UK Sanctions Target Cryptomus and Heleket Over Cybercrime and Russian Financial Evasion

The United Kingdom has implemented severe economic sanctions against Cryptomus, a highly adaptable cryptocurrency platform that cybersecurity experts and blockchain investigators identify as a primary conduit for illicit payments. According to financial intelligence and security assessments, the platform facilitates transactions linked to ransomware attacks, narcotics trafficking, darknet markets, fraud schemes, and specialized cybercrime services that actively help the Russian government circumvent international financial restrictions and maintain its wartime economy.

The formal sanctions, issued by the U.K. government on October 8, specifically target Cryptomus—which has previously operated under the corporate names Certa Payments and Xeltox Enterprises—for processing financial flows that directly benefit Russian state interests and allied financial institutions. Under the terms of the restrictive measures, any assets held by Cryptomus within British banking institutions are immediately frozen. Furthermore, the directives strictly bar all British companies and citizens from engaging in any form of business dealings with the platform, whether virtual or traditional. In addition to Cryptomus, the U.K. government’s punitive actions also sweep up several associated virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.

The targeting of Cryptomus forms part of a broader, multi-year international effort to dismantle the financial infrastructure supporting illicit digital currency flows. Investigations into the platform’s operations have long highlighted its role in the global cybercrime underground. As detailed in a December 2024 investigative report titled “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has functioned as a cornerstone payment processor for dozens of underground Russian cryptocurrency exchanges and web portals openly advertising cybercrime and hacking tools.

Because of mounting international pressure and regulatory scrutiny, the enterprise has exhibited a chameleonic ability to rebrand itself. Since emerging onto the digital landscape in 2022, the platform has repeatedly changed its identity, most recently shifting its branding to “Heleket” following a landmark regulatory enforcement action by Canadian authorities, who levied a record-breaking CAD $176 million fine against the platform for severe anti-money laundering violations.

Major blockchain intelligence and data analytics firms have underscored the scale of the threat posed by these interconnected payment hubs. In a blog post published alongside the announcement of the U.K. sanctions, blockchain data-crunching firm Chainalysis emphasized that the measures strike directly at the core financial conduits sustaining Russia’s wartime operations.

According to Chainalysis, Cryptomus and its parallel incarnation, Heleket, have rapidly transformed into dominant payment clearinghouses for illicit digital asset activity. Data compiled by the firm reveals that these combined services received a greater volume of illicit funds across tracked categories than the traditional cryptocurrency mixers present in their dataset. At the peak of their activity in late 2025, the number of illicit counterparties interacting with the platform surged to more than 900 entities in a single month.

Independent findings from other leading blockchain intelligence organizations paint a similarly expansive picture of the platform’s historical throughput. In April 2026, TRM Labs published a comprehensive profile on Cryptomus revealing that the platform had processed more than $7 billion in total transactions since its inception in 2022. This massive volume included financial flows associated with abhorrent illegal enterprises, such as vendors distributing child sexual abuse material, international terrorist financing networks, and sophisticated human trafficking operations.

TRM Labs also noted a distinct operational shift in how the platform managed regulatory pressure. Following the implementation of tighter “know your customer” or KYC verification rules, Cryptomus experienced a significant drop in raw transaction volume. However, rather than fully conforming to international compliance standards, the operators responded to Canada’s record-setting fines by launching Heleket as a parallel service. This new iteration was specifically designed to bypass regulatory oversight by continuing to offer no-KYC payment processing to its high-risk clientele.

Richard Sanders, a prominent blockchain analyst and investigator who spent months meticulously mapping out the complex payment infrastructure of Cryptomus and actively transacting with its customer base, stressed that the U.K. sanctions represent a critical escalation in enforcement. According to Sanders, previous penalties—such as the massive monetary fine issued by Canada—ultimately proved unenforceable and uncollectible in practice.

A financial penalty alone does not possess the capacity to stop an entrenched cryptocurrency payment processor from continuing to move funds, Sanders noted in a professional analysis shared on LinkedIn. True disruption requires measures that dismantle the operational capabilities of the network, making sanctions a far more potent weapon in the fight against cybercrime.

The underlying corporate structure of Cryptomus has long confounded investigators tracking illicit finance. The platform’s early operational footprint included sharing a modest Vancouver address with dozens of other foreign currency dealers and money transfer businesses, none of which appeared to maintain any physical presence at the location. Even after Canadian regulators handed down their CAD $176 million fine for systemic money laundering violations, the corporate entities behind Cryptomus simply filed appeals, established Heleket as an alternative brand, and maintained their high volume of suspicious transactions.

Sanders also highlighted the geopolitical significance of the U.K. action, noting that it marks the first known instance of a “Five Eyes” nation—referring to the intelligence-sharing alliance comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—formally sanctioning a cryptocurrency operation that was originally incorporated within another jurisdiction belonging to the same alliance.

The question of how illicit operations like Cryptomus and Heleket manage to establish legitimate-sounding credentials to offer international financial services leads directly into a web of obscure corporate registrations. Investigations into the origins of Cryptomus revealed that the sole shareholder of its original parent company, Certa Payments, was a 25-year-old Ukrainian woman. Alongside her involvement with the payment processor, she also headed several other firms, including the WS Management and Advisory Corporation.

This advisory corporation presented itself publicly as an official regulatory body tasked with exclusively overseeing and issuing licenses for cryptocurrency, foreign exchange, and online gaming businesses incorporated within the disputed region of northwestern Africa known as the Western Sahara.

Digital forensics tied the corporate infrastructure directly to these disputed territories. The website for the regulatory body, operating under the domain crasadr.com, explicitly advertised services helping prospective applicants with corporate bank setup, company formation, online gaming licensing, and the creation of foreign exchange brokers. Further technical examination showed that one of Certa Payments’ former web properties shared a hosting server with a dozen other domains, including rasd-state.ws, which served as the official online presence for the Central Reserve Authority of the Western Sahara—the very entity purportedly granting legal standing to these shadow financial platforms.