Breaking: Ethereum Wallet Linked to Massive Cyprus Boiler Room Operations

Charlene Lensburg
Wed, 12 Nov 2025 11:25:32 +0000
Boiler Rooms, AlphaPo, CoinsPaid

The whistleblower has provided critical intelligence revealing that an Ethereum wallet serves as a payroll distribution node for unregulated forex boiler rooms in Cyprus, processing over $20 million per month in employee payments. Funds originate from CoinsPaid and AlphaPo, two crypto payment processors that function as a single criminal infrastructure despite appearing as separate entities.

The whistleblower has provided critical intelligence revealing that Ethereum wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690 serves as a payroll distribution node for unregulated forex boiler rooms in Cyprus, processing over $20 million per month in employee payments. Funds originate from CoinsPaid and AlphaPo, two crypto payment processors that function as a single criminal infrastructure despite appearing as separate entities.

Critical Discoveries

The CoinsPaid-AlphaPo Connection:

The investigation confirms these are not independent companies but a unified payment processing network:​

Shared ownership: Alexander Horst Riedinger (beneficial owner), Max Krupyshev (CEO), Ivan Montik (hidden controller)​

Same compliance department: Violating fundamental AML principles​

Identical technology: Both use Merkeleon white-label software​

Financial interdependence: AlphaPo funded CoinsPaid salaries after 2023 hack​

Simultaneous hacks: Both hit by North Korean Lazarus Group on same day (July 22, 2023), losing $97.3 million combined​

The $20M Monthly Payroll Operation:

Based on documented Cyprus boiler room economics, this scale indicates:

300-500+ employees: Front-line sales agents plus support staff

Major international operation: Consistent with the €600 million fraud network dismantled in October 2025​

Cyprus hub: Limassol call centers targeting European victims​

Recent Enforcement Context:

Between October 27-29, 2025, European authorities raided Cyprus boiler rooms, arresting several suspects (seven in Limassol) connected to a €600 million cryptocurrency fraud network. The wallet’s November 5, 2025, transaction of 300,000 USDC occurred one week after these raids, suggesting continued operations or emergency fund movements.​

Money Laundering Infrastructure

Transaction Flow:

1. Victims deposit to fake forex platforms

2. Funds processed through CoinsPaid/AlphaPo merchant accounts

3. Converted to USDC and transferred to wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690

4. Disbursed to employee wallets or cash-out services in Cyprus

5. Converted to EUR via crypto ATMs, OTC desks, or complicit money service businesses

Red Flags:

Large round-number USDC transfers (300,000 USDC)

Exclusive stablecoin usage indicating commercial operations

Timing correlation with law enforcement actions

High transaction velocity consistent with payroll distribution

Regulatory Failures

Estonian FIU: Despite licensing Dream Finance OÜ (CoinsPaid), appears unable to monitor cross-border crypto flows effectively​

CySEC (Cyprus): Former chairman admitted “ineffective supervision”; multiple boiler rooms operate despite regulatory presence​

Jurisdictional Arbitrage: CoinsPaid/AlphaPo exploit gaps between Estonia, Cyprus, Saint Vincent, Curaçao, and El Salvador regulations​

Call for Whistleblower Information

The report includes an urgent request for insiders to provide:

Evidence of connections between CoinsPaid/AlphaPo and this wallet

Merchant client lists showing boiler room accounts

KYC documentation for wallet beneficiaries

Details of Cyprus boiler room structures and payroll processes

Internal compliance concerns that were ignored

Share Information via Whistle42