UK Sanctions Target Cryptomus Over Russian Sanctions Evasion and Illicit Cybercrime Payments

The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that digital forensics experts describe as a major conduit for illicit financial flows. According to investigators, the platform has processed billions of dollars linked to ransomware extortion, narcotics trafficking, darknet market operations, financial fraud, and cybercrime services. These operations have effectively helped the Russian government and its financial institutions circumvent international financial restrictions imposed in the wake of the ongoing geopolitical conflict.

On October 8, the U.K. government formally issued sanctions against Cryptomus—which has previously operated under the corporate names Certa Payments and Xeltox Enterprises—for facilitating transactions that directly benefit Russian state interests and aligned financial entities. Under the terms of the new measures, any assets belonging to Cryptomus held within British banks are frozen, and domestic UK companies are strictly barred from conducting any business with the platform, whether through virtual or traditional financial channels. Alongside Cryptomus, the U.K. also targeted several other virtual payment platforms designed to bypass traditional banking controls, including VexPay, TokenSpot, and the Tsunami Payments service.

The recent actions build upon detailed findings from previous blockchain investigations, including a December 2024 report titled "How Cryptocurrency Turns to Cash in Russian Banks." That investigation revealed that Cryptomus had established itself as a critical payment processor for dozens of underground Russian cryptocurrency exchanges and dubious websites hawking specialized cybercrime services. Operating since 2022, the company has repeatedly changed its corporate identity to evade scrutiny. Most recently, the platform launched a parallel service under the name "Heleket" last year, following a record-shattering CAD $176 million fine levied by Canadian regulators against the platform for severe anti-money laundering violations.

Major blockchain intelligence and data-analytics firms have emphasized that the British sanctions are designed to strike directly at the broader financial infrastructure sustaining Russia’s wartime economy. In an October 8 blog post addressing the measures, blockchain data-crunching firm Chainalysis noted that Cryptomus and its alter ego Heleket have rapidly evolved into premier payment hubs for illicit digital currency transactions. According to Chainalysis datasets, these interconnected services received a higher volume of illicit funds across tracked categories than the traditional cryptocurrency mixers in their database, with the number of unique illicit counterparties surging past 900 in a single month during late 2025.

Independent blockchain analysis firm TRM Labs reported earlier in April 2026 that Cryptomus had processed more than $7 billion in overall transactions since its inception four years prior. That staggering volume included transactions tied to dangerous criminal enterprises, such as vendors distributing child sexual abuse material, international terrorist financing networks, and high-profile human trafficking operations. TRM Labs also observed that while Cryptomus experienced a temporary cratering in transaction volume after instituting stricter "know your customer" (KYC) rules, the platform deftly circumvented regulatory pressure from Canada by rolling out Heleket, which maintained frictionless, no-KYC payment processing capabilities to keep criminal cash flowing.

Richard Sanders, an experienced blockchain analyst and investigator who spent months mapping out the complex payment infrastructure of Cryptomus and transacting directly with its customer base, noted that the U.K. sanctions represent a critical escalation. He pointed out that Canada’s previous monetary penalty against the platform proved ultimately unenforceable and uncollectible. On LinkedIn, Sanders emphasized that financial fines alone cannot stop a dedicated illicit cryptocurrency payment processor from moving funds, noting that actual sanctions are required to effectively disrupt and dismantle the underlying operations.

As earlier investigations highlighted, Cryptomus originally shared a registered address in Vancouver with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to have a genuine physical presence at the location. Following the imposition of Canada’s massive CAD $176 million fine for alleged money laundering violations, Cryptomus formally appealed the penalty while simultaneously spinning up Heleket as a shadow service, continuing to process substantial volumes of high-risk transactions without interruption.

Sanders also highlighted the geopolitical significance of the move, noting that this marks the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—sanctioning a cryptocurrency operation that was originally incorporated within the borders of another Five Eyes jurisdiction.

The question of how illicit entities like Cryptomus and Heleket manage to secure the legal authority to offer international financial services has long puzzled investigators. The trail appears to lead to a network of synthetic financial institutions overseen by a questionable regulatory body positioned in a disputed territory that lacks widespread international recognition as a sovereign nation.

Prior investigative findings revealed that the sole shareholder of Certa Payments, the parent company of Cryptomus, was a 25-year-old Ukrainian woman. This individual also headed several other shell corporations, including the WS Management and Advisory Corporation. This corporate entity bills itself as an exclusive regulatory authority that issues specialized licenses for cryptocurrency businesses, foreign exchange brokerages, and online gaming operations incorporated within the disputed northwest African region known as Western Sahara.

The official website for this regulatory front, operating under the domain crasadr.com, explicitly advertises services helping applicants with corporate formation, bank account setup, online gaming licensing, and the creation of foreign exchange brokers. Furthermore, digital infrastructure analysis showed that one of Certa Payments’ former web properties shared a server with a dozen other domains, including rasd-state.ws, which serves as the official website for the purported Central Reserve Authority of the Western Sahara—the very authority responsible for issuing licenses to these shadow financial entities.