Crypto.com, launched in 2016 as Monaco, bars Russia-based users and tightened withdrawals after its $33 million hack

Crypto.com is not just a retail crypto app with a shiny domain. It runs exchange, custody, payments, derivatives, and a blockchain stack around CRO, which is exactly the kind of setup high-risk PSPs look at when they want to understand where the merchant, wallet, and on-chain pieces actually sit.

1. Crypto.com was launched in 2016 under the name Monaco. The founders are Kris Marszalek, Rafael Melo, Gary Or, and Bobby Bao. In 2018, after buying the Crypto.com domain, the company rebranded to Crypto.com.
2. The platform now spans several lines of business: a crypto app for buying and storing cryptocurrencies, Crypto.com Exchange, a prepaid Visa card, the non-custodial Crypto.com Onchain wallet, business payment solutions, custody services, and the Cronos blockchain ecosystem. On Crypto.com Exchange, users can trade spot and margin, futures, trading bots, OTC deals, and institutional tools.
3. Crypto.com also offers derivatives on traditional assets, including perpetual contracts on commodities, US indices, and private company shares before they list. Its ecosystem token is CRO, used across Crypto.com products and within Cronos for fees, staking, transfers, and app operations.
4. Cronos is not a single chain but a set of connected blockchains: Cronos POS for payments, transfers, and CRO staking; Cronos EVM for Ethereum-compatible applications; and Cronos zkEVM, a layer 2 network for faster and cheaper transactions.
5. For account access, users must complete identity verification, including personal data, document checks, and a photo holding a paper with “Crypto.com” and the date written on it. Crypto.com also publishes a Merkle tree proof of reserves and says it uses 1:1 reserves, cold storage, access controls for hot and cold wallets, code security reviews, and a vulnerability bounty program.
6. In January 2022, Crypto.com was hacked, and BTC, ETH, and other cryptoassets worth $33 million at the time were withdrawn from 483 users. After that, the company added extra withdrawal protection, including a mandatory 24-hour delay for the first withdrawal to a new whitelisted address.
7. Russia is listed among the regions whose residents cannot use the Crypto.com app, and Russia also appears in the list of countries whose users are barred from participating in staking. For PSPs, that matters because Crypto.com is not treating access and product eligibility as a single global setting; the restrictions are product- and jurisdiction-specific.

For high-risk operators, the useful takeaway is simple: Crypto.com is both a consumer-facing crypto venue and a multi-product infrastructure stack, with KYC, withdrawals, reserves, and jurisdiction controls all baked into the operating model. That combination tends to matter more than the brand name on the front page.