UK Sanctions Target Cryptomus and Heleket Over Illicit Payment Networks and Russian Sanctions Evasion

The United Kingdom has implemented severe economic sanctions against Cryptomus, a chameleon-like cryptocurrency platform that cybersecurity experts and blockchain investigators identify as a primary conduit for illicit payments. According to industry analysis, the platform processes massive volumes of transactions related to ransomware, narcotics trafficking, darknet markets, fraud, and cybercrime services. These operations have effectively helped Russian entities and financial institutions circumvent international financial restrictions established in the wake of the ongoing geopolitical conflict.

The UK Foreign, Commonwealth & Development Office issued the sanctions notice, which officially targets Cryptomus—historically known under previous corporate iterations such as Certa Payments and Xeltox Enterprises—for processing payments that directly benefit the Russian government and its isolated financial apparatus. Under the terms of the UK action, any assets belonging to Cryptomus held within British banks are frozen, and domestic UK companies are strictly barred from conducting any business, virtual or otherwise, with the platform. Alongside Cryptomus, the UK government also targeted several other virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service, signaling a coordinated crackdown on underground infrastructure.

The mechanics and scale of Cryptomus have been tracked by security researchers for years. Investigative reporting published previously detailed how Cryptomus functions as a pivotal payment processor for dozens of Russian cryptocurrency exchanges and underground websites hawking cybercrime services. Emerging onto the digital landscape in 2022, the company continuously altered its corporate identity to evade law enforcement and regulatory scrutiny. Most recently, following a record-breaking financial penalty levied by Canadian authorities, the platform launched a parallel service operating under the name "Heleket" to maintain its illicit operations.

Data from prominent blockchain intelligence firms underscores the sheer scale of the network dismantled or disrupted by the British measures. Chainalysis, a leading blockchain data-crunching firm, noted in a public advisory that the UK sanctions strike directly at the broader infrastructure supporting Russia’s wartime economy. Cryptomus and Heleket rapidly evolved into major payment hubs for illicit activity globally. According to Chainalysis metrics, these combined services received more illicit funds across tracked categories than traditional cryptocurrency mixers within the firm’s dataset, with the number of illicit counterparties surging to more than 900 in a single month during late 2025.

Independent blockchain intelligence paints a similarly staggering picture of the platform’s financial throughput. TRM Labs reported that Cryptomus processed more than $7 billion in total transactions since its inception in 2022. This enormous volume encompassed funds tied to severe criminal enterprises, including vendors of child sexual abuse material, global terrorist financing networks, and international human trafficking operations.

TRM Labs observed that Cryptomus experienced a temporary cratering of its transaction volume after implementing mandatory "know your customer" (KYC) rules. However, rather than complying with international financial regulations, the platform pivoted by launching Heleket as a parallel service designed explicitly to bypass KYC checks and continue processing high volumes of high-risk transactions.

Richard Sanders, an experienced blockchain analyst and investigator who spent months mapping out the intricate payment infrastructure of Cryptomus and transacting directly with its customer base, emphasized that the UK sanctions represent a critical escalation in international enforcement. Sanders noted that while Canada previously attempted to penalize the platform, those domestic fines ultimately proved difficult to enforce and collect across international borders.

A financial penalty alone does not stop an active cryptocurrency payment processor from continuing to process illicit payments, Sanders explained on professional networking platforms, whereas formal economic sanctions actively target the operational viability of the business.

The structural history of Cryptomus further highlights the sophisticated evasion techniques employed by modern cybercrime syndicates. During initial investigations into the platform’s corporate footprint, researchers discovered that Cryptomus shared a physical address in Vancouver with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to maintain a genuine physical presence at the location. Following a staggering CAD $176 million fine imposed by Canada for systemic anti-money laundering violations, Cryptomus aggressively appealed the penalty while spinning up Heleket to ensure uninterrupted service for its criminal clientele.

Furthermore, analysts highlight that the UK action marks a significant diplomatic milestone. It is believed to be the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—formally sanctioning a cryptocurrency operation that was originally incorporated within the jurisdiction of another Five Eyes partner.

The underlying legitimacy of entities like Cryptomus and Heleket has long puzzled financial regulators. The question of how such operations derive their ostensible authority to offer international financial services leads to a web of fictitious financial institutions overseen by phony regulatory bodies positioned in disputed geopolitical territories.

Investigations into the corporate ownership of Cryptomus revealed that the sole shareholder of its parent company, Certa Payments, was a 25-year-old Ukrainian woman. This individual simultaneously headed several other corporate entities, including the WS Management and Advisory Corporation. This organization aggressively marketed itself as an exclusive regulatory body responsible for issuing licenses to cryptocurrency firms, foreign exchange brokers, and online gaming businesses incorporated within the Western Sahara, a disputed region in northwest Africa not widely recognized as a sovereign nation.

The digital footprint left by these entities exposed direct ties between corporate registration schemes and fictitious oversight bodies. The official website of the WS Management and Advisory Corporation directed applicants to resources assisting with corporate formation, online gaming licensing, and foreign exchange brokerage creation. Historical records of domains utilized by Certa Payments revealed that they shared web hosting infrastructure with domains dedicated to the Central Reserve Authority of the Western Sahara, illustrating how underground financial networks leverage fictitious jurisdictional authorities to project an illusion of legitimacy to banking partners and consumers alike.