Kyrrex Crypto Exchange: Fragmented Structure, Nested Services, and Major Compliance Red Flags

1. Executive Overview

Kyrrex promotes itself as a globally regulated cryptocurrency platform, yet it operates through a scattered, multi-jurisdictional network that has enabled high-risk transaction flows, regulatory arbitrage, and substantial losses for retail users.

The International Consortium of Investigative Journalists (ICIJ), in its report “Hunt for missing millions unmasks one crypto exchange hidden inside another”, revealed that Kyrrex’s offshore arm functioned as a nested exchange within HTX (Huobi). Through this arrangement, it processed billions in volume while accepting deposits that originated from fraudulent investment schemes.

Taken together with shifting corporate operators, dissolved entities, and a lack of clear governance, Kyrrex raises serious compliance, AML, and sanctions-risk concerns.

2. Corporate Structure and Ownership Layers

Kyrrex relies on a multi-layered and largely opaque corporate setup that appears tailored to exploit regulatory gaps across jurisdictions.

2.1 Cyprus Holding Layer

• Kyrrex Holding Ltd. (Cyprus, incorporated 2018) acts as the primary holding company.
• Viktor Kochetov is recorded as a director, with both co-founders holding indirect equity interests through this vehicle.
• Corporate filings confirm that Mike Romanenko served as sole director and legal representative of the St. Vincent & the Grenadines (SVG) company as of November 2024.

2.2 Malta Entity (Regulated “Front”)

• Real Exchange (REX) Limited holds a Class 4 VFA Services Provider license issued by the Malta Financial Services Authority (MFSA) for European business.
• Shareholders include K-Worldwide Group 18 Ltd., with upstream ownership flowing through Kyrrex Holding Ltd. (Cyprus), Peter’s Lab (Poland), and RV70 Holding Limited (England).
• In 2020, MFSA imposed a “cease on-boarding” order due to compliance shortcomings, later revoked after approximately six months.

2.3 Offshore Entity (SVG)

• Kyrrex Limited (St. Vincent & the Grenadines, registered 2021) ran unregulated exchange operations until recently.
• Romanenko acted as the sole director.
• This offshore entity handled user on-boarding with severely inadequate KYC and verification controls.

2.4 Additional Registrations

Kyrrex also expanded its footprint via entities in:

• United States
• United Kingdom
• Switzerland

None of these entities, however, were subject to a comprehensive VFA regime comparable to that in Malta, particularly for the high-risk services routed via HTX wallets.

2.5 Key Entities and Roles

3. Regulatory Framework and Compliance Breakdowns

3.1 Malta (Real Exchange / REX)

• REX holds a Class 4 VFA license under Malta’s Virtual Financial Assets Act.
• In February 2025, the MFSA issued a notice explicitly denying responsibility for non-Malta entities operating under the Kyrrex brand, despite common ownership and branding.

3.2 St. Vincent & the Grenadines (Kyrrex Ltd)

• At the time of Kyrrex Limited’s registration in 2021, no substantive VFA regulatory regime or meaningful licensing framework existed.
• The platform therefore operated without effective licensing, prudential supervision, or enforceable AML/CFT obligations.

3.3 Core Compliance Failures

KYC and Customer Due Diligence Deficiencies

Investigations found that at least 29 Kyrrex users linked to fraudulent flows supplied clearly fabricated or unverifiable information, including:

• Non-existent or fictional addresses (e.g., “Poulainnec”)
• Locations tied to diplomatic missions
• P.O. boxes lacking proper verification
• Potentially stolen or misused identities

These cases point to systemic weaknesses in CIP/KYC procedures.

Nested Exchange Setup via HTX

• Kyrrex functioned as a nested exchange inside HTX (formerly Huobi), meaning customer trades and balances were routed through wallets hosted at HTX.
• This additional layer complicated transaction monitoring, blurred responsibilities, and facilitated rapid movement of illicit funds.
• One high-risk wallet alone reportedly processed nearly $10 billion in Bitcoin between February 2022 and July 2025.

Delayed AML and Transaction Monitoring

• Romanenko has acknowledged that the use of blockchain analytics tools to detect illicit activity can take “weeks or months.”
• Such delays allow criminal funds to be fully cashed out or re-layered long before any freeze or investigative response is triggered.

Sanctions-Related Exposure

• Blockchain forensics traced 82.4 BTC (approximately $1.7 million) linked to Russian organization MOO Veche, which has been associated with funding Russian military operations.
• These funds passed through Kyrrex wallets and were partly sourced from ChipMixer, a mixer service dismantled by authorities after allegedly laundering around $3 billion in criminal proceeds.

4. Litigation Exposure and Investor Losses

4.1 Scale of Victim Impact

According to the ICIJ findings, Kyrrex’s infrastructure was repeatedly used to channel fraud proceeds:

• Victims from Canada, the Netherlands, Belgium, Denmark, Australia, and other countries lost substantial sums to investment schemes that relied on Kyrrex wallets.
• These cases highlight Kyrrex’s role as a key enabler within broader fraud ecosystems.

4.2 Dutch Class-Style Action

• Amsterdam lawyer Marius Hupkes represents more than 20 Dutch victims who together claim losses exceeding $11 million.
• The legal filings argue that Kyrrex helped maintain a system in which criminals could repeatedly divert fraudulent funds using structures designed to be difficult to trace.

4.3 HTX’s Restricted Cooperation

• Host exchange HTX allegedly ignored multiple requests from victims and law enforcement agencies to freeze suspicious wallets.
• Effective action was taken only after a Dutch court ordered measures in 2023, underscoring the limitations of relying on voluntary cooperation in nested setups.

4.4 Liability Shielding via Offshore Registration

• Kyrrex has attempted to rely on its SVG registration to deny responsibility towards EU investors deceived by third-party fraudsters.
• This stance stands in stark contrast to the shared branding and ownership links between Kyrrex Limited (SVG) and REX (Malta), and further illustrates the use of offshore structures to limit accountability.

5. Risk Assessment and Overall Conclusions

Kyrrex is a textbook example of regulatory arbitrage in the crypto sector:

• A regulated front in Malta is paired with unregulated offshore operations in SVG and other jurisdictions.
• A nested exchange model through HTX, together with persistent KYC failings and slow transaction monitoring, has created a configuration that is highly conducive to:
• Money laundering
• Fraud facilitation
• Potential sanctions evasion

Despite public claims of strong compliance and transparency, the beneficial ownership chain remains difficult to verify, and the group’s structure appears intentionally complex, making it easier to shift legal responsibility across entities.

The MFSA’s narrow focus on the Malta-licensed company—without fully probing cross-border connections to related entities—illustrates supervisory gaps that have also been highlighted by the European Banking Authority (EBA) in its critique of fragmented EU oversight.

6. Call for Information and Whistleblower Input

The investigative media outlet Scam-Or Project invites:

• Former and current insiders
• Employees and contractors
• Business partners and service providers
• Compliance professionals
• Affected investors and victims

to share confidential information about Kyrrex, its operations, its use of nested exchange services, or its beneficial owners.

Information can be submitted securely via the Scam-Or Project whistleblower section, helping to support ongoing investigative and legal efforts around Kyrrex-linked fraud and compliance failures.