By Sagoh 
The United Kingdom has imposed strict economic sanctions on Cryptomus, a chameleonic cryptocurrency platform that international blockchain intelligence experts and security researchers identify as a primary financial conduit for ransomware gangs, narcotics traffickers, darknet markets, fraud networks, and cybercrime services. According to government assessments, the platform’s operations have significantly aided the Russian government and its financial institutions in circumventing international financial restrictions tied to the ongoing conflict in Ukraine.
On October 8, the U.K. government formally issued economic sanctions against Cryptomus—which has operated under various corporate titles, including Certa Payments and Xeltox Enterprises—for processing high volumes of illicit payments that directly benefit Russian state interests. The sanctions impose an immediate freeze on any assets held by Cryptomus within British financial institutions and legally bar all British companies and citizens from engaging in any commercial or virtual business dealings with the platform. Alongside Cryptomus, the U.K. also targeted several other virtual payment platforms intimately connected to its operations, namely VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown underscores the growing international scrutiny facing unregulated and semi-regulated crypto payment processors that act as financial bridges between Western liquidity and illicit Eastern economies. Investigators have long tracked how these platforms facilitate the conversion of digital currency into clean fiat cash, maintaining a robust pipeline for Russian entities seeking to bypass sweeping Western sanctions.
A History of Rebranding and Evasion
Cryptomus first emerged on the digital landscape in 2022, rapidly positioning itself as a key payment processor for dozens of Russian cryptocurrency exchanges and underground websites hawking cybercrime tools, stolen credentials, and hacking services. However, as law enforcement agencies and blockchain analytics firms closed in on its operations, the platform repeatedly changed its corporate identity to evade regulatory oversight.
Most recently, following a massive regulatory penalty levied by North American authorities, the platform launched a parallel service known as "Heleket." Despite overwhelming technical and transactional evidence linking the two entities, support agents staffing Heleket’s official Telegram channels have repeatedly claimed that the service maintains no affiliation with Cryptomus. Nevertheless, blockchain analysts note that Heleket effectively serves as a seamless continuation of the original platform’s no-KYC (Know Your Customer) payment processing infrastructure.
The structural resilience of Cryptomus was initially highlighted in extensive investigative reporting, which detailed how cryptocurrency flows from illicit sources into cash within traditional Russian banking channels. The company’s ability to weather regulatory storms by simply changing its name has long frustrated global anti-money laundering watchdogs.
Scale of Illicit Activity and the Limits of Fines
Data compiled by prominent blockchain intelligence firms illustrates the staggering scale of illicit funds processed through the Cryptomus ecosystem. In an October 8 blog post analyzing the U.K. sanctions, Chainalysis emphasized that the measures target the broader infrastructure underpinning Russia’s wartime economy.
"Cryptomus and Heleket have emerged as major payment hubs for illicit activity," Chainalysis wrote. "Together, these services received more illicit funds across tracked categories than the mixers in our dataset, and the number of illicit counterparties surged to more than 900 in a single month in late 2025."
Earlier in April 2026, blockchain analysis firm TRM Labs released intelligence indicating that Cryptomus had processed more than $7 billion in transactions since its inception in 2022. That volume included substantial flows associated with vendors distributing child sexual abuse material, international terrorist financing networks, and human trafficking operations. TRM Labs further observed that while Cryptomus experienced a temporary cratering in transaction volume after briefly instituting rudimentary KYC rules, the platform quickly pivoted by launching Heleket to recapture the lucrative market of cybercriminals seeking anonymous payment rails.
The limitations of traditional monetary penalties were laid bare in October 2025, when Canada hit Cryptomus with a record-shattering CAD $176 million fine for severe anti-money laundering violations. According to blockchain analyst and investigator Richard Sanders, who spent months mapping out the platform’s complex payment infrastructure and interacting directly with its network of customers, that Canadian fine ultimately proved unenforceable and uncollectible.
"A fine doesn’t stop a cryptocurrency payment processor from processing payments," Sanders wrote in a public assessment of the enforcement action. "Sanctions kill the operation. The distinction matters."
Sanders noted that during the Canadian investigation, Cryptomus shared a physical address in Vancouver with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to have any actual operational presence at the location. Following the imposition of the CAD $176 million fine, Cryptomus management appealed the penalty while simultaneously spinning up Heleket to maintain uninterrupted processing for high-risk and illicit transactions.
Furthermore, Sanders highlighted the historical significance of the U.K. action, pointing out that it represents the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing formal sanctions on a cryptocurrency enterprise incorporated within the jurisdiction of another Five Eyes partner.
The Phony Regulators of Western Sahara
The sprawling network behind Cryptomus and its successor platforms raises fundamental questions about how obscure online entities manage to project legitimacy and secure authorization to offer international financial services. The answer, according to investigative findings, leads to a web of fictitious financial institutions overseen by a phony regulatory body rooted in a disputed geopolitical territory in northwest Africa.
Previous investigative deep dives revealed that the sole shareholder of Certa Payments, the parent company of Cryptomus, was a 25-year-old Ukrainian woman. Alongside her involvement with Cryptomus, she also headed several other corporate entities, including the WS Management and Advisory Corporation. This enterprise aggressively billed itself as an exclusive regulatory body responsible for issuing and overseeing operational licenses for cryptocurrency exchanges, foreign exchange brokers, and online gaming businesses incorporated within the disputed region of the Western Sahara.
The regulatory website operated by this entity—crasadr.com—offered applicants purported assistance with offshore bank setup, corporate formation, and the licensing of high-risk financial services. Digital infrastructure analysis further tied these operations together; one of Certa Payments’ former web domains shared a server with a dozen other domains, including rasd-state.ws, which served as the purported digital home for the Central Reserve Authority of the Western Sahara—a non-sovereign entity entirely unrecognized by the global community.
With the implementation of the U.K. economic sanctions and the freezing of its British-held financial pathways, the operational landscape for Cryptomus, Heleket, and their associated payment rails faces an unprecedented existential threat, effectively neutralizing a cornerstone of Russia’s wartime cryptocurrency laundering apparatus.
Nila Kartika Wati 
Dwi Wanna 
Laily UPN