Cryptomus / Xeltox Enterprises Ltd.
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3ZDcma…XcPASummary
Cryptomus is a cryptocurrency payment processor and exchange operated by Xeltox Enterprises Ltd., a company incorporated in British Columbia, Canada. In October 2025, Canada's financial intelligence unit FINTRAC imposed a record C$176.96 million (approximately US$126 million) administrative penalty against Xeltox for 2,593 violations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, citing failures to report transactions linked to child sexual abuse material, ransomware payments, fraud, and Iran sanctions evasion. Blockchain intelligence firm TRM Labs further assessed with high confidence that Cryptomus launched a successor platform, Heleket, shortly after implementing mandatory KYC controls, allegedly to continue facilitating illicit activity under a separate brand.
Connected Entities
4 entities · 60 linked investigations- Cryptomus / Xeltox Enterprises Ltd.→mentioned with→Phantom Wallet(60%)
- Cryptomus / Xeltox Enterprises Ltd.→mentioned with→Nobitex(60%)
- Cryptomus / Xeltox Enterprises Ltd.→mentioned with→KuCoin(60%)
Connected Through
3 shared actors · 157 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦KuCointokenalso infake Ledger Live app·0LAB / LABUSDT·0AI Agent Prompt Injection Crypto Attack Class (2026)·0LAB Token (LabsAI)·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0Q2 2026 DeFi Record Hack Wave·0MiCA Non-Compliant Exchange Risk Cluster (Post-July 1, 2026)·0AscendEX — Insolvency and Withdrawal Freeze (July 2026)·0Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)·0CYBERLEEK Token·0Miloud Abderrahmane (ISIS Crypto Facilitator)·1Socket Security Malicious Browser Extension Campaign August 2026·2Alexander Vladimirovich Ledenev·2Leva Heal Limited (Fake Ledger Live App - Apple App Store)·2Xaman Wallet Impersonation / XRP Airdrop Phishing (2026)·2Rublevka Team·2M1llionz (RichMilly666)·3AudiA6 Mixing Service·3Shivolink (SLINK)·3LAB Token (Smartliquid AI)·4zkLend (Starknet)·47zarc·4Raidparty·4LAB Token·4Crypto Beast (ALT Token Influencer)·4Crypto Beast·4World Cup PvP Token (WCUP)·4Terra 2.0·7Secret Network / Axelar Bridge Exploit June 2026·8James Wynn·8Wanchain-Cardano Bridge NIGHT Token Exploit (July 2026)·8Secret Network / Axelar IBC Bridge Exploit (June 2026)·8SIREN Token·9Best Wallet / BEST Token Presale·10Swan Treasury (STY Token)·10Dego Finance·10Masa·12Zilliqa Exchange Partner Cold Wallet Hack (July 2026)·12Baton Corporation Ltd (Pump.fun)·12Cypher Protocol·12Step App (FITFI)·14Austin Fine (@xmrfine)·18MiCA EU Mass Non-Compliance — 83% Unlicensed Platform Risk·18Cetus CLMM·18Baton Corporation (Pump.fun)·18BitcoinDepot·18Eesee (Abandoned NFT Marketplace by LAB Founders)·18zkLend·20B-Squared Network·20Philippines SEC — Multi-Exchange Unlicensed Operations Enforcement·20Pepe (PEPE)·20CyberLeek Solana Token·22CyberLeek / CYBERLEEK Solana Token·22RocketSwap Base·22MSCST (MSC Protocol)·22Ranger Finance·22ProBit Global·23B² Network·23Metawin·23Goatseus Maximus (GOAT)·23ALEX Lab·24OKB·25KuCoin·28TBTFW (Beverly Hills Luxury Car Dealer — Crypto Laundering Vector)·28OlaXBT·28GriffinAI·28Moonbeam Network (GLMR)·28Trust Wallet Chrome Extension Hack (December 2025)·28Cetus Protocol·28Singularity Finance·28Vulcan Forged·28Symbiosis Finance BridgeV2 syBTC Exploit (September 2026)·30Akropolis·30KiiChain·32Midas Capital·32KuCoin Exchange Hack·32Gate.io·32United Stables (U)·33Griffain·37Fogo·38Symbiosis Finance·38Port3 Network·38KAT katana-network·39yg·39ADI·40Midnight Network / NIGHT Token·42GooseFX·420G Labs·43Ledger Live·50PeopleDAO·52Trust Wallet·55Injective Protocol·55Allo Protocol·57Playsomo·60Spark Protocol·62Jupiter Exchange·62USDGO·66
- □Phantom Walletorganizationalso inMastra AI npm Supply Chain Attack (June 2026)·0node-gyp npm Supply Chain Compromise (June 2026)·0Uniswap Google Ad Phishing Campaign (May 2026)·0UNK_DeadDrop North Korea Developer Phishing Campaign·0Miasma npm Supply Chain Attack (Red Hat)·0Solana Blinks / Durable-Nonce Drainer Kits (2026)·0World Cup 2026 — Stake.com Impersonation Wallet Drainer Campaign·0Fake Jupiter CJUP Airdrop Phishing Campaign·0TeamPCP / Mini Shai-Hulud npm Supply Chain Worm·0Sector Drainer — DaaS Wallet Drainer with Phantom 0-Day Bypass·0Fake Uniswap V4 Airdrop Phishing Network (2026)·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0easy-day-js / Mastra npm Supply Chain Attack·0Phantom Gyp npm Supply Chain Attack (June 2026)·0Rugproof (Solana Launchpad)·0Fake MetaMask Update Phishing Campaign (May 2026)·0Quark Drainer·0GSD Cloud / Lex Christopherson·0AsyncAPI npm Supply Chain Attack (Miasma RAT) — July 2026·0Solidity Pro VSCode Extension (Malicious)·0CastleLoader / NeedleStealer Crypto Wallet Malware Campaign·0Morocoin / Berge Blockchain / Cirkor·0Donald G. Basile / Bitcoin Latinum (LTNM)·2Donald Basile / Bitcoin Latinum (LTNM) / Monsoon Blockchain Corporation·2Rublevka Team·2Leo Platform npm Supply Chain Attack (June 2026)·3Miasma npm Supply Chain Attack·5DeepSnitch AI·12WAYGU CASH·18Ctrl Wallet — Security Exploit and Forced Shutdown·22BullX·27LiFi Finance·32Grass·38LiFi Protocol·38Leap Wallet·52Fuse Wallet·54Lulo·55Transak·55Famous Fox Federation·57Phantom Wallet·63Kaspa·64Dialect·69Glow Wallet·72
- □Nobitexorganizationalso inSiavash Kayvanpour·0OFAC Iran Central Bank Crypto Wallet Freeze (July 2026)·0Operation Economic Outcast — Iran Digital Assets Sectoral Sanctions (August 2026)·0Babak Zanjani Network — Expanded OFAC Designations (July 2026)·0OFAC Operation Economic Outcast — Iran Digital Assets Sectoral Sanctions August 2026·0Operation Economic Outcast — Iran Digital Asset Sanctions·0Iranian Crypto Exchanges OFAC Designation — Nobitex, Wallex, Bitpin, Ramzinex (June 2026)·0Shelbit Exchange·0Amir Hossein Rad·0Nobitex / Wallex / Bitpin / Ramzinex·0Aban Tether·0BitBank (Iranian Crypto Exchange)·2Iran IRGC Crypto Exchange Network (OFAC Sectoral Sanctions)·2Siavash Kayvanpour — OFAC-Designated Shelbit Founder·2Blessed Trust & Hexa Whale·2Nobitex·5Huobi / HTX·7Nobitex June 2025 Hack (Predatory Sparrow)·10Predatory Sparrow (Gonjeshke Darande)·22
Timeline(11 events)
2022
Cryptomus platform begins operations. TRM Labs later documents hundreds of millions in transactions associated with illicit actors between 2022 and 2025.
TRM Labs Intel LibraryJuly 2024
During July 2024, Cryptomus fails to file 1,068 suspicious transaction reports and 1,518 large virtual currency transaction reports — the primary basis for the FINTRAC penalty.
FINTRAC Official Press ReleaseJuly 2024
Between July and December 2024, Cryptomus fails to report 7,557 transactions originating from Iran and fails to comply with a Ministerial Directive on Iran-related transactions.
CBC News2025
Heleket, alleged successor platform to Cryptomus, launches. On January 16, 2025, Heleket receives initial funding from sanctioned Russian exchange Garantex.
TRM Labs — Cryptomus Likely Behind Launch of HeleketFebruary 2025
Cryptomus implements mandatory KYC controls. On-chain transaction volume begins declining from approximately US$150 million per month as illicit actors reportedly migrate to Heleket.
TRM Labs — Cryptomus Likely Behind Launch of HeleketMarch 2025
FINTRAC conducts an examination of Xeltox/Cryptomus. Representatives communicate from Spain and Uzbekistan, confirming no Canadian employees.
The Tyee — Vancouver Crypto Exchange Fined a Record $177 Million20 May 2025
BC Securities Commission issues a temporary order prohibiting Cryptomus from trading securities or derivatives and engaging in promotional activities in British Columbia, citing unregistered exchange operation.
BC Securities Commission News Release16 October 2025
FINTRAC issues the C$176,960,190 administrative monetary penalty against Xeltox Enterprises Ltd. — the largest in the regulator's history.
FINTRAC Official Press Release22 October 2025
FINTRAC publicly announces the penalty. Director Sarah Paquet attributes violations to CSAM trafficking, fraud, ransomware payments, and sanctions evasion. CBC, Globe and Mail, Krebs on Security, and other outlets report the action.
FINTRAC Official Press Release14 November 2025
Xeltox Enterprises files a notice of appeal in Federal Court, arguing FINTRAC erred in treating Xeltox and Cryptomus as the same entity and claiming violations were committed by foreign licensees of Panama-based Padel West S.A.
Globe and Mail — Cryptocurrency firm appeals $176-million fine by FinTRAC21 May 2026
South Korean exchange Bithumb freezes transfers to and from Heleket over AML and terrorism financing concerns, citing the platform's alleged connection to Cryptomus and Garantex.
Crypto Times — Bithumb Freezes Heleket Transfers Over Money Laundering, Terror LinksDecision Log
- hash: FR4WxeiUWAdMmyWQCdN4hFKc9Vt7rYHsy2TFaDmqCK1B
- hash: ENL5ACVmPNEYhS1Yqef6kryAgsUkbviTCxaxPTLj4aBF
- hash: GqFMGtdgLa2gHJqzKA8iwFsf4cKc91TarzKsg49PnBGV
This investigation is cryptographically anchored to the Solana blockchain (3 events). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/10/2026, 5:05:42 PM
last updated: 8/25/2026, 7:21:52 PM
4 viewsavoid.net — verified advice for a post-truth world