Content warning: This article contains discussions of child exploitation and sexual abuse.
TLDR: Two Nominis investigations, a Telegram child exploitation network paid in USDT on TRON and a Bitcoin-funded dark web marketplace, show crypto-enabled crime growing in Canada and why transaction-level compliance is now essential.
Cryptocurrency has become part of the ordinary financial furniture in Canada, used by legitimate businesses and millions of individuals, and the same qualities that make it useful to them have made it useful to the people running illicit operations alongside them. FINTRAC, the country's financial intelligence unit, gives some sense of the scale, having produced 6,236 financial intelligence disclosure packages in 2024 to 2025 and contributed to more than 200 major investigations, with 316 of those disclosures relating to human trafficking alone and identifying 538 subjects of interest. Two recent Nominis investigations, set out below, show what this activity looks like on the ground in Canada and why the businesses that handle crypto can no longer treat compliance as an afterthought.
Case 1
The first case is among the most serious our intelligence team has documented. Human trafficking, forced labour and modern slavery generate enormous sums each year, an amount the International Labour Organisation most recently put at around 236 billion US dollars in 2024, up from its widely cited 2014 estimate of 150 billion, and a growing share of that money now moves through cryptocurrency.
The operation at the centre of this investigation runs as a group on Telegram, where it advertises escort services to paying users, including access to children reported to be as young as ten. The people running it appear to hold their victims in ordinary residential houses across several cities, among them Vancouver and Toronto and every buyer pays for what is advertised in USDT on the TRON network while coordination runs through the group itself.
The most disturbing feature of the operation is how unremarkable its surroundings are, with children held and sold in major Canadian cities and paid for across the very same crypto rails that legitimate businesses use every day. We are not publishing the identity of the group or any detail of how it is found, contacted or paid, since doing so would endanger the children involved and assist the people exploiting them, but the financial pattern can be described, and it is a familiar one.
The operators settle in USDT on TRON - a dollar-pegged stablecoin that holds a fixed value and moves across borders within seconds without a bank in the middle of the transaction, because transfers on TRON cost only a few cents and confirm almost immediately, and because the enormous volume of ordinary USDT activity on that network lets an illicit payment sit concealed inside a much larger flow of legitimate ones.
The wallet investigated in this investigation demonstrates the longevity of this operation, its first transaction having taken place in April 2024 and continuing transaction until at least upon publication of this investigation.
The same preference has been recorded well beyond this case, most relevantly by the United Nations Office on Drugs and Crime, whose 2024 assessment named USDT on TRON as the settlement choice of the syndicates operating in the region this operation appears to draw its victims from.
Case 2
The second case is different in character while running on the same logic. In a separate investigation, our team examined a dark web marketplace operating in Canada that sells a range of illegal goods and services, among them drugs, forged financial and identity documents, and hacking software.
Tracing the transactions linked to the operation, the team identified a Bitcoin wallet, shown here in part as 14PE********B7GM, that has been active since May 2026 and remained live as of July 2026, and it found that funds leaving that wallet were routed through a series of other wallets Nominis had previously identified in connection with the laundering of stolen funds.
This operation used Bitcoin, moving its proceeds through a chain of intermediary wallets to put distance between the marketplace and its money, which is a well-established method for making funds harder to attribute.
Despite their differences, both operations turn on the same vulnerability, the moment at which their cryptocurrency reaches a business willing to accept it without checking where it came from.
Cryptocurrency is now woven into ordinary commerce in Canada, and the operations described here move their money through the same exchanges, payment processors and other crypto businesses that ordinary customers use, which puts those businesses in the path of illicit funds whether they are aware of it or not. Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, businesses dealing in virtual currency are reporting entities, required to register with FINTRAC, maintain a compliance programme, keep records and file suspicious transaction reports, and FINTRAC has built a substantial body of guidance to support them, including virtual currency red-flag indicators and its long-running Project Protect partnership on the laundering of proceeds from human trafficking for sexual exploitation.
Meeting that standard, in practice, means going beyond knowing the customer and into knowing the transaction: screening a counterparty wallet before any funds are accepted, monitoring flows as they occur, treating a match against trafficking, drug, fraud or other illicit typologies as grounds for immediate escalation, and filing the report while the funds are still in view.
Applied to these cases, that is what would flag the laundering-linked wallet behind the dark web marketplace, or the payment pattern behind the Telegram group, at the point the money arrives, and when the activity in question includes the sexual exploitation of children, the case for treating these obligations with full seriousness needs no further argument. This is the work Nominis is built for, giving firms the means to catch a suspect payment while it is still in front of them.
Neither operation is unusual in how it uses cryptocurrency, and that ordinariness is the point, because both belong to a pattern becoming more common in Canada, in which serious crime settles quietly alongside legitimate business, from the exploitation of children to the dark web trade in drugs and forged documents. A technology is judged in the end by what it is visibly used for, and every payment accepted without anyone checking where it came from lets that judgement form around cases like these.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at [email protected].
.png)
.jpg)
