By Sagoh 
The United Kingdom has levied severe economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that blockchain and cybersecurity experts identify as a primary conduit for financial transactions tied to ransomware, narcotics, darknet markets, fraud, and cybercrime services allegedly assisting Russia in circumventing international financial restrictions.
On October 8, the U.K. government formally issued sanctions targeting Cryptomus—which has previously operated under the corporate aliases Certa Payments and Xeltox Enterprises—for processing payments that directly benefit the Russian government and its financial institutions. Under the terms of the U.K. measures, any assets held by Cryptomus at British banks are immediately frozen, while domestic companies and financial institutions are strictly barred from conducting any business with the platform, whether virtual or otherwise. Alongside Cryptomus, the U.K. sanctions also target several associated virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive investigative reporting, including a December 2024 investigation titled "How Cryptocurrency Turns to Cash in Russian Banks," which exposed Cryptomus as a critical payment processor for dozens of underground Russian cryptocurrency exchanges and websites hawking cybercrime tools and services. Emerging in 2022, the platform has repeatedly rebranded to evade scrutiny. Most recently, it launched an alternative service known as "Heleket" last year after Canadian authorities levied a record-breaking CAD $176 million fine against the platform for severe anti-money laundering violations.
Major blockchain intelligence firms have emphasized the broader geopolitical and criminal impact of the U.K. measures. Chainalysis noted in an October 8 blog post that the U.K. sanctions strike directly at the core infrastructure supporting Russia’s wartime economy and broader illicit digital financial networks.
According to Chainalysis, Cryptomus and its spin-off Heleket rapidly evolved into dominant payment hubs for illicit activity, receiving more illicit funds across tracked categories than traditional cryptocurrency mixers in their dataset. The firm observed that the number of illicit counterparties utilizing the network surged to more than 900 in a single month during late 2025.
Parallel analyses from other blockchain intelligence providers underscore the staggering scale of the platform’s operations. In April 2026, TRM Labs published findings revealing that Cryptomus had processed more than $7 billion in transactions since its inception in 2022. This enormous volume included substantial fund flows associated with vendors trafficking in child sexual abuse material, international terrorist financing networks, and large-scale human trafficking operations.
TRM Labs also observed a distinct shift in the platform’s operational strategy over time. Cryptomus’s overall transaction volume experienced a sharp downturn after the platform reluctantly instituted mandatory "know your customer" (KYC) compliance rules. Rather than reforming its practices, the platform responded to Canadian regulatory pressure and subsequent fines by launching Heleket as a parallel service explicitly designed to continue offering anonymous, no-KYC payment processing to high-risk clientele.
Richard Sanders, a prominent blockchain analyst and investigator who spent months mapping out the intricate payment infrastructure of Cryptomus and transacting directly with its customer base, noted that the U.K. sanctions represent a vital escalation in international law enforcement. Sanders pointed out that while Canada’s historic CAD $176 million fine made headlines, it ultimately proved unenforceable and uncollectible in practice.
Writing on LinkedIn, Sanders emphasized the fundamental difference between punitive financial penalties and targeted government sanctions. A monetary fine, he explained, does not stop an active cryptocurrency payment processor from continuing to process transactions, whereas formal sanctions effectively dismantle the operational capacity of the enterprise.
Investigative findings from late 2024 revealed that Cryptomus originally shared a registered Vancouver address with dozens of other foreign currency dealers and money transfer businesses—none of which maintained any physical presence at the location. Following the imposition of Canada’s massive anti-money laundering fine, the platform appealed the penalty while simultaneously spinning up Heleket to maintain its high volume of suspect transactions without interruption.
Furthermore, Sanders highlighted that the U.K. action marks a significant precedent as the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing formal sanctions on a cryptocurrency operation incorporated within the jurisdiction of another member of the alliance.
A central question surrounding entities like Cryptomus and Heleket involves the formal authorization and legal backing they utilize to offer international financial services. Investigations indicate that these platforms frequently rely on a network of fictitious financial institutions overseen by a phony regulatory body positioned within a territory that lacks widespread international recognition as a sovereign state.
Previous investigative work uncovered that the sole shareholder of Certa Payments, the parent company of Cryptomus, was a 25-year-old Ukrainian woman. This individual also served as the head of several other corporate entities, including the WS Management and Advisory Corporation. This organization marketed itself as an exclusive regulatory body responsible for issuing licenses to cryptocurrency businesses, foreign exchange brokers, and online gaming operations incorporated within the disputed region of northwestern Africa known as the Western Sahara.
The regulatory website operated by the entity, crasadr.com, publicly claimed to assist prospective businesses with corporate formation, bank account setup, online gaming licenses, and the creation of foreign exchange brokerages. Digital infrastructure analysis revealed further operational ties; one of Certa Payments’ former web portals shared a server network with twelve distinct domains, including rasd-state.ws, which served as the official website for the self-styled Central Reserve Authority of the Western Sahara.
Nila Kartika Wati 
Ammar Sabilarrohman 
Asro