By Layla Zulfa 
The United Kingdom has officially issued stringent economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that digital forensics and blockchain security experts describe as a primary pipeline for illicit payments. According to investigators, the platform acts as a major conduit for funds tied to ransomware attacks, narcotics trafficking, darknet markets, fraud schemes, and specialized cybercrime services that actively help the Russian government circumvent international financial restrictions and maintain its wartime economy.
The sanctions, formally published by the U.K. government on October 8, target Cryptomus—which has previously operated under the corporate names Certa Payments and Xeltox Enterprises—for processing high volumes of financial transactions that directly benefit the Russian state and its restricted financial institutions. Under the terms of the U.K. action, any assets belonging to Cryptomus held within British banks are frozen, and domestic companies are strictly prohibited from conducting any form of business with the platform, whether virtual or physical. In addition to Cryptomus itself, the sweeping sanctions also designate several other virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.
A History of Evasion and Rebranding
The crackdown follows extensive industry investigations that have tracked the platform’s evolution over the years. As outlined in a December 2024 investigative report detailing how cryptocurrency is systematically converted into cash within Russian banks, Cryptomus established itself as a critical payment processor for dozens of domestic Russian cryptocurrency exchanges and underground websites hawking cybercrime tools and illicit services.
Since emerging onto the digital landscape in 2022, the company has repeatedly changed its identity to dodge law enforcement and regulatory scrutiny. Most recently, the platform adopted the moniker “Heleket” following a historic regulatory enforcement action in Canada. In late 2025, Canadian authorities levied a record-breaking CAD $176 million fine against Cryptomus for severe violations of anti-money laundering regulations.
Major blockchain intelligence and data-analytics firms have emphasized the systemic scope of the operation. In an October 8 blog post analyzing the new measures, Chainalysis stated that the U.K. sanctions strike directly at the core infrastructure supporting Russia’s wartime financial networks.
"Cryptomus and Heleket have emerged as major payment hubs for illicit activity," Chainalysis wrote, noting that the combined services received more illicit funds across tracked tracking categories than many traditional cryptocurrency mixers. According to the firm’s dataset, the volume of illicit counterparties utilizing the platforms surged to more than 900 entities in a single month in late 2025.
Parallel findings from TRM Labs in April 2026 revealed that Cryptomus had processed upwards of $7 billion in overall transactions since its inception in 2022. This staggering volume included massive flows of funds associated with vendors of child sexual abuse material, international terrorist financing networks, and cross-border human trafficking operations. Furthermore, TRM Labs observed that while Cryptomus experienced a temporary cratering in transaction volume after instituting superficial "know your customer" (KYC) rules, the platform quickly adapted to the Canadian penalties by launching Heleket as a parallel service that continued to offer entirely unverified, no-KYC payment processing.
The Limits of Fines Versus Sanctions
Richard Sanders, an independent blockchain analyst and investigator who spent months mapping out Cryptomus’s intricate payment infrastructure and directly transacting with its user base, pointed out that the new U.K. sanctions mark a critical escalation because Canada’s earlier financial penalties proved ultimately unenforceable and uncollectible.
Writing on professional networks, Sanders emphasized the stark difference between civil monetary penalties and sovereign economic blacklisting. "A fine doesn’t stop a cryptocurrency payment processor from processing payments," Sanders wrote on LinkedIn. "Sanctions kill the operation. The distinction matters."
Sanders’s prior investigative work uncovered that Cryptomus initially shared a registered Vancouver address with dozens of other foreign currency dealers and money transfer businesses—none of which maintained a physical presence at the location. Following the imposition of Canada’s CAD $176 million money laundering fine, the platform appealed the penalty while simultaneously spinning up Heleket to ensure uninterrupted processing of high-volume, high-risk transactions.
Furthermore, Sanders highlighted the unprecedented diplomatic and geopolitical nature of the British action. The U.K. sanctions represent the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing direct economic sanctions on a cryptocurrency enterprise incorporated within another member of the same Five Eyes alliance.
The Phony Regulatory Framework of Western Sahara
As investigators dug deeper into the corporate origins of Cryptomus, a bizarre web of shell companies and fictitious regulatory bodies came to light, raising fundamental questions about how underground financial services manage to secure legitimacy on paper. The trail points directly to fake financial institutions operating under the oversight of a phony regulatory body positioned within a disputed region in northwest Africa.
Previous investigative findings revealed that the sole shareholder of Cryptomus’s original parent company, Certa Payments, was a 25-year-old Ukrainian woman. This individual simultaneously headed several other corporate entities, including the WS Management and Advisory Corporation. This firm marketed itself as an exclusive regulatory body responsible for issuing and overseeing licenses for cryptocurrency exchanges, foreign exchange brokers, and online gaming businesses incorporated in the disputed territory of the Western Sahara—a region not widely recognized as a sovereign nation.
The official portal for this purported regulator, hosted at crasadr.com, explicitly offered assistance to corporate applicants seeking bank setups, online gaming permissions, and foreign exchange broker licenses. Digital mapping of the infrastructure revealed that one of Certa Payments’ former web domains shared a server with twelve other distinct domains, including rasd-state.ws, which served as the designated online presence for the so-called Central Reserve Authority of the Western Sahara.
With the U.K. now enforcing asset freezes and sweeping commercial prohibitions against Cryptomus, Heleket, and their associated payment rails, the network faces an unprecedented operational blockade designed to sever its ties to the international financial system.
Nila Kartika Wati 
Sagoh 
Dwi Wanna