News

UPDATE APPENDED:

Kyrrex, a virtual assets service provider launched in 2018, operates as a “nested” exchange on HTX, a second, much larger exchange reportedly owned by crypto-billionaire and Trump meme-coin investor Justin Sun, records reviewed by ACAMS moneylaundering.com indicate.

Owned by Ukrainian entrepreneurs Mykhailo Romanenko and Viktor Kochetov with one platform in Malta and another offshore, in St. Vincent and the Grenadines, Kyrrex harbors ambitions to bridge the gap between traditional financial services and virtual assets as “the world’s first crypto-fiat bank.”

That goal aside, Kyrrex’s operations and seeming dependence on HTX have grabbed the attention of law enforcement agencies in Britain and the Netherlands amid allegations from dozens of victims of cryptocurrency-related investment scams that the savings bilked from them passed through wallets that the smaller exchange controls on the larger one.

Public records show that various plaintiffs brought legal proceedings against HTX in London and Amsterdam on nine separate occasions from June 2022 to April 2024, only to later identify the true destination of their funds as Kyrrex, which denies wrongdoing.

“When you’re dealing with a nested service, the blockchain tracing ends at an exchange that hides another exchange,” Marius Hupkes, an attorney in Amsterdam who represents 26 alleged victims, told moneylaundering.com. “It’s a game of cat and mouse, and Kyrrex appears to be a large-scale facilitator.”

Hupkes, who alleges in a pending lawsuit that Kyrrex made the wallets in question accessible to “money mules” and thereby allowed the suspects who defrauded his clients to launder their proceeds, said the exchange’s nested structure complicates efforts to find and recover the stolen cryptocurrency, mainly Bitcoin and Ethereum.

Kyrrex “utilizes automated internal smart routing arrangements to pool customers’ coins and assets,” a representative of the exchange’s legal team told Hupkes in an email in December 2023. “This pooling process means mixing of users’ coins on various accounts opened with different exchanges and service providers, such as Huobi [now known as HTX].”

Remarkably, Kyrrex also openly directs users to a bot, KRRX Bot, hosted on Telegram, a social-media and encrypted-messaging platform that France has accused of facilitating money laundering, fraud, the spread of child sexual-abuse material and other transnational crimes.

The “All-In-One Telegram Crypto Bot” empowers users to deposit, swap and withdraw cryptocurrency with “no limits, no KYC [know-your-customer] and full privacy,” a website associated with the application claims. An advertisement on Kyrrex’s official page on LinkedIn further describes KRRX Bot as part of the “Kyrrex ecosystem.”

Kochetov reposted the advertisement in 2022.

In an email to moneylaundering.com, TRM Labs, a blockchain analytics firm in San Francisco, described no-KYC bots on Telegram as a common feature of higher-risk platforms and unregistered services.

“It’s possible that some operations, whether infrastructure or users, are located in Ukraine, as a version of that bot [targets] Ukrainian users,” TRM Labs stated. “The no-KYC model increases exposure to money laundering and fraud risks.”

Obfuscation

Blockchain analysis shows that from February 2022 to July of this year, 103,000 bitcoins, the equivalent of €9.6 billion, transited through a single wallet that HTX attributed to Kyrrex.

“We have identified the owner of the target address as being a corporation in the name of Kyrrex Limited,” HTX, then known as Huobi, told Hupkes, the attorney, in an email in November 2023. “Kyrrex operates a cryptocurrency exchange. This explains the inflow and outflow of funds.”

The high volume and aggregate value of transactions suggests the wallet functioned as an omnibus account, a repository for pooling cryptocurrency from multiple users.

“According to OSINT [open-source intelligence] on Chainalysis [a third-party that analyzed the transactions], this address has been involved in crypto-investment scams on multiple occasions,” an agent with the Dutch Fiscal Information and Investigations Service told one of the plaintiffs in an email in October 2022.

Bitcoins and other cryptocurrencies transferred to customers of a nested exchange typically pool into such wallets, making it impossible for outside parties to distinguish the beneficiary of each transaction from any one of hundreds of thousands of other possible recipients.

Only the nested exchange, in this case, Kyrrex, can identify the recipients of inbound payments, using a private, off-chain ledger to log their balances in real time.

By contrast, standalone exchanges that run their own custodial and settlement services funnel inbound cryptocurrency to the intended recipient’s personal wallet—a model that allows investigators to quickly identify suspicious parties and request a map of their transactions.

Correspondence reviewed by moneylaundering.com shows that after plaintiffs successfully petitioned a court in Amsterdam in April and March 2024 to order Kyrrex to freeze their alleged savings and name the recipients, the exchange asked for the relevant “hashes”— alphanumeric strings that act as digital receipts for payments on the blockchain.

Kyrrex typically revealed the identities of the alleged money mules in emails to the plaintiffs and froze the wallets “four to five working days” after receiving the hashes, said Hupkes.

By then, the funds had disappeared.

Dual structure

Nesting is neither illegal nor an automatic breach of regulations in the EU. In practice, new exchanges sometimes nest themselves with established colleagues to tap into their capital reserves, reduce operational costs and accelerate their own entry into the market.

“It’s a classic nested service—everything gets swept into Huobi [HTX],” a blockchain investigator told moneylaundering.com on condition of anonymity. “I wonder if Maltese regulators are aware of these connections.”

Kyrrex runs two websites with identical branding: kyrrex.mt, a platform connected to Real Exchange (REX) Limited, the exchange’s regulated branch in Malta, and kyrrex.com, which traces back to Fintech Operations Development S.A., a joint stock company in Panama.

Users need provide only an email address and country of residence to begin swapping cryptocurrencies on kyrrex.com. Those wishing to convert bitcoins or other digital assets into mainstream currency will have to undergo KYC checks, according to the website.

“Privacy for crypto, compliance for fiat,” Kyrrex noted in July. “This hybrid model is very convenient.”

Convenience may come at a cost, however.

The Malta Financial Services Authority warned consumers in February to access Kyrrex only through kyrrex.mt, which the agency views as separate from kyrrex.com in St. Vincent and the Grenadines, “with no shared management, financial operations, or legal responsibilities.”

The blockchain appears to support the MFSA’s claim.

“On-chain analysis [shows] that the address clusters and liquidity flows of the two entities are mostly segregated,” TRM Labs noted.

Either way, Kyrrex’s bifurcated structure gives momentum to warnings over Malta’s possible exposure to financial crime-related risks from offshore, and more broadly over the quality of governance and culture of compliance at the exchange, particularly as it presents itself as one “ecosystem” led by the same chief executive, Maltese national Kevin Plumpton.

Moreover, Kyrrex does not appear to have disclosed to users in a publicly posted terms of service or other readily observable venue that a second exchange, HTX, hosts the wallets that hold their cryptocurrency and underpin their transactions.

Plumpton describes himself on LinkedIn as a “leader” in anti-money laundering compliance and founder of an “innovative” due-diligence platform, KYCMATIC.

His exchange rejects any allegations of impropriety.

“Kyrrex conducts its business in accordance with all applicable legal and regulatory requirements and maintains a robust AML/KYC compliance framework across the jurisdictions in which it operates,” an attorney representing the exchange told moneylaundering.com in an email.

In a subsequent letter to moneylaundering.com, the attorney disputed the description of Kyrrex as a “nested exchange,” and wrote that his client “operates its own trading and custody infrastructure” while “HTX and other exchanges act exclusively as … liquidity providers.”

The attorney also rejected that Kyrrex was the “true destination” of funds from the alleged scams and had “exclusive information about the inbound payments through HTX wallets,” and further stated that his client “has never been [a] beneficiary of users’ funds and has never retained customers’ assets improperly.”

HTX operated from the Seychelles before vanishing from the island’s corporate registry in October 2023, reportedly at the behest of local regulators. The exchange also runs a subsidiary in Lithuania, Safe Glory UAB, but has otherwise revealed little about its structure and ownership.

In an unprecedented move, the U.K. Financial Conduct Authority sued HTX last month for promoting services to British residents without authorization. The FCA filed the lawsuit two years after placing HTX on a list of companies that consumers should avoid, alongside Binance, KuCoin and BitMEX.

Concerns over Kyrrex’s operations and partnership with HTX coincide with the rollout of the markets in crypto-assets regulation, or MiCA, which imposes a bloc-wide framework of licensing, consumer-protection and other requirements on virtual asset service platforms in the EU.

Representatives of Kyrrex have publicly discussed their plans to obtain a license for the exchange pursuant to MiCA, but moneylaundering.com could not confirm whether they had applied for one in Malta or anywhere else by press time.

A spokesperson for the MFSA told moneylaundering.com that the agency requires “robust” governance, effective anti-money laundering programs and appropriate disclosures from all licensees, but declined to comment on individual cases.

“It [the MFSA] takes any credible information about potential misconduct seriously and cooperates closely with domestic and international counterparts, including law enforcement authorities,” the spokesperson said. “The MFSA continues to monitor developments in the crypto-asset sector and to apply a risk-based supervisory approach.”

HTX did not respond to inquiries by press time.

Contact Koos Couvée at kcouvee@acams.org

UPDATE: Adds further statements from Kyrrex’s attorney after the 36th graph.