Krebs is not a bad idea as he would cover not only the leak but the (allegedly) shady nature of the service. He’s read by a lot of serious people including law enforcement and national security.

Negotiate your own anonymity with him BEFORE you provide any actual info (this goes for all reporters BTW).

Another option is to drop a write-up in The NY Times or Washington Post Secure Drop TOR service. They both have serious info security reporters.

No guarantee any of these options will pick up the story, of course.

"A clear conscience? When did you acquire this taste for luxuries?" - https://www.youtube.com/watch?v=jNKjShmHw7s

[You do you, but "letting people know a crypto company in Russia(?) is a bit shady" is not at the same level as walking past a person in trouble and ignoring them. The risks to your person and life of 'hacking' a multi-million dollar financial company, accross national borders, into a country in an active war and sabre rattling to the rest of the world, have got to be worth some serious consideration and not just a hurried blog post written in a couple of days].

Since merely knowing what the OP knows already likely implicates him in at least one felony, you (and he) might want to think about that very carefully.

It's either that or probably go to prison. I know what I'd pick :)