By Asro 
The United Kingdom has officially levied economic sanctions against Cryptomus, a high-volume and shape-shifting cryptocurrency platform that blockchain intelligence experts and security researchers say functions as a critical conduit for illicit financial flows. According to authorities, the platform processes payments linked to ransomware attacks, narcotics trafficking, darknet markets, fraud schemes, and sophisticated cybercrime services that actively help the Russian government and its financial institutions circumvent international sanctions and financial restrictions.
On October 8, the U.K. government formally issued restrictive measures against Cryptomus—which has previously operated under the corporate monikers Certa Payments and Xeltox Enterprises—for facilitating transactions that directly benefit Moscow and its wartime economy. The newly enacted sanctions freeze any financial assets held by Cryptomus at British banking institutions and strictly bar U.K. companies and citizens from conducting any form of business with the platform, whether virtual or commercial. Alongside Cryptomus, the U.K. also targeted several other digital payment platforms and services, including VexPay, TokenSpot, and the Tsunami Payments service, in an effort to choke off the broader infrastructure supporting illicit digital currency pipelines.
The crackdown underscores a multi-year trail of regulatory scrutiny. As detailed in a December 2024 investigative report titled “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has long served as a primary payment processor for dozens of Russian cryptocurrency exchanges and online storefronts peddling cybercrime tools. Emerging on the digital landscape in 2022, the platform has repeatedly rebranded to evade law enforcement. Most recently, it adopted the name “Heleket” following a massive regulatory enforcement action in late 2025, when Canada levied a record-breaking CAD $176 million fine against the platform for severe anti-money laundering violations.
Major blockchain data-crunching and analytics firms have emphasized that the U.K.’s latest sanctions represent a significant escalation in the global effort to dismantle the financial scaffolding sustaining Russia’s wartime operations. In an October 8 blog post analyzing the move, blockchain analytics leader Chainalysis noted that Cryptomus and its parallel incarnation Heleket have cemented their status as dominant hubs for unlawful activity.
According to Chainalysis, these linked services received a greater volume of illicit funds across tracked categories than the traditional cryptocurrency mixers present in the firm’s dataset. The scale of the operation was staggering, with the number of illicit counterparties interacting with the platform surging to more than 900 in a single month during late 2025.
Further compounding these findings, an April 2026 intelligence report from blockchain analysis firm TRM Labs revealed that Cryptomus had processed more than $7 billion in overall transactions since its inception in 2022. That eye-watering cumulative volume included significant financial flows tied directly to vendors of child sexual abuse material, international terrorist financing networks, and human trafficking operations.
TRM Labs also observed that while Cryptomus experienced a temporary cratering in transaction volume after instituting formal “know your customer” (KYC) rules, the platform quickly pivoted in response to Canadian financial penalties by launching Heleket as a parallel service designed to bypass regulatory oversight and continue offering no-KYC payment processing to dubious clients.
Richard Sanders, a seasoned blockchain analyst and investigator who spent months painstakingly mapping out Cryptomus’s intricate payment infrastructure and transacting directly with its customer base, noted that the U.K. sanctions mark a decisive turning point. According to Sanders, previous monetary penalties—such as the massive fine issued by Canadian authorities—ultimately proved unenforceable and uncollectible in practice.
Writing on LinkedIn following the U.K. announcement, Sanders explained that financial penalties alone are insufficient to alter the behavior of deeply entrenched illicit payment processors. A monetary fine does not stop a cryptocurrency payment processor from continuing to process transactions, Sanders noted, whereas targeted government sanctions effectively kill the operation by cutting off its access to legitimate financial rails. That legal and operational distinction matters profoundly in the fight against cybercrime.
As revealed in earlier investigative reporting, Cryptomus originally shared a registered address in Vancouver with dozens of other foreign currency dealers and money transfer businesses, none of which appeared to maintain any physical presence at the location. Following the imposition of Canada’s CAD $176 million fine for suspected money laundering violations, the platform appealed the penalty while simultaneously launching Heleket to ensure uninterrupted processing of high-volume, high-risk transactions.
Furthermore, Sanders highlighted that the U.K. sanctions are historically notable because they mark the first known instance of a “Five Eyes” intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing direct economic sanctions on a cryptocurrency business originally incorporated within another jurisdiction belonging to the Five Eyes alliance.
This trans-jurisdictional evasion naturally raises fundamental questions about where shadowy entities like Cryptomus and Heleket derive their apparent legal authority to offer international financial services in the first place. Investigations into the corporate genealogy of these platforms point to a bizarre nexus involving fake financial institutions overseen by a phony regulatory body positioned in a disputed territory not widely recognized as a sovereign nation.
An in-depth investigation revealed that the sole shareholder of Cryptomus’s parent company, Certa Payments, was a 25-year-old Ukrainian woman. This individual also headed several other shell corporations, including the WS Management and Advisory Corporation. This entity marketed itself as an exclusive regulatory body responsible for overseeing licenses for cryptocurrency operations, foreign exchange brokerages, and online gaming businesses incorporated within the disputed region of northwestern Africa known as Western Sahara.
The website operated by this entity—crasadr.com—historically stated that it assisted corporate applicants with bank setups, entity formation, online gaming licenses, and the creation of foreign exchange brokers. Digital infrastructure analysis further tied these operations together; one of Certa Payments’ former web domains shared a hosting server with 12 other domains, including rasd-state.ws, which served as the purported website for the Central Reserve Authority of the Western Sahara, a regulatory body used to legitimize the commercial activities of entities granted digital asset and gaming licenses in the contested territory.
Nila Kartika Wati 
Sagoh 
Ammar Sabilarrohman