By Nana 
The United Kingdom has levied sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that cybersecurity experts identify as a critical payment conduit for ransomware gangs, narcotics traffickers, darknet markets, fraud networks, and cybercrime services. According to investigators, the platform has played a pivotal role in helping Russia circumvent existing international financial restrictions following its invasion of Ukraine.
On October 8, the U.K. government officially published sanctions targeting Cryptomus—a platform previously operating under the aliases Certa Payments and Xeltox Enterprises—for processing transactions that directly benefit the Russian government and its allied financial institutions. The newly enacted measures freeze any financial assets held by Cryptomus within British banks and legally bar all UK-based companies from engaging in any commercial or virtual business dealings with the platform. Alongside Cryptomus, the U.K. also targeted several other associated virtual payment services, including VexPay, TokenSpot, and the Tsunami Payments service, in an effort to dismantle the broader digital infrastructure supporting illicit cross-border finance.
The latest regulatory action builds upon long-standing investigative reporting into how illicit digital assets flow freely into traditional financial systems. As detailed in a December 2024 investigation titled “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has operated as a foundational payment processor for dozens of underground Russian cryptocurrency exchanges and commercial websites openly hawking cybercrime-as-a-service tools.
Since emerging onto the digital landscape in 2022, the enterprise has repeatedly rebranded and restructured itself to evade regulatory scrutiny. Most recently, following a record-breaking CAD $176 million fine levied by Canadian regulators for severe anti-money laundering violations, the platform launched a parallel service known as "Heleket" to maintain its operations. Despite clear technical and operational continuity, support agents manning Heleket’s official Telegram channels have persistently claimed to users that the service has no affiliation whatsoever with Cryptomus.
Industry analysts have praised the U.K.’s intervention as a necessary escalation against hardened financial threat actors. The blockchain analytics firm Chainalysis emphasized in an October 8 blog post that the U.K. sanctions strike directly at the core infrastructure sustaining Russia’s wartime economy. Chainalysis noted that Cryptomus and Heleket rapidly emerged as premier payment hubs for illicit activity, pointing out that together, these interconnected services received more illicit funds across tracked threat categories than all the cryptocurrency mixers tracked in their expansive dataset combined. Furthermore, Chainalysis revealed that the number of illicit counterparties utilizing the platform surged to more than 900 in a single month during late 2025.
Independent investigations underscore the staggering scale of capital flowing through the platform’s channels. In April 2026, blockchain intelligence firm TRM Labs published findings showing that Cryptomus had successfully processed more than $7 billion in cumulative transactions since its inception in 2022. This massive volume included funds directly associated with vendors distributing child sexual abuse material, international terrorist financing networks, and dangerous human trafficking operations.
TRM Labs also observed a distinct operational shift in the platform’s behavior over time, noting that Cryptomus’s overall transaction volume experienced a temporary downturn only after the platform instituted nominal "know your customer" (KYC) compliance rules. Rather than fully capitulating to regulatory oversight, however, the platform responded to mounting legal pressures—such as the massive Canadian penalties—by launching Heleket as a parallel operational entity designed explicitly to continue offering frictionless, no-KYC payment processing to high-risk clientele.
Richard Sanders, an experienced blockchain analyst and investigator who spent months meticulously mapping out Cryptomus’s intricate payment infrastructure and directly transacting with its customer base, noted that the U.K. sanctions represent a vital turning point in international enforcement. According to Sanders, previous penalties imposed by individual nations proved largely toothless because they lacked real-world enforceability.
Writing on LinkedIn, Sanders highlighted the fundamental difference between punitive fines and comprehensive sanctions. A financial fine, he explained, does little to actually stop an illicit cryptocurrency payment processor from continuing to process transactions on the open market, whereas targeted economic sanctions effectively choke the life out of the underlying operation.
The investigative trail surrounding Cryptomus has consistently revealed deep layers of corporate obfuscation. As earlier investigations uncovered, Cryptomus initially shared a physical office address in Vancouver with dozens of unrelated foreign currency dealers and money transfer businesses—none of which appeared to maintain any actual physical presence at the location. Following the record-setting Canadian fine for alleged money laundering, the platform formally appealed the financial penalty while simultaneously spinning up Heleket and carrying on business as usual.
Furthermore, Sanders pointed out that the U.K.’s action marks a historic milestone in international law enforcement cooperation: it is the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—imposing official sanctions against a cryptocurrency operation incorporated within the jurisdiction of another Five Eyes partner.
This raises critical questions regarding how entities like Cryptomus and Heleket initially managed to acquire the legal authority and licensing required to offer international financial services in the first place. The answer appears to trace back to a web of phantom financial institutions overseen by a questionable regulatory body positioned in a geographic territory that lacks widespread international recognition as a sovereign state.
Previous investigations into the platform’s corporate ownership structure revealed that the sole shareholder of Cryptomus’s original parent company, Certa Payments, was a 25-year-old Ukrainian woman. Alongside her involvement with Cryptomus, she also headed several other corporate entities, including the WS Management and Advisory Corporation. This particular enterprise explicitly billed itself as the exclusive regulatory authority responsible for issuing official operating licenses for cryptocurrency platforms, foreign exchange brokers, and online gaming businesses incorporated within the disputed region of northwestern Africa known as Western Sahara.
The official website for this self-appointed regulatory body, operating under the domain crasadr.com, publicly advertised its services in assisting corporate applicants with fast-tracked bank setups, corporate formations, online gaming permits, and the licensing of foreign exchange intermediaries. Digital infrastructure analysis further tied these operations together, revealing that one of Certa Payments’ former web properties shared a hosting server with a dozen distinct domains, including rasd-state.ws, which served as the official online portal for the purported Central Reserve Authority of the Western Sahara.
Nila Kartika Wati 
Sagoh 
Ammar Sabilarrohman