Dutch lawyer Marius Hupkes isn’t afraid of crossing borders to investigate criminal networks. He once flew across the Atlantic to Suriname to track down a key witness in a complex murder case.
But this time the borders in Hupkes’ case were virtual, and so too were the stolen assets and financial institutions that held them. The assets were cryptocurrencies traded using strings of code on a public ledger known as a blockchain; the institutions were burgeoning crypto exchanges that seemed to exist online but nowhere else.
“The promise of blockchain tracing was that we could have transparency,” he recently told the International Consortium of Investigative Journalists. “But this is just a story. In fact there’s more behind it.”
In the fall of 2022, the Amsterdam-based lawyer received a call from a Dutch model who had converted about $1.5 million of his family’s savings into bitcoins and other cryptocurrencies, and sent it to someone posing as an investment adviser — who turned out to be a fraud. The victim had hired a crypto analytics firm to trace the stolen cryptocurrency along the blockchain through various crypto wallet addresses — the equivalent of bank accounts — until the trail stopped at what looked like a promising destination: a wallet address at Huobi Global, a major crypto exchange that said it complied with anti-money laundering rules.
Hupkes sent an email to Huobi demanding it freeze the suspicious wallet and reveal the name of its owner. In an email signed “Huobi Regulatory Cooperation,” anonymous company representatives referred the lawyer to authorities in Seychelles, the secrecy jurisdiction in the Indian Ocean where the exchange was registered at the time. Hupkes went to court.
Months later, a Dutch judge ordered Huobi to comply with the lawyer’s demands or face a fine of up to $2.1 million.
In the meantime, Huobi had changed its name to HTX, shuttered its Seychelles operations and didn’t publicly disclose the location of its new headquarters.
Then finally, in November 2023, another anonymous HTX representative revealed the identity of the wallet’s owner. It wasn’t a person but another crypto exchange. “A hidden company,” Hupkes said.
The company was Kyrrex Ltd., a discovery that led to many more.
Kyrrex, which is registered in St. Vincent and the Grenadines, a Caribbean country where virtual asset providers are poorly regulated, onboarded customers without proper checks and who were later accused of fraud and other crimes. The exchange did so while providing some of its trading services through accounts hosted — or, in industry terms, “nested” — on another exchange, HTX.
Nested services are not illegal. But they make tracing illicit cryptocurrency more difficult and provide a layer of deniability to both the host and the nested exchanges, experts say.
While police agencies from various countries investigated criminal networks suspected of using wallets owned by the St. Vincent company, Kyrrex’s executives touted a Malta-licensed affiliate as fully transparent and compliant with anti-money laundering laws in an effort to access the lucrative European market.
The Kyrrex case shows how crypto exchanges, which often claim that transparency is a core component of their business, combine trading practices like nesting with complex corporate structures and shell companies in secrecy jurisdictions to evade scrutiny from authorities and everyday crypto users alike.
Paul Beckett, a lawyer specializing in offshore finance, said the complex structures allow firms like Kyrrex to sidestep oversight. “Malta, respectable, ‘that’s the one we tell the world about,’ ” he said. “St. Vincent is the ugly sister, and that’s where the mischief happens.” The result, he added: “absence of accountability of any kind.”
The Kyrrex case also points to flaws in the European Union’s regulatory structure, where supervision of virtual asset providers is left to each member state’s authorities. Officials in Malta — recently criticized by European authorities for lax oversight of crypto businesses — ignored allegations against Kyrrex’s entity in St. Vincent, arguing that, despite using the same brand name, it is legally separate from the Malta-based affiliate. Kyrrex, too, says that each entity has its own dedicated staff and infrastructure. Yet, corporate filings and other records reviewed by ICIJ show that Kyrrex co-founders have an interest in both entities, pointing to common ownership.
ICIJ’s investigation also found that HTX kept Kyrrex as a client even though it was aware that law enforcement agencies and investors around the world were investigating whether some of Kyrrex’s wallets were being used by criminals. ICIJ and its media partners identified four wallet addresses hosted on HTX and attributed to Kyrrex that were used by suspected criminals, according to court filings, reports by analytics firms and other records.
The findings are part of The Coin Laundry, a cross-border investigation by ICIJ and 37 media partners that reveals how crypto exchanges profit off the proceeds of scams, theft and other crimes — while those who’ve lost their savings or livelihoods are left with little hope of justice.
To examine Kyrrex’s operations, ICIJ and its partners reviewed confidential complaints filed with Seychelles’ financial regulator, police reports and other records from scam victims and cryptocurrency users from at least nine countries. The documents show that, collectively between 2022 and 2024, dozens of crypto investors reported losing nearly $6.5 million to suspected fraudsters who sent part of the stolen funds to the same Kyrrex wallet address hosted on HTX that was identified in Hupkes’ case.
Research by blockchain analysts also suggests that the wallet was exploited by hackers who allegedly stole email users’ personal information, by a Russian official accused of receiving a $19 million bribe in bitcoins, and by a sanctioned Russian organization that supported Russia’s military operations in Ukraine. Police in Spain, China and other countries have also investigated criminal networks that used the wallet identified in Hupkes’ case, ICIJ found. Nearly $10 billion worth of bitcoins passed through this wallet between February 2022 and July 2025, according to data published by Blockchain.com and Arkham Intelligence, two blockchain data sources.
Hupkes now represents more than 20 Dutch scam victims who hope to recover more than $11 million in a lawsuit against Kyrrex. They allege that the crypto exchange facilitated fraud and “maintained a system in which criminals can easily and repeatedly divert fraudulent funds through untraceable structures.” HTX is not a party in the litigation.
In an interview with ICIJ, Kyrrex co-founder Mykhailo “Mike” Romanenko rejected the label of nested exchange and described the company’s business model as similar to a brokerage. Romanenko said the company cooperates with law enforcement and regulators, and its operations are compliant with the laws of the jurisdictions where each entity is based.
He said Kyrrex’s due diligence is also on par with other exchanges and that the firm tries to “maintain balance between compliance obligations, user accessibility and commercial competitiveness.”
Romanenko declined to comment on the Dutch case.
In responses to ICIJ’s questions, Kyrrex’s lawyer said in an email that the company “categorically rejects any implication of impropriety” and complies with all laws and regulations.
‘Aha!’
With salt-and-pepper hair and often sporting a blue suit and no tie, the 55-year-old Hupkes is a familiar face on Dutch TV shows in discussions of crypto investment fraud and financial regulations.
It was after watching one of those programs that Bas Zijlstra, the Dutch model and self-care coach who lost $1.5 million to the fraudulent adviser, approached Hupkes in late 2022.
Zijlstra, 42, told ICIJ he had decided to invest the proceeds from a house sale in bitcoins because he didn’t trust banks. Needing advice, he responded to an ad with the photo of a famous Dutch model on a newspaper’s website. A purported adviser named “Mark Grams” contacted him right away, and the two became friendly. Over two months, Zijlstra liquidated both his gold investment portfolio and his father’s stock portfolio, converted it all to cryptocurrency and sent the sum in several installments to what “Grams” said was his firm’s trading platform. Zijlstra became suspicious when an unknown company called to say that his account had been blocked and he had to transfer more money to access his funds. He consulted with a friend and then it hit home: He had been scammed. “The floor under me was gone,” he said.
Zijlstra filed a police report but got little response. So he approached Hupkes — and he wasn’t the only one. In the following months, Hupkes would attract others claiming that criminals had siphoned their cryptocurrency to the same wallet hosted by HTX discovered by Zijlstra.
“Then you see … a bigger picture because it’s always the same pattern,” Hupkes said.
Indeed, Hupkes became a reference for a network of investigators. “In this period, I had many questions from authorities, police, everywhere from the world,” Hupkes said. “They wanted to know: “What’s behind this address? And nobody knew it.”
Examining police reports and Seychelles records, ICIJ discovered that after Hupkes alerted HTX about the wallet that appeared to receive his client’s stolen cryptocurrency, more than a dozen other scam victims around the world complained to HTX about the same suspect wallet address. Among them: a Canadian farmer, a Belgian scientist, a Danish politician and an Australian mining procurement specialist.
Despite receiving repeated inquiries from victims and law enforcement, HTX did not freeze the suspect wallet, nor, according to emails that are part of the legal case, did it disclose its owner — until forced by the Dutch court order in 2023.
That was “the big ‘aha!’ moment,” Hupkes said, when we found out that Kyrrex was the owner of the account. He added: “This was really a disclosure of vital information.”
The ‘Rolls Royce’ of crypto
Before founding Kyrrex, Romanenko, now 30, and Viktor Kochetov, now 42, both financial traders from Ukraine, say they were crypto skeptics.
The sector wasn’t yet fully developed and often relied on clunky trading platforms that were technologically behind those of traditional finance, Romanenko explained in a 2023 interview with a YouTube channel.
“We didn’t understand anything and we thought that it’s not a good idea to work with the crypto at that moment,” he said.
Romanenko, whose title at Kyrrex is chief visionary officer, said in an interview with a trade magazine this year that they came to believe they could develop a “Rolls Royce” of crypto trading platforms that could give “everyone” access to the crypto market. As they built their own platform they chose to rely on other exchanges for liquidity and to grow their buy and sell orders.
In 2018, Kochetov registered Kyrrex Holding Ltd. in Cyprus, which then became a shareholder of Real Exchange, also known as REX, the company’s entity in Malta. The country had just become the first member of the EU to pass a law regulating virtual asset providers, and Kyrrex’s co-founders applied for a license for REX to operate there.
While the license application was pending, in 2020 Maltese regulators found REX noncompliant and ordered it to “cease on the on-boarding of new clients” in Malta. Regulators lifted the order about six months later.
In 2021, Kyrrex expanded to St. Vincent and the Grenadines, an island nation known for low tax rates and protecting the identity of corporate owners by restricting access to corporate records. Kyrrex was registered as a business company at a time when the country had no laws governing virtual asset providers. Romanenko became its sole director, according to information revealed by Kyrrex to an Italian media outlet last year.
Kyrrex later expanded worldwide with companies in the U.S., U.K. and Switzerland. It also sponsored sports events featuring European soccer stars and launched a charitable foundation to support Ukraine, the founders’ homeland.
“Our main points with what we are building, our structure is transparency, security, compliance,” Romanenko said in an interview with another YouTube channel last year.
Meanwhile, the two founders moved to Malta and, from there, they touted Kyrrex as eager to work with regulators. But, Kyrrex records reviewed by ICIJ show that the St. Vincent-registered entity failed to verify some of its customers’ identities — a due diligence procedure intended to prevent financial crimes.
‘F— off’
Last year, after HTX identified Kyrrex as the owner of the suspect wallet address, Hupkes had a new target. The lawyer demanded Kyrrex reveal the names of the users believed to have stolen his clients’ cryptocurrency.
In an email signed only by the “Kyrrex team,” the company’s representatives said they were “unable” to disclose any names and told Hupkes that his requests would now be handled by the St. Vincent-registered entity. They then explained that Kyrrex did “not hold company funds” within the suspect address and that the company uses other exchanges, such as HTX, to hold users’ assets and fulfill customers’ trading orders.
So-called centralized exchanges like HTX maintain their own private ledger of transactions, including transactions through a nested service. Kyrrex doesn’t have those ledgers but can get that information, experts say. The company acknowledged that when it told Hupkes it could track down the customers accused of fraud using transaction hashes — a code that serves as a receipt number.
After obtaining a court order requiring Kyrrex to identify its customers, Hupkes sent the transaction hashes to Kyrrex. Within hours, the company provided the first names and addresses of the customers associated with the allegedly fraudulent transactions. Overall, the company has disclosed to the Dutch lawyer the names of 29 Kyrrex suspect users, the records show. Kyrrex said it also froze their accounts. But the customers had already transferred the funds out of the Kyrrex wallet. “The accounts were always empty,” Hupkes said.
In contracts with its customers, Kyrrex says it “strictly” follows “know-your-customer” rules and requires them to provide accurate and complete information when they open an account. But Kyrrex records reviewed by ICIJ show that, as early as 2021, some of the 29 customers allegedly linked to fraudulent transactions had opened accounts providing information that was false or incomplete.
For example, a user with the name Eralba Cara provided to Kyrrex the address “32, Rue Du Mole Ch-1201 Gjeneve, Tirana, Albania.” The purported address includes two cities — Geneva and Tirana — and the street address of the Permanent Mission of Albania to the United Nations in Geneva.
“Cara” allegedly helped steal about $800,000 from two of Hupkes’ clients, according to court records.
In another case, a Kyrrex customer opened an account using a French name and listed an address in “Poulainnec.” The city doesn’t exist. ICIJ’s reporting partners at Radio France found a person with the same French name who owns a beauty salon in southern France. She told the reporters that she was actually the victim of a crypto scam a few years ago, raising the possibility that her identity had been stolen.
ICIJ also found that Kyrrex allowed at least 18 customers to open accounts by providing scant information: a P.O. box in Dubai, United Arab Emirates, or the name of a city in Turkey or a village in Ukraine, without a street name or house number.
Hupkes sent emails to all the Kyrrex users identified as potential scammers demanding that they return the stolen currency. But many emails bounced back because the addresses were either fake or no longer in use.
Hupkes said that only one person replied. “F— off,” he wrote.
Convinced that Kyrrex’s account holders were “money mules,” or stand-ins, Hupkes demanded that the exchange pay damages for its alleged role in allowing the crimes.
Kyrrex refused. The company “is not liable for the damages suffered by [Hupkes’] client that were caused by others with malicious [intent],” a lawyer representing the company responded.
“At the time of the transactions Kyrrex did not know or should have known that it was dealing with an unreliable party,” the lawyer added.
Kyrrex also used its St. Vincent registration to shield itself from liability. In his letter to Hupkes, Kyrrex’s lawyer said that the company, which is registered outside the EU, does not have responsibility toward the Dutch investors who were defrauded by third parties.
In the interview with ICIJ, Kyrrex’s Romanenko said that the exchange relies on blockchain analysis firms to automatically detect and flag transactions potentially associated with illicit wallet addresses.That process can take weeks or months after a transaction has occurred as the firms uncover new illicit activity.
And even if stolen crypto was sent to one of the Kyrrex wallets, Romanenko said, it was a small portion of the funds passing through the exchange. “The volume of our processed transactions is substantial,” he said “It is no surprise that some isolated transactions or parts of the transactions can be identified as a high-risk.”
Nested
Though Kyrrex executives reject the label, industry insiders describe Kyrrex as a “nested service,” an intermediary that relies on larger “host” exchanges, such as HTX, to provide users trading services for digital assets. Kyrrex’s system routes users’ trade requests to the most suitable exchange partner based on price, liquidity and other factors. In turn, host exchanges can collect fees from the transactions and treat the nested exchange as a corporate client without having to vet and monitor its client’s customers.
Nested services represent a particular challenge for investigators.
“From an investigative standpoint, finding these nests can be very, very difficult because they don’t disclose that they have nested services inside other exchanges,” said David Utzke, a former crypto investigator with the U.S. Internal Revenue Service who recently wrote a book about digital asset technology. “It’s not until you start serving subpoenas or summonses that you discover: Well, wait a minute, you’re actually not doing any of this [trading]. You’re passing it off to somebody else.”
In the last few years, U.S. and European regulators have flagged nested services as a potentially powerful tool for money launderers because they can hide behind the host exchange to process transactions and quickly cash out their bounty.
This layering of structures, compounded by exchanges’ opaque ownership structure built around shell companies in secrecy jurisdictions such as St. Vincent or Seychelles, makes it difficult for law enforcement and investors to hold the companies involved accountable.
From an investigative standpoint, finding these nests can be very, very difficult because they don’t disclose that they have nested services inside other exchanges — former crypto investigator David Utzke
The European Banking Authority recently sounded the alarm about crypto asset providers that have “opaque governance and overly complex group structures” that can create “gaps in supervision.”
In October, the EBA recommended that authorities in EU member states look “beyond surface-level ownership to fully assess operational and control structures — particularly in multi-entity, offshore or otherwise opaque setups — to identify and mitigate [money laundering and terrorism financing] risks effectively.”
Malta regulators’ approach to REX, Kyrrex’s Maltese affiliate, appears to run counter to those recommendations.
As international police agencies were investigating wallets linked to Kyrrex and reports by an Italian media outlet connected alleged scammers to the St. Vincent entity’s services, Malta’s Financial Service Authority in February released a public notice to clarify that the agency is not responsible for business practices attributed to Kyrrex’s entities outside Malta.
REX and the St. Vincent-registered Kyrrex “are separate businesses with no shared management, financial operations, or legal responsibilities,” the MFSA said in the statement.
However, Maltese corporate records list company co-founder Romanenko as an indirect shareholder of the Maltese entity. As of November 2024, he was also the sole director and legal representative of Kyrrex, according to a letter that its lawyers sent to the Italian media outlet last year.
Romanenko acknowledged to ICIJ that both the Maltese and the St.Vincent companies share many of the same shareholders. But, he said, each company has its own compliance department and technological infrastructure, to keep them legally separate.
The MFSA declined to comment on Kyrrex and its various affiliates. In an email, agency CEO Kenneth Farrugia told ICIJ that MFSA is “legally restricted from providing specific details on its licensed entities.” Farrugia added that the MFSA conducts “continuous supervisory interventions” to ensure that its license holders fully adhere with their legal obligations.” St. Vincent regulators did not reply to ICIJ’s requests for comments.
The host
Between 2021 and 2024, more than two dozen crypto investors filed complaints with Seychelles authorities about Kyrrex host HTX and its predecessor Huobi. The investors alleged that the exchange facilitated fraudulent transactions, then failed to help victims recover stolen funds, according to confidential complaints reviewed by ICIJ. Many reported that they received no response at all from the company. Law enforcement agencies around the world have lamented the same, according to a 2023 Europol survey of cryptocurrency services’ cooperation with law enforcement.
“The main problem of Huobi’s responses are that they are unreliable, i.e. sometimes they respond and sometimes they do not, or only after months,” Europol said in the internal report. “This has hampered numerous investigations.”
British lawyers for a crypto scam victim who sued Huobi in the U.K. in 2022 told ICIJ that the company did not dispute the legal claim.As a result, the court ordered the exchange to refund more than 89.6 bitcoins, worth at the time nearly $1.8 million. To ensure the exchange saw the court decision, the lawyers airdropped a non-fungible token — a digital asset stored on a blockchain representing content like a photograph or artwork — containing the judgment order into a Huobi cryptocurrency wallet.
Reaching company representatives became even more difficult after Huobi changed ownership and offices in late 2022 before rebranding to HTX, said Steven Murray, a partner at the U.K. firm HCR Legal LLP who is pursuing a case against the company on behalf of 14 other scam victims.
In 2023, the Seychelles government forced HTX to close its local entity after the U.S. Securities and Exchange Commission charged a member of its advisory board, crypto billionaire Justin Sun, with fraud. (It is not clear if the Seychelles’ move was due to the SEC action, which was dropped earlier this year after President Donald Trump took office.) Since HTX moved out of Seychelles, law enforcement agencies and victims say they are unsure how to contact the company for cooperation.
HTX is only one of the exchanges that provide liquidity to Kyrrex. ICIJ and its media partners have examined analytics firms’ tracing reports, court filings and other records showing that, between 2021 and 2023, at least four Kyrrex wallets hosted on HTX were allegedly used by suspected criminals to receive stolen funds. (These include the one identified in the case of the Dutch scam victim Zijlstra.)
HTX did not respond to ICIJ’s repeated requests for comments.
Crypto for Russian troops
Alleged scammers were not the only ones to send funds to Kyrrex’s wallet on HTX.
ICIJ has reviewed wallet addresses posted in 2023 and 2024 on Telegram by Olga Vyazovskaya, a former chief medical officer of a pro-Russian militia in the Donbas region of Ukraine.
In the Telegram posts, which started about a year after Russia invaded Ukraine, Vyazovskaya asked her followers to send donations, explaining that the funds would be used to provide medicine to Russian troops and support children, the elderly and refugees in the Donbas, which Russia has occupied since 2014.
Vyazovskaya, who sometimes wears military camouflage, attached photos of children receiving toys, volunteers unboxing food supplies, and soldiers and activists alongside military trucks transporting diapers, medicine and other goods. Her supporters, she wrote, included Alexander Zhuchkovsky, a Russian influencer sanctioned by the U.S. government in 2022 for buying military equipment for a Russian extremist group and other pro-Russian fighters.
Vyazovskaya’s fundraising campaign was also publicized on the website of MOO Veche, a sanctioned Russian organization that has raised funds to provide drones, thermal imaging equipment and body armor to Russia’s special forces and other military units.
ICIJ analyzed transactions linked to a wallet address published by Vyazovskaya and several others used by MOO Veche. The analysis, which was partly based on a report by blockchain analytics firm Global Ledger, shows that after the start of the conflict in 2022 and then in 2023, the addresses sent a combined 82.4 bitcoins, valued at more than $1.7 million at the time, to an intermediary wallet. This wallet then sent the cryptocurrency to one hosted by HTX. ICIJ found that the deposit wallet address was the same Kyrrex-owned address allegedly involved in the global fraud investigated by Hupkes and police around the world.
To buy and sell cryptocurrency, you need to use a digital wallet. Crypto wallets have public and private keys. The public key is similar to a bank account number, while the private key is more like a password. Whoever holds the private key controls the cryptocurrency linked to it.
Most centralized cryptocurrency trading services, or exchanges, provide users with a deposit wallet that they host. This means that the exchange holds their private keys, and users must instruct the exchange about what to do with their cryptocurrency.
With unhosted wallets, users hold both the private and public keys, and are the only ones who can access their wallets.
An additional review of the transactions by analytics firm Broker Defense showed that part of the bitcoins that passed through the Kyrrex wallet originated from ChipMixer, a so-called crypto mixing service that laundered more than $3 billion in dirty currency until U.S. and German authorities took it down in 2023.
Romanenko told ICIJ that, as a Ukrainian who is proud of cooperating with his country’s authorities, he was surprised when he first saw the Global Ledger report pointing to the sanctioned Russian group’s use of his exchange. “No exchange can identify all risk prior to transaction processing. It is simply impossible,” he said. Since July, Kyrrex uses the analytics firm’s services to do anti-money laundering checks and monitor transactions on its exchange.
Delays
In early November, as Hupkes prepared to submit legal papers to the Dutch court as part of the proceedings against Kyrrex, the company changed lawyers, and tactics.
The new lawyer — who didn’t reply to ICIJ’s questions — will represent Kyrrex’s U.K. entity, not the one in St. Vincent, Hupkes said, resulting in the case being delayed.
In the meantime, some crypto investors beyond the Netherlands will continue to follow the case with anticipation. For fraud victims in other countries who also traced their stolen currency to the same Kyrrex-owned wallets identified by Hupkes, the Dutch case represents a way forward to recover their funds. In Canada, several victims are considering suing the exchange in light of Hupkes’ legal action on behalf of Zijlstra and the other Dutch plaintiffs, according to The Toronto Star, an ICIJ media partner.
Hupkes said his clients will now have to prove to the judge that Kyrrex’s entities were served with legal summonses. But he does not see the delay as a setback.
“This must be a story of hundreds of millions worldwide,” Hupkes said. “We always see just a small tip of the iceberg because not everybody goes to a lawyer. People stay at home suffering and feeling the pain of the loss without help. Probably it’s much bigger than we think.”
Contributing reporters: Maxime Tellier (Radio France), Jacob Borg (The Malta Times), Sheila Wang and Emma McIntosh (The Toronto Star), Yaroslava Nikitiuk (Slidstvo.Info), Sonny Motké (Het Financieele Dagblad), Agustin Armendariz, Jesús Escudero, Miguel Fiandor Gutiérrez, Delphine Reuter (ICIJ).
