The United Kingdom has issued stringent economic sanctions against Cryptomus, a cryptocurrency platform described as a "chameleonic" entity and a critical conduit for illicit financial flows, facilitating payments for ransomware, narcotics, darknet markets, fraud, and cybercrime services that bolster Russia’s efforts to circumvent existing financial restrictions. These sanctions, announced on October 8th, mark a significant escalation in the global effort to disrupt financial channels supporting adversarial states and criminal enterprises. Cryptomus, previously operating under the guises of Certa Payments and Xeltox Enterprises, has been formally designated for processing payments that directly benefit the Russian government and its financial institutions. The immediate impact of these sanctions includes the freezing of any Cryptomus assets held within U.K. banks and a complete prohibition on British companies engaging in any business, virtual or otherwise, with the platform. Alongside Cryptomus, other virtual payment platforms, VexPay and TokenSpot, along with the Tsunami Payments service, were also targeted in this coordinated action.

This development builds upon extensive investigations, notably Krebs on Security’s December 2024 report titled "How Cryptocurrency Turns to Cash in Russian Banks," which identified Cryptomus as a pivotal payment processor for a multitude of Russian cryptocurrency exchanges and websites peddling cybercrime services. Since its emergence in 2022, the platform has exhibited a pattern of name changes, most recently rebranding as "Heleket" last year, shortly after Canadian authorities imposed a record CAD $176 million fine on the platform for egregious anti-money laundering violations. This latest move by the U.K. government underscores the international recognition of Cryptomus’s role in enabling illicit activities and its persistent efforts to evade regulatory scrutiny.

The blockchain data analysis firm Chainalysis has corroborated the U.K.’s assessment, stating that the sanctions are aimed at dismantling the broader infrastructure underpinning Russia’s wartime economy. In an October 8th blog post, Chainalysis highlighted that "Cryptomus and Heleket have emerged as major payment hubs for illicit activity." The firm’s analysis revealed that, collectively, these services processed a staggering volume of illicit funds, surpassing even mixers within their dataset, with the number of illicit counterparties surging to over 900 in a single month during late 2025. This surge in activity points to the platform’s significant reach and its appeal to a wide array of criminal actors.

Further substantiating the severity of Cryptomus’s operations, the blockchain analysis firm TRM Labs, in an April 2026 report, found that Cryptomus had processed over $7 billion in transactions since its inception in 2022. This substantial figure included transactions linked to deeply disturbing illicit activities such as child sexual abuse material vendors, terrorist financing networks, and human trafficking operations. TRM Labs also observed a notable decline in Cryptomus’s transaction volume after the platform implemented new "know your customer" (KYC) rules. In response to the Canadian fines, the platform reportedly launched Heleket as a parallel service specifically designed to continue offering payment processing without mandatory KYC procedures, highlighting a deliberate strategy to circumvent regulatory compliance.

Richard Sanders, a seasoned blockchain analyst and investigator who dedicated months to meticulously mapping Cryptomus’s payment infrastructure and interacting with its clientele, emphasized the critical importance of the U.K.’s sanctions. Sanders pointed out that Canada’s previous fine against Cryptomus, while substantial, proved to be ultimately unenforceable and uncollectible. "A fine doesn’t stop a cryptocurrency payment processor from processing payments," Sanders articulated on LinkedIn. "Sanctions kill the operation. The distinction matters." This statement underscores the difference between monetary penalties, which can often be circumvented, and outright sanctions, which effectively dismantle an entity’s ability to operate.

The pattern of evasion exhibited by Cryptomus is further illuminated by Sanders’s observations. His research indicates that following the significant Canadian fine, Cryptomus appealed the penalty, launched Heleket as a clandestine parallel service, and continued to process vast quantities of dubious transactions. This strategy of rebranding and creating parallel entities is a common tactic employed by illicit operations to maintain functionality while evading detection and enforcement.

The U.K. sanctions are particularly noteworthy as they represent the first known instance of a "Five Eyes" country—an intelligence alliance comprising Australia, Canada, New Zealand, the U.K., and the U.S.—sanctioning a cryptocurrency operation that is incorporated within another Five Eyes jurisdiction. This highlights the increasing interconnectedness of global financial crime and the challenges faced by intelligence agencies in combating it across national borders.

The question of how entities like Cryptomus and Heleket derive their authority to offer international financial services has also come under scrutiny. The investigation reveals a complex web involving seemingly fake financial institutions overseen by a spurious regulatory body, purportedly located in a region not widely recognized as a sovereign nation. This shadowy infrastructure appears designed to lend an air of legitimacy to otherwise illicit operations.

Further delving into this intricate scheme, the December 2024 investigation uncovered that the sole shareholder of Cryptomus’s parent company, Certa Payments, was a 25-year-old Ukrainian woman. This individual also held leadership positions in several other firms, including WS Management and Advisory Corporation. This entity positions itself as the regulatory body exclusively responsible for overseeing licenses for cryptocurrency, foreign exchange, and online gaming businesses incorporated in the disputed region of Western Sahara, located in northwest Africa. The website for this purported regulatory body, crasadr.com, claims to assist applicants with essential services such as bank setup, formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. Alarmingly, a former website associated with Certa Payments, certa[.]website, shared a server with twelve other domains, including rasd-state[.]ws, which is the website for the Central Reserve Authority of the Western Sahara. This intricate setup suggests a deliberate attempt to create a facade of regulatory compliance and operational legitimacy for illicit financial activities.