Analytical review of the EXTRATUM exchange service

JavaScript is disabled!

JavaScript must be enabled for this site to work properly.

Original language : Русский

Date : Sun 04 Oct 2026 07:12:52

Project : EXTRATUM

Author : Anonymous

Risk : Medium

Category : exchange

Analytical review of the EXTRATUM exchange service

EXTRATUM bills itself as an automated service for around-the-clock swapping of digital assets, stablecoins, and fiat currencies. The platform runs on WordPress — the go-to engine for the exchange industry — with the specialized PremiumExchanger (PremiumBox) plugin. The site comes in Russian and English, and offers conversion of popular cryptos (Bitcoin BTC, Ethereum ETH, Litecoin LTC, Monero XMR, Tron TRX, Gram/Toncoin, Solana SOL, Polygon POL, Avalanche AVAX, Binance Coin BNB, Tether USDT on the TRC20/ERC20/BEP20 networks, USDC) into fiat options: Russian bank cards (Sberbank, T-Bank/Tinkoff, SBP RUB), Ukrainian bank transfers (Privat24, Monobank, Oschadbank, Visa/MasterCard UAH), plus cash Vietnamese dong (VND) is advertised as well.

This service is brand new: the first mentions in aggregators, social media posts, and news on the site date back to the summer of 2026 (activity on the E-mon.cc and Kurs.Expert monitoring sites was recorded just 1 to 4 months ago). The only ways to reach customer support are e-mail and a Telegram account. Meanwhile, the site has zero info about the legal entity, the company's registration jurisdiction, any licenses for handling virtual assets, or a physical office address. The front page shows demo counters ("average processing time 04:37", "1500+ directions", "exchanges from 20 USDT to 10 BTC").

Analyzing the Terms of Service (Site Rules / TOS)

Section / Location	What the Document Says	Analysis, Risks & Hidden Gotchas
Section 1, 2.2	"The contract is concluded between an internet service for exchanging title units, hereinafter the Contractor... and the Customer..."	Total operator anonymity. Neither the preamble nor the closing provisions name a legal entity, a jurisdiction, or the applicable law. The Contractor is just an abstract website. If your money disappears, there's legally no one you can send a claim or a lawsuit to.
Section 4	"If any profit arises during the exchange, it stays in the Contractor's account as an extra benefit and a premium for the commission services"	Profit asymmetry when rates move. If the rate shifts in the service's favor while your order is processing (spread or rate delta), the service pockets that profit as a "premium". But if the rate drops, the service reserves the right to recalculate your order (clause 5.1). The risk lands entirely on the customer.
Clause 5.1	"If this amount exceeds the one stated in the order by more than 10%, the Contractor terminates the contract unilaterally and all funds are returned... minus the amount deducted for commission expenses..."	You pay for a forced refund if you mess up the amount. If a customer accidentally sends a bit too much (say, not accounting for wallet fees or exchange rounding), the service won't credit the equivalent — it forcibly returns the deposit and charges the user transfer fees on top.
Clause 5.2	"...electronic currency is refunded within 24 hours of receiving the demand to terminate the contract. If refund delays were not caused by the Contractor, it bears no responsibility for them"	Contradiction with the AML policy's refund timelines. The TOS sets a 24-hour refund window. But the dedicated AML policy (clause 9) lets refunds during checks drag on for up to 30 calendar days, and for an indefinite period if intermediaries block things. The vague "not the Contractor's fault" wording makes it easy to blame any delay on outside factors.
Clause 5.3	"...the agreement between the parties is terminated by the Contractor on its own side, since the contract never comes into effect. The Customer may not be notified about this. If title units arrive... after the stated deadline, such funds are sent back... with all commission expenses... deducted..."	Silent cancellation with no notice, plus fees skimmed. If the customer's transaction gets stuck in the mempool or a banking gateway past the order timer, the service kills the deal without telling you and deducts the costs from the return transfer.
Clause 5.6	"...the Contractor bears limited liability within the framework of these rules... and provides no additional guarantees to the Customer, nor bears any additional liability to them..."	A practically total opt-out from commercial liability for outages, rate slippage, or the user's indirect losses.
Clause 5.8	"The Contractor is not liable for damage and consequences of an erroneous transfer... if the Customer entered... incorrect details"	A standard crypto-industry clause, but combined with zero detail verification on the interface side, any typo means the asset is gone for good.
Clause 6	"Within 24 hours of the exchange being completed... the Contractor provides a guarantee on the services rendered, provided no other terms are agreed"	A phantom "guarantee". What a 24-hour guarantee on an already-completed one-time exchange of title units is supposed to mean is never explained: a blockchain crypto transaction is final. Looks like a leftover from a template with no legal substance behind it.
Clause 7	"...order fulfillment deadlines shift by the duration of the force majeure. The Contractor bears no responsibility for overdue obligations"	Force majeure criteria aren't defined anywhere. The service can chalk its own server glitches or a third-party liquidity provider's problems up to "unforeseen circumstances".
Clause 9	"For cardholders from the countries of England, Germany, and the USA, the terms for transferring title units are extended for an indefinite period corresponding to a full check of the cardholder's data. During the entire period the funds are not subjected to any operations and sit in full in the Contractor's account"	The "indefinite period" trap for UK/DE/USA cards. User funds get frozen for an unlimited time with no clear deadlines. On top of that, the wording "the countries of England, Germany and the USA" gives away an archaic mid-2010s template (the countries are picked arbitrarily, and "the country of England" is legally wrong). Trying to exchange through these routes is asking for a freeze.
Clause 11.2	"...the funds arrive in the account within the following 24 hours or are returned to the Customer's details minus commission expenses"	The service gets to unilaterally decide — either push the funds through with a day's delay or forcibly refund you while deducting fees.
Clause 11.3	"At the first request, the Contractor may hand over information about electronic currency transfers to law enforcement agencies, settlement system administrations, and also to victims of unlawful actions who suffered fraud proven by judicial bodies"	Very broad grounds for data disclosure". At the first request" says nothing about how a request's legitimacy gets verified, and handing data straight to third parties ("victims") flat-out contradicts the privacy policy.
Clause 12	"The Contractor has the right to refuse to conclude the contract and to execute the order, without giving any reasons. This clause applies to any client"	An absolute right to refuse with zero explanation. If you've already sent funds to the exchanger's address, invoking this clause turns your transaction into a refund procedure with fees deducted and possibly a multi-day review.

Analyzing the AML/KYC Policy

The AML section is the most detailed and professionally written part of the whole package, but it packs harsh blocking criteria and financial penalties for the sender

Section / Location	What the Document Says	Explanation
Risk check triggers (Section 4)	"If the cumulative risk level of a transaction exceeds 70%, or the check reveals more than 1% of tags belonging to elevated-risk categories, such a transaction may be deemed high-risk and temporarily suspended..."	The 1% threshold for high-risk tags (which covers not only Darknet, Scam, and Sanctions but also "Mixer", "Gambling" and even "P2P Exchange Unlicensed") is a brutally strict filter. Any incoming crypto that passed through an unlicensed P2P exchanger or a gambling platform just 2–3 transactions ago can easily rack up that 1% of so-called "historical footprint." That's a formal excuse to halt pretty much any transaction.
A deep stack of requested documents (Section 3)	"If suspicious or high-risk transactions are detected, as well as in other cases provided for by applicable law, EXTRATUM.io may request documents and information from the User needed for identification and verification procedures"	The service can demand: a passport/ID, a selfie or video selfie with the document, proof of address (Proof of Address), documents proving the lawful origin of the funds (Proof of Funds/Source of Wealth), and proof that you own the sending wallet (a video recorded from your exchange/wallet dashboard). For a private exchanger, demanding source-of-capital documents is the maximum compliance burden you can pile onto a user.
Fees and penalties on refunds (Section 9)	"...EXTRATUM.io may withhold a commission of up to 5% of the exchange amount, but no more than $100... as well as AML check expenses, network fees, conversion costs, and losses from blocks by third parties"	Even if you handed over documents and proved your transaction is clean, walking away from the exchange or getting a refund will cost you up to 5% (up to $100) plus network fees and the cost of analytics databases. If the check finds no wrongdoing, the refund is limited to "actual expenses" — a list the administration defines however it pleases.
Asset holding timelines (Section 9)	"Reviewing a refund request and running the necessary checks can take up to 30 (thirty) calendar days... If the assets are blocked by an exchange... the period extends until the restrictions are fully lifted"	A check period of up to a month, with no external regulator watching, turns holding your funds into a tool for indefinite freezing.
No disputing allowed if you provide "incomplete data" (Sections 12, 15)	"If false, unreliable, incomplete, or forged information or documents are provided, EXTRATUM.io may... withhold funds and (or) digital assets until the check is completed..."	The service reserves the right to hold onto your funds until checks are finished if it decides your documents are incomplete or questionable.

Privacy and Personal Data Policy

Sections 2 and 3: The service collects pretty much a complete digital and legal profile of the customer: full name, date of birth, phone, e-mail, address, citizenship, document details, selfie materials, and technical metadata.

Sections 5 and 10: It declares that data gets passed to "verification partners" and government agencies. At the same time, the document never names the personal data operator (there's no data-controller company name), doesn't mention the applicable personal data laws (GDPR, 152-FZ, etc.), and there are no Data Protection Officer (DPO) contacts. In the policy's contact block (clause 10), where the responsible person's contacts should be, there's just blank space — a clear sign of a careless attitude toward the legally meaningful parts of the site.

Presence on Exchange Monitoring Sites

Kurs.Expert: The service is listed. Status: active. Market age shows 1 year 9 months (even though the exchanger's domain was registered on 2026-06-01). Reputation: 91% (Green zone). Total reserve: $13,971,034. The operator's registration country is listed as Russia.
E-mon: The exchanger card is active (age 4 months, country: Russia). Claimed total reserve: $2,141,378.

A Look at the On-Site Reviews

The review block on the site itself holds just 5 entries (names: Kira, Dava, Lara, Konstantin, Guest). The publication dates are quite telling:

Four reviews were posted in a tight cluster over five days in July 2026 (July 9, 11, 12, 14). The texts are cookie-cutter, 1–2 sentences each.
The fifth review is dated 01.01.2024, 00:00 ("Great exchanger!" from user Guest). This is the classic default review hard-wired into the PremiumBox plugin's database at first install. A review from 2024 when the exchanger actually launched in the summer of 2026 makes it painfully obvious the comment block is artificial.

Practical Recommendations

Don't risk big sums: If you really have to use this service, stick strictly to small test transactions. Trusting a platform with no reputation and no legal entity with more than $50–$100 is unreasonably risky.
Check your crypto for AML before sending: Never send EXTRATUM coins that came off P2P platforms, mixers, or third-party services without pre-checking them through checkers (GetBlock, AMLBot). The 1% high-risk tag threshold can get your transaction halted.
Be ready for full KYC: If the AML filter trips, you'll have to hand a full set of personal data (passport, selfies, video recordings, proof of income) to anonymous site admins. If you're not comfortable sharing personal data with an unregistered resource — skip the exchange altogether.
Don't use UK, German, or US cards: Under clause 9 of the TOS, transfers through such cards can be frozen for an indefinite period with no interest or compensation.
Document every step: Make sure to save a screenshot of the order, the sending transaction hash (TXID), the order creation time, and your Telegram correspondence.

The Extratum exchange service is a textbook example of a freshly launched semi-automatic exchange point running on the PremiumExchanger script. Open sources show no direct evidence of fraud, non-payment, or deliberate scamming: the Kurs.Expert and E-mon monitors list no active complaints or arbitration disputes, and orders on basic routes do get processed.

That said, the level of legal and operational protection for the customer here is bare minimum. The service is completely anonymous, hides its jurisdiction, publishes mismatched reserves, and runs on lopsided legal documents: an archaic offer template with a right of unilateral refusal sits side by side with draconian AML rules that let them freeze funds for 30 days on the slightest suspicion (from just 1% high-risk connections) and skim up to 5% in fees on refunds.

url

domain	explore	registered	registrar	abuse email	score	average
extratum.io		June 1, 2026	NameSilo, LLC	[email protected]	47/100	47.0
Blacklist: NoCoin Hexxium QuidsUp URLhaus FadeMind MetaMask Phishunt Badd-Boyz BlackBook CoinMiner OpenPhish ThreatFox TweetFeed PhishRadar Scam Block Abuse Block Phishing DB ScamSniffer PhishDestroy Malware Block Phishing Army Toxic Domains Filters Heroes GlobalAntiScam Phishing Block Pi-hole Trojan Scam Blocklist Fraud Blocklist Pi-hole Malware Crypto Blocklist Pi-hole Phishing Ransomware Block CyberHost Malware Pi-hole Malicious Pi-hole C2 Servers Thread Intelligence PhishDestroy Community