Ethereum Payroll Wallet Tied to Major Cyprus Boiler Room Network

A whistleblower has disclosed detailed intelligence indicating that Ethereum wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690 is being used as a central payroll hub for unregulated forex boiler rooms operating out of Cyprus. According to the report, the address channels more than $20 million per month in salary payments to staff. The funds are routed through CoinsPaid and AlphaPo, two crypto payment processors that in practice function as a single integrated infrastructure, despite presenting themselves as separate companies.

Key Findings from the Investigation

The CoinsPaid–AlphaPo Integrated Network

The investigation concludes that CoinsPaid and AlphaPo should not be regarded as independent actors but rather as components of a unified high-risk payment ecosystem:

• Shared ownership structure

• Alexander Horst Riedinger – beneficial owner

• Max Krupyshev – CEO

• Ivan Montik – concealed controlling figure

• Common compliance team
  A single compliance function reportedly services both entities, undermining basic AML segregation principles.

• Identical technology stack
  Both processors are said to rely on Merkeleon white-label software solutions.

• Financial dependency
  After the 2023 security incident, AlphaPo allegedly covered CoinsPaid’s salary obligations.

• Coordinated hacks on 22 July 2023
  Both operations were reportedly hit on the same day by the North Korean Lazarus Group, with an estimated $97.3 million in combined losses.

The $20 Million Monthly Payroll Mechanism

Drawing on documented economics of Cyprus-based boiler rooms, the whistleblower’s data suggests that this payroll scale reflects a large, industrial operation.

Estimated Operational Scale

• Headcount: Approximately 300–500+ employees, including front-line sales staff, retention agents and back-office support.

• Geographic footprint:

• Core hub in Cyprus, with a concentration in Limassol.

• Call centers primarily targeting retail victims across Europe.

• Alignment with previous fraud cases:
  The magnitude of the payroll is consistent with the €600 million crypto fraud network dismantled in October 2025.

Law Enforcement Context and Timeline

Between 27–29 October 2025, European law enforcement agencies conducted coordinated raids on Cyprus boiler rooms. Several suspects were detained, including seven arrests in Limassol, in connection with a €600 million cryptocurrency fraud scheme.

Despite this:

• On 5 November 2025, the wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690 processed a transaction of 300,000 USDC.

• This movement, occurring roughly one week after the raids, is interpreted as either evidence of ongoing operations or emergency redistribution of funds in response to enforcement pressure.

Money Laundering and Payroll Infrastructure

Transaction Pathway

The whistleblower outlines the following typical flow of funds:

1. Victim deposits
   Retail investors transfer money to fraudulent online forex platforms.

2. Processing via crypto PSPs
   Incoming funds are routed through CoinsPaid and AlphaPo merchant accounts.

3. Conversion to stablecoins
   Balances are exchanged into USDC.

4. Aggregation at the payroll wallet
   USDC is consolidated at the Ethereum address
   0xab47bd435cd07300e912bdf8373e2d0145dce690.

5. Distribution to staff and cash-out partners
   Funds are split and sent to employee wallets and to cash-out intermediaries in Cyprus.

6. Conversion to fiat
   Proceeds are turned into EUR through:

• Crypto ATMs

• OTC desks

• Complicit or negligent money service businesses

Illustrative Flow Table

Key Red Flags

The following indicators support the suspicion that this is a structured payroll and laundering setup:

• High-value, round-number transfers, e.g., 300,000 USDC.

• Exclusive use of stablecoins, consistent with commercial payment flows rather than typical retail trading.

• Temporal correlation between major transactions and law enforcement actions.

• High transaction frequency and regularity, characteristic of payroll distributions rather than sporadic investment activity.

Regulatory Weaknesses and Jurisdictional Exploitation

Estonia – FIU Oversight Limits

• The Estonian FIU has licensed Dream Finance OÜ (operating as CoinsPaid).

• Nevertheless, the whistleblower report suggests that cross-border monitoring of complex crypto flows remains insufficient, allowing large volumes tied to offshore fraud schemes to move with limited scrutiny.

Cyprus – CySEC Supervision Gaps

• The CySEC former chairman has publicly acknowledged ineffective supervision in past years.

• Numerous boiler room operations continue to surface in Cyprus despite the formal presence of the regulator.

Jurisdictional Arbitrage Strategy

CoinsPaid and AlphaPo allegedly leverage a multi-jurisdictional structure to exploit regulatory blind spots, distributing risk across:

• Estonia

• Cyprus

• Saint Vincent and the Grenadines

• Curaçao

• El Salvador

This patchwork enables them to shift operations and banking/crypto relationships when one country tightens oversight or enforcement.

Appeal for Additional Whistleblower Evidence

The report concludes with an urgent call for insiders and affected stakeholders to come forward with further documentation. Particularly valuable would be:

• Proof of links between CoinsPaid / AlphaPo and wallet 0xab47bd435cd07300e912bdf8373e2d0145dce690, including transaction records and internal correspondence.

• Merchant client lists identifying boiler room operators using these processors.

• KYC files and onboarding materials for beneficiaries associated with the payroll wallet.

• Organizational charts and descriptions of Cyprus boiler room operations, including how payroll and commissions are structured.

• Internal compliance reports, escalation emails, or risk assessments that were disregarded or suppressed.

Such evidence could help regulators and law enforcement agencies map the full scope of the network, protect future victims, and hold responsible individuals and entities to account.