The whistleblower has provided critical intelligence revealing that Ethereum wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690 serves as a payroll distribution node for unregulated forex boiler rooms in Cyprus, processing over $20 million per month in employee payments. Funds originate from CoinsPaid and AlphaPo, two crypto payment processors that function as a single criminal infrastructure despite appearing as separate entities.
Critical Discoveries
The CoinsPaid-AlphaPo Connection:
The investigation confirms these are not independent companies but a unified payment processing network:
- Shared ownership: Alexander Horst Riedinger (beneficial owner), Max Krupyshev (CEO), Ivan Montik (hidden controller)
- Same compliance department: Violating fundamental AML principles
- Identical technology: Both use Merkeleon white-label software
- Financial interdependence: AlphaPo funded CoinsPaid salaries after 2023 hack
- Simultaneous hacks: Both hit by North Korean Lazarus Group on same day (July 22, 2023), losing $97.3 million combined
The $20M Monthly Payroll Operation:
Based on documented Cyprus boiler room economics, this scale indicates:
- 300-500+ employees: Front-line sales agents plus support staff
- Major international operation: Consistent with the €600 million fraud network dismantled in October 2025
- Cyprus hub: Limassol call centers targeting European victims
Recent Enforcement Context:
Between October 27-29, 2025, European authorities raided Cyprus boiler rooms, arresting several suspects (seven in Limassol) connected to a €600 million cryptocurrency fraud network. The wallet’s November 5, 2025, transaction of 300,000 USDC occurred one week after these raids, suggesting continued operations or emergency fund movements.
Money Laundering Infrastructure
Transaction Flow:
- Victims deposit to fake forex platforms
- Funds processed through CoinsPaid/AlphaPo merchant accounts
- Converted to USDC and transferred to wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690
- Disbursed to employee wallets or cash-out services in Cyprus
- Converted to EUR via crypto ATMs, OTC desks, or complicit money service businesses
Red Flags:
- Large round-number USDC transfers (300,000 USDC)
- Exclusive stablecoin usage indicating commercial operations
- Timing correlation with law enforcement actions
- High transaction velocity consistent with payroll distribution
Regulatory Failures
Estonian FIU: Despite licensing Dream Finance OÜ (CoinsPaid), appears unable to monitor cross-border crypto flows effectively
CySEC (Cyprus): Former chairman admitted “ineffective supervision”; multiple boiler rooms operate despite regulatory presence
Jurisdictional Arbitrage: CoinsPaid/AlphaPo exploit gaps between Estonia, Cyprus, Saint Vincent, Curaçao, and El Salvador regulations
Call for Whistleblower Information
The report includes an urgent request for insiders to provide:
- Evidence of connections between CoinsPaid/AlphaPo and this wallet
- Merchant client lists showing boiler room accounts
- KYC documentation for wallet beneficiaries
- Details of Cyprus boiler room structures and payroll processes
- Internal compliance concerns that were ignored
