UK Imposes Economic Sanctions on Cryptocurrency Platform Cryptomus Over Russia Ties and Illicit Payments

The United Kingdom has issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that digital forensics and intelligence experts describe as a major conduit for payments linked to ransomware, narcotics, darknet markets, fraud, and cybercrime services. According to investigators, the platform’s operations have played a critical role in helping Russia circumvent existing international financial restrictions.

On October 8, the U.K. government formally issued sanctions against Cryptomus—previously known under corporate aliases including Certa Payments and Xeltox Enterprises—for processing payments that directly benefit the Russian government and its financial institutions. The new measures freeze any assets held by Cryptomus at British banks and strictly prohibit UK-based companies from engaging in any business dealings with the platform, whether virtual or otherwise. Alongside Cryptomus, the U.K. also targeted several other virtual payment platforms, specifically VexPay, TokenSpot, and the Tsunami Payments service.

As detailed in previous investigative reporting, Cryptomus has served as a pivotal payment processor for dozens of Russian cryptocurrency exchanges and dubious websites hawking cybercrime-as-a-service offerings. The company has exhibited a pattern of rebranding itself multiple times since emerging in 2022. Most recently, the platform adopted the name "Heleket" last year after Canadian authorities levied a record-shattering CAD $176 million fine against the enterprise for severe anti-money laundering violations.

Blockchain data-crunching firm Chainalysis emphasized that the U.K. sanctions are designed to dismantle the broader underlying infrastructure supporting Russia’s wartime economy. In an October 8 blog post, Chainalysis noted that Cryptomus and Heleket have rapidly evolved into premier payment hubs for illicit activity across the digital asset ecosystem. According to the firm’s data, these services received more illicit funds across tracked categories than the specialized cryptocurrency mixers in their dataset, with the number of interacting illicit counterparties surging to more than 900 in a single month in late 2025.

Independent blockchain intelligence from TRM Labs previously revealed in April 2026 that Cryptomus had processed more than $7 billion in total transactions since its inception in 2022. This staggering volume included transactions associated with vendors distributing child sexual abuse material, terrorist financing networks, and international human trafficking operations. Furthermore, TRM observed that while Cryptomus experienced a temporary cratering in transaction volume after implementing mandatory "know your customer" (KYC) rules, the platform quickly pivoted in response to Canadian regulatory enforcement by launching Heleket as a parallel service that continued to offer completely unverified, no-KYC payment processing.

Richard Sanders, a seasoned blockchain analyst and investigator who spent months meticulously mapping Cryptomus’s payment infrastructure and transacting directly with its customer base, noted that the U.K. sanctions represent a vital escalation because Canada’s earlier financial penalties proved ultimately unenforceable and uncollectible. Writing on LinkedIn, Sanders highlighted the fundamental difference between regulatory fines and targeted government sanctions, pointing out that while a fine rarely stops a determined cryptocurrency payment processor from moving funds, comprehensive economic sanctions effectively kill the underlying operational capacity.

During previous investigations into the platform’s corporate footprint, Cryptomus was found sharing a single Vancouver office address with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to have any physical presence at the location. Following the imposition of Canada’s massive CAD $176 million fine for alleged money laundering violations, Cryptomus filed an appeal, spun up Heleket as an operational duplicate, and continued processing vast volumes of high-risk transactions.

Sanders also highlighted the broader geopolitical significance of the move, noting that this marks the first known instance of a "Five Eyes" nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—sanctioning a cryptocurrency operation incorporated within the jurisdiction of another member of the alliance.

This cross-border evasion raises persistent questions regarding how entities like Cryptomus and Heleket derive their apparent authority to offer international financial services in the first place. Investigative findings indicate that the apparatus relies heavily on a network of fictitious financial institutions overseen by a phony regulatory body positioned within a region that lacks widespread recognition as a sovereign nation.

Previous investigations revealed that the sole shareholder of Cryptomus’s initial parent company, Certa Payments, was a 25-year-old Ukrainian woman who simultaneously headed several other corporate entities. Among these was the WS Management and Advisory Corporation, an organization that marketed itself as an exclusive regulatory body overseeing licensing for cryptocurrency, foreign exchange, and online gaming businesses incorporated in the disputed northwest African territory known as Western Sahara.

The website operated by this entity, crasadr.com, publicly claimed to assist applicants with corporate bank setup, online gaming licenses, and the creation and licensing of foreign exchange brokers. Further tying the infrastructure together, one of Certa Payments’ former web properties shared a server infrastructure with a dozen other domains, including rasd-state.ws, which served as the purported website for the Central Reserve Authority of Western Sahara, an institution used to grant legitimacy to the illicit financial ventures.