Undercover journalist exposes shady crypto-to-cash services

“Do you have (a) token?” responds the woman at the counter, flanked by a pile of cash and a bill-counting machine.

The customer — an undercover journalist — slides a $5 bill through the cash scoop. The teller checks its serial number against a record on her phone, then reaches into a drawer and pulls out a crisp stack of American bills.

The teller raises her head again: “$1,900?”

The customer nods, and the teller runs the cash through a bill counting machine, wraps the bundle in a receipt slip and hands it across the counter with an envelope. The entire transaction, which experts say was completely illegal, takes less than two minutes.

The customer was there to exchange cryptocurrency for cash — a transaction facilitated by a growing number of businesses enabling anyone with an anonymous cryptocurrency wallet to cash out huge sums without touching the mainstream banking system.

Some crypto-to-cash operations allow customers to circumvent safeguards meant to prevent the laundering of dirty money tied to organized crime, human trafficking and foreign sabotage operations.

The process is quick, covert, and seen as a dire threat to the global anti-money laundering system that took decades to build.

The presence of these crypto-to-cash services has surged in Canada, especially in Toronto.

Reporters have identified more than 100 businesses advertising these services in Canadian cities. More than one-third of these firms — including the one that exchanged the money with the undercover journalist — are openly breaking the law by not being registered with Canada’s financial intelligence unit, which oversees the country’s anti-money laundering and anti-terrorist financing measures.

Instead, they offer a parallel banking system that has stymied both regulators and law enforcement, who have struggled to investigate illicit transactions that are easy to conduct with anonymous cryptocurrency wallets. One in five of the crypto-to-cash businesses found by reporters appears to be operating from foreign countries. In some cases, the services offer a customer more cash than the crypto is actually worth — a telltale sign, experts warn, that they may be trying to launder dirty money.

“If you have this way to move money with absolutely zero checks on it, you’re facilitating an unlimited amount of crime,” said Richard Sanders, a cybercrime investigator and one of the world’s foremost experts on crypto-to-cash operations. “I could not have in my worst dreams predicted the reality we’re in now.”

Crypto-to-cash services allow people to quickly cash out their investment in cryptocurrencies, without going through a bank. It can be particularly useful for those who need to transfer money from or to countries where banks are more restricted.

Unlike the crypto ATMs that have popped up across Canada over the past decade, which are limited in how much cash they can physically hold, crypto-to-cash services can handle large transactions.

A business can legally offer these services as long as they’re following a set of laws put in place to prevent money laundering and terrorist financing. This includes registering with the federal regulator, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), as well as conducting “know your client” checks, also known as KYC checks, to verify the identity of customers.

The law also requires companies to collect information about people involved in cryptocurrency transactions, a measure meant to make it harder for bad actors to use cryptocurrency.

Online directories are brimming with foreign businesses that are all too willing to sidestep the rules.

In Toronto, reporters used Telegram and WhatsApp to message two dozen unregistered businesses that advertise crypto-to-cash services. Many responded that they provide cash courier services in the city. Some also claimed they would not need to check ID. Some platforms have websites that appear to have mostly automated the process, allowing anyone to initiate crypto-to-cash transactions.

“Verification is not required to create an order,” one service said.

“When ready, our representative will contact you to co-ordinate the time and place of meeting,” said another.

Among these businesses, 001k.exchange — the one the investigation used for the Toronto transaction — is a major player. Based in Ukraine, 001k.exchange advertises crypto-to-cash service in several cities across Canada, as well as several major U.S. cities, despite not having the legal authority to operate in any of them.

Since August 2022, 001k.exchange has received more than $14.8 billion (U.S.) in cryptocurrency, according to data Chainalysis — a blockchain analytics firm — provided to ICIJ. It is unclear what portion of this total is composed of courier services versus other crypto exchange services that 001k provides.

The company directs customers to contact it via Telegram, a messaging app known for its relative anonymity and encryption features.

When a reporter reached out through the app, a 001k representative initially said the firm would not do transactions of less than 10,000 USDT, or tether, a cryptocurrency known as a “stablecoin” that is pegged to the U.S. dollar. (Most exchanges identified by the reporters had a similar minimum for transactions.)

The representative later agreed to a lower amount in exchange for $100 (U.S.) in commission. The representative said that they could turn it around within the same day.

On the day of the transaction, the reporter transferred 2,000 USDT — the equivalent of $2,800 (Canadian) — from an anonymous digital wallet to a crypto wallet address provided by 001k on Telegram. Within minutes, the rep confirmed the receipt. The reporter was told to send a photo of a low-denomination bill with its unique serial number clearly visible. This would be the “token.”

“You will need to hand over this banknote when receiving the funds. It serves as proof that it’s you who is collecting the money,” the 001k rep said on Telegram. “A courier will contact you when he is ready.”

In less than an hour, the reporter got a message from a Telegram account named “Aleks Canada,” whose messages were written in Russian. “Hello. Parcel to Toronto,” they wrote. Aleks Canada then instructed the reporter to pick up the cash at Orbit Money, a currency exchange and money transfer business on Yonge Street in midtown Toronto.

When the reporter showed up at the Yonge Street storefront, a teller let her in and handed over the stack of cash after examining the “token,” a $5 bill. No ID was checked. No questions were asked. The reporter did not see the teller record any information. The cash came with a receipt and an envelope with the Orbit Money logo.

“It’s suspicious from beginning to end,” Adam Atlas, a Montreal-based lawyer who specializes in crypto. “They would be expected to verify that you are who you are.”

In an email, Orbit Money told the joint investigation it has “no relationship, partnership, or affiliation of any kind” with 001k.exchange, and that the company had not known about or authorized the transaction. Later, in an interview, company representatives said it appeared two employees — the teller and a manager — were responsible, though Orbit was still in the early stages of an internal investigation.

“We’re just so flabbergasted,” said Angelo Coppola, Orbit’s anti-money laundering consultant.

“We are definitely taking this very, very seriously, and if there’s anything we could do to have this situation not repeat itself, yes, we will make sure that it does not repeat itself.”

Orbit Money is a money services business with 12 locations across Canada, registered to handle foreign exchanges, money transfers and virtual currency.

Orbit Money said that although it is registered with FINTRAC to handle cryptocurrency transactions, it only does so in “exceptional cases and strictly in accordance with FINTRAC requirements.”

Reporters traced the 2,000 USDT involved in the transaction to a 001k.exchange deposit wallet. The USDT was then moved to another wallet hosted by 001k.exchange where at least $900 million (U.S.) worth of crypto was received over the past three months, according to independent blockchain researcher Yury Serov.

Both over Telegram and on its website, which displays courier exchange rates, 001k has at times offered to pay people to provide it with cryptocurrency and receive cash. In late October, 001k was offering to provide customers in New York City with $10,001 (U.S.) in physical cash in exchange for 9,757 USDT.

In Montreal, a 001k representative offered to give a reporter more than $1 million (Canadian) in exchange for 763,949 USDT — essentially paying a 0.5 per cent commission to hand off the cash.

“This indicates a connection to a criminal syndicate that needs to offload cash,” says Pamela Clegg, a blockchain investigations expert who has worked for crypto firms and traditional banks. “Especially if they are paying people to take their money.”

A representative for 001k on Telegram acknowledged questions from ICIJ, but did not answer.

Most cryptocurrency transactions are logged on public ledgers called blockchains. But even though these records allow anyone to see funds moving between crypto wallets, or accounts, they often don’t show who is behind them. Crypto technology makes it very easy for users to create an unlimited number of anonymous digital wallet addresses, similar to bank account numbers.

Crypto-to-cash services thrive in this financial secrecy, according to experts ICIJ interviewed.

“Seeing the amount of money being pushed through these desks, it’s absolutely staggering,” said Nick Smart, the chief intelligence officer for Crystal Intelligence, a firm that analyzes blockchains. “We don’t know who’s using them or why they’re using them.”

Because crypto-to-cash services often use cryptocurrency addresses whose ownership is unknown to law enforcement, attempts to trace illicit cryptocurrency transfers often go cold when a money launderer cashes out at such a service, officials said.

“It’s just like whack-a-mole,” said Joseph Iuso, executive director of the Canadian Money Services Business Association.

“You’re just going to shut down one and it’s going to pop up somewhere else. To me, it’s far better to regulate and have the proper regulations and ensure people are following the proper reporting and record keeping than to try and keep nailing people.”

Globally, there has been rare success in stamping out criminal activities linked to crypto-to-cash services. Last year, an international investigation called Operation Destabilise — led by the U.K.’s National Crime Agency — exposed and disrupted Russian money laundering networks that specialized in exchanging cryptocurrency for hard cash and vice versa. The networks were found to support serious and organized crime around the world.

Ontario Provincial Police said it is “aware that these types of events can occur,” but redirected questions about them to financial regulators. The RCMP did not answer questions by deadline.

Experts say it has also posed significant challenges for the Canadian authorities to detect all illegal crypto-to-cash services expanding across the country. The fact that the cash was handed off at a registered money services business in midtown Toronto does not necessarily make it easier.

Atlas, who reviewed the receipt slip from the Toronto transaction, said that it was only a printout from a bill counter to show the right number of bills being paid and was not a real record of the transaction.

“They could pass an audit with flying colours because this transaction never happened,” he said.

Orbit Money said it is investigating how the transaction, which it says happened “entirely outside” of its internal system, allowing it to bypass built-in checks, occurred at its Toronto branch. Although the cash appeared to have come from a drawer at the branch, Orbit said its accounting department found no money missing, indicating someone may have quickly replaced it.

The manager who Orbit said was responsible for the transaction, Kaveh Sayehvand, said the cash came from his personal savings, that he thought he was repaying a loan to a friend and that he has no connection to 001k. He also said the teller had no knowledge of the situation and was only following his instructions.

In a statement, Orbit said it “will implement corrective measures to eliminate similar risks going forward. This includes enhanced oversight, additional staff retraining, and further reinforcement of our compliance policies.”

Orbit Money also said it strictly enforces FINTRAC rules around record keeping, reporting to the regulator and properly identifying customers. “Any deviation from these standards is treated as a serious compliance matter,” the company said.

When asked about the crypto-to-cash transaction with 001k and Orbit Money, FINTRAC declined to comment or disclose any information on specific entities.

“FINTRAC is prepared to take strong action as necessary so that businesses take their responsibilities seriously,” said Lori Blair, a FINTRAC spokesperson. “That can include administrative monetary penalties and referrals of any non-compliance to law enforcement.”

—with files from Spencer Woodman (ICIJ), Hugo Joncas (La Presse), Frédéric Zalac, Jeff Yates, Yanick Rose and Zach Dubinsky (CBC/Radio-Canada)