Richard Sanders, whose work informed much of FINTRAC’s inquiry, found that at least 56 crypto exchanges relied on Cryptomus to process transactions. Many of these exchanges allowed anonymous swaps between digital assets and even offered cash-out options through sanctioned Russian banks.

Sanders said he was “not surprised” by the fine but criticized regulators for their slow response. “This will probably be treated as the cost of doing business,” he noted, suggesting that stronger sanctions or criminal charges may be necessary to deter repeat offenders.

The penalty is a substantial escalation for FINTRAC, which issued just 23 fines last year totaling under $26 million. It also highlights Canada’s growing struggle with “phantom” money service businesses—shell entities registered at fake or shared addresses to obscure ownership and evade oversight. A joint investigation by CTV National News and the Investigative Journalism Foundation uncovered dozens of MSBs incorporated at single addresses across the country, often without the consent of the property owners.

Cryptomus’s own registered address in Vancouver was listed as home to more than 70 foreign currency dealers, multiple money transfer firms, and several crypto exchanges—all of which appeared to exist only on paper. The building, once a bank branch, now houses a massage therapy clinic and co-working offices, but investigators found no evidence that Cryptomus or its affiliates operated there physically.

The $176 million penalty sends a clear message that Canadian authorities are intensifying their crackdown on digital financial intermediaries used for illicit purposes. Still, analysts warn that enforcement must extend beyond fines if regulators hope to stem the flow of laundered crypto assets passing through Canadian-registered shell firms.