A cryptocurrency exchange registered in downtown Vancouver has traded tens of millions of dollars with clients of a Russian platform linked to prolific cybercriminals, according to experts consulted by the Investigative Journalism Foundation.
Three analysts told the IJF that the Canadian exchange Cryptomus was used to trade large volumes of cryptocurrency with accounts hosted by Garantex, a notorious cryptocurrency exchange favoured by Russians hoping to avoid sanctions.
Those analysts also said Cryptomus, which did not respond to multiple requests for comment for this story, also had a documented history of trading with Nobitex, an Iranian cryptocurrency exchange.
Cryptomus made those trades even after it had registered with Canada's financial intelligence agency, whose mandate includes stopping sanctions evasion. The company still holds that registration.
Transferring funds in apparent defiance of Canadian sanctions shows critical weaknesses in Canada’s oversight of such companies and raises questions about why authorities did not act, experts say.
“One wonders what the diligence process is behind these, because there doesn’t seem to be a lot of information or clarity in terms of what it actually takes to be registered,” said Michael Ecclestone, an anti-money laundering expert with the AML Shop consultancy in Ottawa.
Cryptomus, legally incorporated in British Columbia under the name Xeltox Enterprises, advertises itself as a payment processor for merchants who want to accept payment in cryptocurrencies like Bitcoin. It also allows users to trade those cryptocurrencies between themselves.
The company’s website is blocked in Canada, and British Columbian securities investigators have accused it of violating the law by operating as a crypto trading platform without registering with the provincial regulator.
The IJF contacted three independent analysts who all used different proprietary software to examine trades between Cryptomus and Garantex, a now-defunct exchange the U.S. Department of Justice claims was used to launder hundreds of millions of dollars in criminal proceeds, particularly from cybercriminal groups.
All three said they found evidence of significant trade between Cryptomus and Garantex. Two of them said that the trade amounted to tens of millions of dollars, though they differed on the exact figures.
Those trades are significant because Canada has imposed stiff economic sanctions on Russia in retaliation for its invasion of Ukraine, which steeply limits trade between Canadian and Russian companies and people. The Financial Transactions and Reports Analysis Centre of Canada (Fintrac) has warned that cryptocurrency is being used to avoid those sanctions and is also being used by Russians to launder the proceeds of crime, especially cybercrime.
TRM Labs, a leading blockchain intelligence company that monitors and studies cryptocurrency transactions for governments and private clients, told the IJF that it observed trades worth more than US$250 million between Cryptomus and Garantex from the start of 2024 until March 2025, when Garantex was taken offline after a joint international law enforcement operation. Canada, which never sanctioned Garantex, was not a part of that operation.
The U.S. has indicted three men it accused of founding and operating the platform. In those filings, the U.S. government claimed that Garantex’s clients included a number of Russian cybercriminal organizations as well as the Lazarus Group, a network of hackers believed to be working for the government of North Korea.
Read more:
- Criminals laundering Chinese money through Canadian real estate, agency report says
- Agency review found 18 Canadian small banks not following anti-money laundering rules
A second analyst using software developed by the company Chainalysis estimated that between June 2022 and March 2025, Cryptomus sent the equivalent of US$48.7 million to Garantex and received $82.1 million.
That analyst, who said they could not be quoted because they were not authorized to use the software to assist members of the media, also said there was evidence of “indirect” trade through intermediaries. They said that indirect trade could amount to approximately $250 million.
That analyst also found evidence Cryptomus had traded directly with Nobitex, an Iranian cryptocurrency exchange. Canada has not sanctioned Nobitex specifically but has stringent sanctions on Iran.
Fintrac considers any financial transaction originating from that country to be “high-risk” for money laundering or terrorist financing.
An analyst with a third firm, who spoke to the IJF on background, also said that the company’s software found evidence of trading between Cryptomus and Garantex, he did not provide exact figures. That analyst said there was also evidence Cryptomus had recorded trades with Nobitex.
Cryptomus’ listed address in Vancouver is a co-working space in the downtown core that is the listed location of more than 90 different financial services companies, including dozens of currency exchanges. The owner of that co-working business did not respond to a request for comment on whether Cryptomus is a legitimate customer, but previously told the IJF that her business’s address is fraudulently used by multiple companies.
Cryptomus’ current and former directors all list addresses in Lithuania and Uzbekistan. Sanjar Berdiev, who describes himself on LinkedIn as Cryptomus’ founder, did not respond to requests for comment sent via a Cryptomus email or on LinkedIn. A B.C. phone number Cryptomus provided for its registration with Fintrac would not accept any calls.
The IJF also contacted an active Reddit account associated with Cryptomus. The operator of that account declined to share contact information for Berdiev or another spokesperson and did not answer questions
When Cryptomus began business in 2022, the company’s website openly advertised that it could let users “accept payments from anywhere in the world.” It also boasted that it did not have any “KYC” or “know-your-client” procedures, which are typically required by banks and other financial institutions as a safeguard against money laundering or sanctions evasion.
That same year, the company successfully registered with the Fintrac, Canada’s anti-money laundering agency, which requires cryptocurrency exchanges and other money services businesses to have know-your-client procedures. Roughly three months after registering, the Cryptomus website no longer advertised that it was “KYC free.”
In 2024, the company began to publicly advertise its registration with Fintrac on the front page of its website.
That’s also the year that TRM Labs said it began to notice a large volume of trade between Cryptomus and Moscow-based Garantex. TRM's global head of policy and government affairs Ari Redbord told the IJF that Garantex was logging substantial trade with Cryptomus.
Between January and May 2024, Redbord said TRM found “Cryptomus was the second largest Virtual Asset Service Provider (VASP) globally transacting with sanctioned exchange Garantex based on direct on-chain transactions.”
Redbord declined to answer questions about when TRM first observed trades between Garantex or Cryptomus or why TRM was monitoring it, but he said the trade between the two exchanges appeared to increase significantly in early 2024.
“Between January and April 2024, TRM observed a four-fold increase in the number of transactions between the two services,” Redbord wrote.
The Canadian government never formally sanctioned Garantex but has sanctioned thousands of Russian individuals and entities since 2014 and forbade Canadian businesses from providing any kind of financial service to a slew of Russian industries, including financial services, arms production and marine transportation.
It is not clear if Canadian authorities were aware of Cryptomus’ alleged activity.
In May 2025, the B.C. Securities Commission issued a temporary order banning Cryptomus from trading securities and derivatives or engaging in promotional activities.
The commission alleged the company was “operating as an unrecognized exchange” that was not registered as required by law.
The commission scheduled a hearing to extend that ban, but later cancelled it. Access to the Cryptomus website was blocked in Canada around that time.
Elise Palmer, a spokesperson for the commission, said B.C. law prohibits her from discussing the particulars of the case. She could not say if the commission had a role in blocking access to the website.
But she said the commission only issues temporary orders “in cases where the length of time to hold a hearing could be prejudicial to the public interest and put the public at risk.”
She said the commission “may withdraw an application [for an extension] when those circumstances change.”
Ecclestone, the anti-money laundering consultant, said the Cryptomus case fits a pattern of suspicious cryptocurrency businesses that are nominally based in Canada.
“We’ve seen registered entities run out of Cyprus with beneficial ownership in Qatar, in Malaysia, in Africa — everywhere,” Ecclestone said.
Fintrac spokesperson Erica Constant did not comment specifically on Cryptomus’ registration, nor did she directly answer questions from the IJF about the platform’s extensive trade with Garantex. Federal laws prohibit Fintrac from speaking about financial intelligence it may have received or given to law enforcement.
Constant did acknowledge that cryptocurrency “can play an important role in sanctions circumvention activities.”
Ecclestone argued Fintrac is not adequately assessing or scrutinizing cryptocurrency platforms.
Such businesses are required to register with Fintrac as money services businesses, a category that also includes businesses like currency exchanges or wire transfer services that could be used to launder money.
Fintrac said it “verifies the validity of the information provided by an entity” to ensure owners are eligible for registration. But Ecclestone said Fintrac does not have the resources to oversee those businesses. In the 2023-24 fiscal year, the agency’s report to Canada’s finance minister said the agency assessed “well over” 250 such businesses. There are roughly 2,700 active registrations as of July 2025, according to the agency’s registry.
The IJF and CTV News previously reported on a company registered with Fintrac that allegedly ran a large pyramid scheme targeting investors in Sri Lanka and Bangladesh. That reporting also revealed that there are hundreds of registered money services businesses in Canada that all share common addresses, often at co-working spaces and other shared offices where none of those companies have a permanent physical presence.
“We certainly come across a few that seem to be located in other jurisdictions with no locus to Canada … clearly based in offshore financial secrecy jurisdictions, yet their website proudly trumpets their registration and regulation with Fintrac,” Ecclestone said. “One wonders if that’s being used to give an air of legitimacy to those who are not legitimate.”
Fintrac said registration is not the same thing as an endorsement, but Ecclestone said that’s a nuance lost on many consumers and potentially even financial institutions.
“If it really doesn’t mean anything, then why do it?” Ecclestone said.
Read more: