Audit log

Every state-changing event for Cryptomus / Xeltox Enterprises Ltd.: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-10 17:06:01Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   GqFMGtdgLa2g…g49PnBGVcopysha256 → base58

   verifying row…

   canonical bytes (22029 B) ▸

   {"actor":"system:backfill","investigation_id":"07e63eaa-1d75-45b0-8fef-47a315a054fd","kind":"publish","page_slug":"cryptomus-xeltox-enterprises-ltd","published_at":"2026-08-10T17:06:01.208Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Cryptomus / Xeltox Enterprises Ltd.","sections":[{"content":"On October 16, 2025, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed an administrative monetary penalty of C$176,960,190 on Xeltox Enterprises Ltd., operating as Cryptomus. The penalty, publicly announced on October 22, 2025, is the largest ever levied by FINTRAC and dwarfs the previous record of approximately C$20 million imposed on KuCoin operator Peken Global Ltd. in September 2024. FINTRAC Director and CEO Sarah Paquet stated: 'Given that numerous violations in this case were connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action.' The penalty was issued under Part 1 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).","heading":"FINTRAC Record Penalty (C$176.96 Million)","severity":"critical","sources":[{"credibility":1,"name":"FINTRAC Official Press Release — Administrative Monetary Penalty on Xeltox Enterprises Ltd.","type":"regulatory","url":"https://fintrac-canafe.canada.ca/new-neuf/nr/2025-10-22-eng"},{"credibility":1,"name":"CBC News — Cryptomus fined $177 million by FINTRAC","type":"news_article","url":"https://www.cbc.ca/news/business/cryptomus-fined-177-million-fintrac-9.6948338"},{"credibility":2,"name":"CoinDesk — Canada's Anti-Money Laundering Watchdog Levies Record $126M Fine on Cryptomus","type":"news_article","url":"https://www.coindesk.com/policy/2025/10/23/canada-s-anti-money-laundering-watchdog-levies-record-usd126m-fine-on-cryptomus"}]},{"content":"FINTRAC identified six categories of violations totaling 2,593 individual breaches. The most numerically significant failures occurred in July 2024 alone: Cryptomus failed to file 1,068 required suspicious transaction reports and 1,518 large virtual currency transaction reports for transactions of C$10,000 or more. FINTRAC found that these unreported transactions involved darknet markets and virtual currency wallets with clear connections to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion. The regulator additionally cited failures to maintain written compliance policies approved by senior officers, failure to assess and document money laundering and terrorist financing risks, and failure to notify FINTRAC of changes to application information.","heading":"AML Violations: Suspicious Transaction Reporting Failures","severity":"critical","sources":[{"credibility":1,"name":"FINTRAC Official Press Release — Administrative Monetary Penalty on Xeltox Enterprises Ltd.","type":"regulatory","url":"https://fintrac-canafe.canada.ca/new-neuf/nr/2025-10-22-eng"},{"credibility":2,"name":"Bennett Jones LLP — C$176.9 Million Fine Against Cryptocurrency Exchange from FINTRAC","type":"research","url":"https://www.bennettjones.com/Insights/Blogs/176-9-million-fine-against-cryptocurrency-exchange-from-FINTRAC-demonstrates-costs-of-non-compliance"},{"credibility":2,"name":"The Tyee — Vancouver Crypto Exchange Fined a Record $177 Million","type":"news_article","url":"https://thetyee.ca/News/2025/10/22/Vancouver-Crypto-Exchange-Fined/"}]},{"content":"FINTRAC found that Cryptomus failed to comply with a Ministerial Directive concerning 'financial transactions associated with the Islamic Republic of Iran.' Between July and December 2024, the platform failed to report 7,557 transactions originating from Iran, failed to treat those transactions as high-risk, and did not verify sender or beneficiary identities or conduct required enhanced due diligence. Blockchain intelligence firm TRM Labs independently identified over 75,000 transactions between Cryptomus and Iranian cryptocurrency exchanges, including more than 50,000 with Nobitex alone — Iran's largest domestic crypto exchange.","heading":"Iran Sanctions Evasion and Ministerial Directive Non-Compliance","severity":"critical","sources":[{"credibility":1,"name":"CBC News — Cryptomus fined $177 million by FINTRAC","type":"news_article","url":"https://www.cbc.ca/news/business/cryptomus-fined-177-million-fintrac-9.6948338"},{"credibility":2,"name":"TRM Labs — Cryptomus Risk Profile (Intel Library)","type":"research","url":"https://www.trmlabs.com/resources/intel-library/cryptomus"},{"credibility":2,"name":"Bennett Jones LLP — C$176.9 Million Fine Against Cryptocurrency Exchange from FINTRAC","type":"research","url":"https://www.bennettjones.com/Insights/Blogs/176-9-million-fine-against-cryptocurrency-exchange-from-FINTRAC-demonstrates-costs-of-non-compliance"}]},{"content":"TRM Labs documented that between 2022 and 2025, Cryptomus processed hundreds of millions of US dollars in transactions associated with child sexual abuse material vendors, terrorist financing networks, human trafficking operations, and sanctions evasion networks. The platform also maintained extensive transaction flows through Garantex, a Russia-based exchange subsequently sanctioned and shut down by authorities. TRM additionally identified at least 56 cryptocurrency exchanges on Cryptomus that facilitated cash-outs to sanctioned Russian banks. Krebs on Security documented 122 illicit services that used Cryptomus as a payment processor, including bulletproof hosting providers, aged account marketplaces, proxy and anonymity services, and anonymous SMS platforms. A December 2025 ransomware payment of USD$122,246 made by a Canadian victim was traced through both Cryptomus and its alleged successor Heleket, with actors operating from Russia and Iran.","heading":"Illicit Actor Exposure: CSAM, Ransomware, Darknet, and Garantex","severity":"critical","sources":[{"credibility":2,"name":"Krebs on Security — Canada Fines Cybercrime Friendly Cryptomus $176M","type":"news_article","url":"https://krebsonsecurity.com/2025/10/canada-fines-cybercrime-friendly-cryptomus-176m/"},{"credibility":2,"name":"TRM Labs — Cryptomus Risk Profile (Intel Library)","type":"research","url":"https://www.trmlabs.com/resources/intel-library/cryptomus"}]},{"content":"On May 20, 2025, the British Columbia Securities Commission (BCSC) issued a temporary order against Xeltox Enterprises Ltd. operating as Cryptomus, finding that the platform may have been violating registration requirements of the Securities Act (British Columbia) and operating as an unrecognized exchange. The order prohibited Cryptomus from trading securities or derivatives and from engaging in promotional activities. The temporary order was set to expire on June 4, 2025, with the BCSC Executive Director retaining the option to petition a BCSC panel for an extension. Following the order, Cryptomus's website became inaccessible to visitors from Canada, displaying a block message.","heading":"BC Securities Commission Temporary Order","severity":"critical","sources":[{"credibility":1,"name":"BC Securities Commission — BCSC Issues Temporary Order Against Crypto Asset Trading Platform","type":"regulatory","url":"https://www.bcsc.bc.ca/about/media-room/news-releases/2025/26-bcsc-issues-temporary-order-against-crypto-asset-trading-platform"},{"credibility":1,"name":"BCSC Temporary Order Citation 2025 BCSECCOM 209","type":"court_filing","url":"https://www.bcsc.bc.ca/-/media/PWS/New-Resources/Decision-and-Orders/Notices-of-Hearing-and-Temporary-Orders/2025/2025-BCSECCOM-209.pdf"},{"credibility":2,"name":"Bennett Jones LLP — C$176.9 Million Fine Against Cryptocurrency Exchange from FINTRAC","type":"research","url":"https://www.bennettjones.com/Insights/Blogs/176-9-million-fine-against-cryptocurrency-exchange-from-FINTRAC-demonstrates-costs-of-non-compliance"}]},{"content":"Xeltox Enterprises Ltd. is incorporated in British Columbia and was previously known as Certa Payments Ltd. Its sole listed director is Sabina Salim Kizi Berdieva, a citizen of Bukhara, Uzbekistan. The founder of the Cryptomus platform is Sanjar Berdiev, also an Uzbekistani national based in Tashkent. During a March 2025 FINTRAC examination, Xeltox representatives communicated from Spain and Uzbekistan and confirmed the company had no employees working in Canada. The company's originally listed Vancouver address — a downtown co-working space — was found by Krebs on Security to be a mail-drop shared by at least 76 foreign currency dealers, 8 money service businesses, and 6 cryptocurrency exchanges, none of which were physically present. A subsequent address in Vancouver's Olympic Village neighbourhood was shared by four other money services businesses. Cryptomus previously advertised that it did not validate user identities as legally required under Canadian law, and admitted providing FINTRAC with non-affiliated phone numbers and inaccessible email addresses for contact purposes.","heading":"Corporate Structure and Phantom Canadian Presence","severity":"high","sources":[{"credibility":2,"name":"Krebs on Security — Canada Fines Cybercrime Friendly Cryptomus $176M","type":"news_article","url":"https://krebsonsecurity.com/2025/10/canada-fines-cybercrime-friendly-cryptomus-176m/"},{"credibility":2,"name":"The Tyee — Vancouver Crypto Exchange Fined a Record $177 Million","type":"news_article","url":"https://thetyee.ca/News/2025/10/22/Vancouver-Crypto-Exchange-Fined/"},{"credibility":1,"name":"Globe and Mail — Cryptocurrency firm appeals $176-million fine by FinTRAC","type":"news_article","url":"https://www.theglobeandmail.com/business/economy/article-cryptocurrency-firm-appeals-176-million-fine-by-fintrac/"}]},{"content":"On November 14, 2025, Xeltox Enterprises filed a notice of appeal in Federal Court challenging the FINTRAC penalty. The company's central legal argument is that FINTRAC erred by treating Xeltox and Cryptomus as functionally the same entity. Xeltox asserts it merely licenses the Cryptomus platform from Padel West S.A., a Panama-incorporated company that Xeltox claims actually owns the platform. The appeal contends the alleged violations were committed by 'foreign licensees' of the Cryptomus platform with no connection to Canada, over which Xeltox had 'no knowledge or control.' To support claims of financial hardship, Xeltox reported only US$150,000 in assets and US$983,000 in gross revenue for January-February 2025. FINTRAC disputed these figures, estimating based on blockchain transaction analysis that Cryptomus generated between US$15.4 million and US$77.2 million in profits over three years.","heading":"Federal Court Appeal and Corporate Separation Defense","severity":"high","sources":[{"credibility":1,"name":"Globe and Mail — Cryptocurrency firm appeals $176-million fine by FinTRAC","type":"news_article","url":"https://www.theglobeandmail.com/business/economy/article-cryptocurrency-firm-appeals-176-million-fine-by-fintrac/"},{"credibility":1,"name":"CBC News — B.C.-incorporated crypto exchange Cryptomus appeals record $177M penalty","type":"news_article","url":"https://www.cbc.ca/news/canada/british-columbia/cryptomus-177-million-fintrac-penalty-appeal-9.6985475"},{"credibility":2,"name":"BetaKit — FINTRAC issues record-setting $177-million fine against crypto exchange Cryptomus","type":"news_article","url":"https://betakit.com/fintrac-issues-record-setting-177-million-fine-against-crypto-exchange-cryptomus/"}]},{"content":"TRM Labs assessed with high confidence that Cryptomus and a payment processor called Heleket are operationally connected. Heleket launched in January 2025, the same month Cryptomus began implementing mandatory KYC controls. Evidence cited by TRM Labs includes: identical unusual website phrasing across both platforms; use of the same privacy-focused domain registrar; matching design elements and identical 0.4% processing fees; shared use of the uncommon term 'project moderation'; personnel overlap including at least one administrator believed to be based in the Baltic region; and the fact that Heleket received its initial on-chain funding from Garantex, the same sanctioned Russian exchange that funded Cryptomus. Forum discussions noted that existing Cryptomus user credentials granted direct access to Heleket — an atypical characteristic for genuinely independent platforms. On-chain analysis shows Cryptomus transaction volumes declining from approximately US$150 million in January 2025 to US$86 million in March 2025 as Heleket's volumes rose correspondingly, consistent with a user migration. Approximately 0.6% of Heleket's 2025 incoming transaction volume was identified as illicit — nearly five times the payment-processor industry average, with sanctions-related entities accounting for 60% of those illicit inflows. South Korean exchange Bithumb subsequently froze transfers to and from Heleket over AML and terrorism financing concerns.","heading":"Alleged Successor Platform: Heleket","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs — Russia-linked Payment Processor Cryptomus Likely Behind Launch of Parallel Service Heleket","type":"research","url":"https://www.trmlabs.com/resources/blog/russia-linked-payment-processor-cryptomus-likely-behind-launch-of-parallel-service-heleket"},{"credibility":2,"name":"TRM Labs — Cryptomus Risk Profile (Intel Library)","type":"research","url":"https://www.trmlabs.com/resources/intel-library/cryptomus"},{"credibility":2,"name":"Crypto Times — Bithumb Freezes Heleket Transfers Over Money Laundering, Terror Links","type":"news_article","url":"https://www.cryptotimes.io/2026/05/21/bithumb-freezes-heleket-transfers-over-money-laundering-terror-links/"}]}],"sources_used":[{"credibility":1,"name":"FINTRAC — Administrative Monetary Penalty on Xeltox Enterprises Ltd.","type":"regulatory","url":"https://fintrac-canafe.canada.ca/new-neuf/nr/2025-10-22-eng"},{"credibility":1,"name":"CBC News — Cryptomus fined $177 million by FINTRAC","type":"news_article","url":"https://www.cbc.ca/news/business/cryptomus-fined-177-million-fintrac-9.6948338"},{"credibility":1,"name":"Globe and Mail — Cryptocurrency firm appeals $176-million fine by FinTRAC","type":"news_article","url":"https://www.theglobeandmail.com/business/economy/article-cryptocurrency-firm-appeals-176-million-fine-by-fintrac/"},{"credibility":1,"name":"CBC News — B.C.-incorporated crypto exchange Cryptomus appeals record $177M penalty","type":"news_article","url":"https://www.cbc.ca/news/canada/british-columbia/cryptomus-177-million-fintrac-penalty-appeal-9.6985475"},{"credibility":1,"name":"BC Securities Commission — BCSC Issues Temporary Order Against Crypto Asset Trading Platform","type":"regulatory","url":"https://www.bcsc.bc.ca/about/media-room/news-releases/2025/26-bcsc-issues-temporary-order-against-crypto-asset-trading-platform"},{"credibility":1,"name":"BCSC Temporary Order Citation 2025 BCSECCOM 209","type":"court_filing","url":"https://www.bcsc.bc.ca/-/media/PWS/New-Resources/Decision-and-Orders/Notices-of-Hearing-and-Temporary-Orders/2025/2025-BCSECCOM-209.pdf"},{"credibility":2,"name":"Krebs on Security — Canada Fines Cybercrime Friendly Cryptomus $176M","type":"news_article","url":"https://krebsonsecurity.com/2025/10/canada-fines-cybercrime-friendly-cryptomus-176m/"},{"credibility":2,"name":"CoinDesk — Canada's Anti-Money Laundering Watchdog Levies Record $126M Fine on Cryptomus","type":"news_article","url":"https://www.coindesk.com/policy/2025/10/23/canada-s-anti-money-laundering-watchdog-levies-record-usd126m-fine-on-cryptomus"},{"credibility":2,"name":"Bennett Jones LLP — C$176.9 Million Fine Against Cryptocurrency Exchange from FINTRAC","type":"research","url":"https://www.bennettjones.com/Insights/Blogs/176-9-million-fine-against-cryptocurrency-exchange-from-FINTRAC-demonstrates-costs-of-non-compliance"},{"credibility":2,"name":"The Tyee — Vancouver Crypto Exchange Fined a Record $177 Million","type":"news_article","url":"https://thetyee.ca/News/2025/10/22/Vancouver-Crypto-Exchange-Fined/"},{"credibility":2,"name":"TRM Labs — Cryptomus Risk Profile (Intel Library)","type":"research","url":"https://www.trmlabs.com/resources/intel-library/cryptomus"},{"credibility":2,"name":"TRM Labs — Russia-linked Payment Processor Cryptomus Likely Behind Launch of Parallel Service Heleket","type":"research","url":"https://www.trmlabs.com/resources/blog/russia-linked-payment-processor-cryptomus-likely-behind-launch-of-parallel-service-heleket"},{"credibility":2,"name":"BetaKit — FINTRAC issues record-setting $177-million fine against crypto exchange Cryptomus","type":"news_article","url":"https://betakit.com/fintrac-issues-record-setting-177-million-fine-against-crypto-exchange-cryptomus/"},{"credibility":2,"name":"Crypto Times — Bithumb Freezes Heleket Transfers Over Money Laundering, Terror Links","type":"news_article","url":"https://www.cryptotimes.io/2026/05/21/bithumb-freezes-heleket-transfers-over-money-laundering-terror-links/"}],"summary":"Cryptomus is a cryptocurrency payment processor and exchange operated by Xeltox Enterprises Ltd., a company incorporated in British Columbia, Canada. In October 2025, Canada's financial intelligence unit FINTRAC imposed a record C$176.96 million (approximately US$126 million) administrative penalty against Xeltox for 2,593 violations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, citing failures to report transactions linked to child sexual abuse material, ransomware payments, fraud, and Iran sanctions evasion. Blockchain intelligence firm TRM Labs further assessed with high confidence that Cryptomus launched a successor platform, Heleket, shortly after implementing mandatory KYC controls, allegedly to continue facilitating illicit activity under a separate brand.","timeline":[{"date":"2022-01-01","event":"Cryptomus platform begins operations. TRM Labs later documents hundreds of millions in transactions associated with illicit actors between 2022 and 2025.","source":"TRM Labs Intel Library","source_url":"https://www.trmlabs.com/resources/intel-library/cryptomus"},{"date":"2024-07-01","event":"During July 2024, Cryptomus fails to file 1,068 suspicious transaction reports and 1,518 large virtual currency transaction reports — the primary basis for the FINTRAC penalty.","source":"FINTRAC Official Press Release","source_url":"https://fintrac-canafe.canada.ca/new-neuf/nr/2025-10-22-eng"},{"date":"2024-07-01","event":"Between July and December 2024, Cryptomus fails to report 7,557 transactions originating from Iran and fails to comply with a Ministerial Directive on Iran-related transactions.","source":"CBC News","source_url":"https://www.cbc.ca/news/business/cryptomus-fined-177-million-fintrac-9.6948338"},{"date":"2025-01-01","event":"Heleket, alleged successor platform to Cryptomus, launches. On January 16, 2025, Heleket receives initial funding from sanctioned Russian exchange Garantex.","source":"TRM Labs — Cryptomus Likely Behind Launch of Heleket","source_url":"https://www.trmlabs.com/resources/blog/russia-linked-payment-processor-cryptomus-likely-behind-launch-of-parallel-service-heleket"},{"date":"2025-02-01","event":"Cryptomus implements mandatory KYC controls. On-chain transaction volume begins declining from approximately US$150 million per month as illicit actors reportedly migrate to Heleket.","source":"TRM Labs — Cryptomus Likely Behind Launch of Heleket","source_url":"https://www.trmlabs.com/resources/blog/russia-linked-payment-processor-cryptomus-likely-behind-launch-of-parallel-service-heleket"},{"date":"2025-03-01","event":"FINTRAC conducts an examination of Xeltox/Cryptomus. Representatives communicate from Spain and Uzbekistan, confirming no Canadian employees.","source":"The Tyee — Vancouver Crypto Exchange Fined a Record $177 Million","source_url":"https://thetyee.ca/News/2025/10/22/Vancouver-Crypto-Exchange-Fined/"},{"date":"2025-05-20","event":"BC Securities Commission issues a temporary order prohibiting Cryptomus from trading securities or derivatives and engaging in promotional activities in British Columbia, citing unregistered exchange operation.","source":"BC Securities Commission News Release","source_url":"https://www.bcsc.bc.ca/about/media-room/news-releases/2025/26-bcsc-issues-temporary-order-against-crypto-asset-trading-platform"},{"date":"2025-10-16","event":"FINTRAC issues the C$176,960,190 administrative monetary penalty against Xeltox Enterprises Ltd. — the largest in the regulator's history.","source":"FINTRAC Official Press Release","source_url":"https://fintrac-canafe.canada.ca/new-neuf/nr/2025-10-22-eng"},{"date":"2025-10-22","event":"FINTRAC publicly announces the penalty. Director Sarah Paquet attributes violations to CSAM trafficking, fraud, ransomware payments, and sanctions evasion. CBC, Globe and Mail, Krebs on Security, and other outlets report the action.","source":"FINTRAC Official Press Release","source_url":"https://fintrac-canafe.canada.ca/new-neuf/nr/2025-10-22-eng"},{"date":"2025-11-14","event":"Xeltox Enterprises files a notice of appeal in Federal Court, arguing FINTRAC erred in treating Xeltox and Cryptomus as the same entity and claiming violations were committed by foreign licensees of Panama-based Padel West S.A.","source":"Globe and Mail — Cryptocurrency firm appeals $176-million fine by FinTRAC","source_url":"https://www.theglobeandmail.com/business/economy/article-cryptocurrency-firm-appeals-176-million-fine-by-fintrac/"},{"date":"2026-05-21","event":"South Korean exchange Bithumb freezes transfers to and from Heleket over AML and terrorism financing concerns, citing the platform's alleged connection to Cryptomus and Garantex.","source":"Crypto Times — Bithumb Freezes Heleket Transfers Over Money Laundering, Terror Links","source_url":"https://www.cryptotimes.io/2026/05/21/bithumb-freezes-heleket-transfers-over-money-laundering-terror-links/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fcd6c848-e23a-4baa-b062-03679ca1cbe1copy