By Nila Kartika Wati 
The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that blockchain intelligence experts identify as a major international conduit for laundering ransomware proceeds, narcotics trafficking, darknet market revenues, financial fraud, and cybercrime services. According to investigators and national security analysts, the platform’s operations have actively assisted the Russian government and associated financial institutions in circumventing international financial restrictions imposed in the wake of the ongoing geopolitical conflict.
On October 8, the U.K. government formally issued sanctions targeting Cryptomus—which has previously operated under the corporate aliases Certa Payments and Xeltox Enterprises—for processing high volumes of transactions that directly benefit the Russian state and its financial apparatus. The newly enacted measures freeze any financial assets held by Cryptomus within British banking institutions and strictly prohibit domestic U.K. companies from conducting any form of business with the platform, whether virtual or otherwise. Alongside Cryptomus, the U.K. sanctions package also targeted several other digital payment platforms operating within the same illicit ecosystem, specifically naming VexPay, TokenSpot, and the Tsunami Payments service.
The targeting of Cryptomus highlights the growing urgency among Western governments to dismantle the specialized financial infrastructure that enables transnational cybercrime and sanctions evasion. As detailed in a December 2024 investigative report titled "How Cryptocurrency Turns to Cash in Russian Banks," Cryptomus has functioned for years as a vital payment processor for dozens of underground Russian cryptocurrency exchanges and websites dedicated to selling illicit cybercrime tools and services.
Operating since its emergence in 2022, the platform has repeatedly rebranded and altered its corporate facade to evade law enforcement scrutiny. Most recently, following a record-breaking CAD $176 million fine levied against the company by Canadian regulators in late 2025 for severe anti-money laundering violations, Cryptomus adopted the new moniker "Heleket" in an effort to distance itself from mounting regulatory penalties while maintaining its core business model.
Prominent blockchain analytics and data-crunching firm Chainalysis emphasized that the U.K. sanctions are designed to dismantle the broader underlying infrastructure supporting Russia’s wartime economy and underground cyber networks. In an October 8 blog post analyzing the government actions, Chainalysis noted that Cryptomus and its successor incarnation Heleket have rapidly evolved into premier payment hubs for illicit activities on a global scale. According to the firm’s blockchain tracking data, these interconnected services received a greater volume of illicit funds across tracked categories than traditional cryptocurrency mixers in their dataset, with the number of unique illicit counterparties surging to more than 900 in a single month during late 2025.
Further emphasizing the sheer scale of the platform’s illicit operations, a comprehensive intelligence report published in April 2026 by blockchain analysis firm TRM Labs revealed that Cryptomus had processed more than $7 billion in total transactions since its inception in 2022. This massive financial throughput included funds directly associated with vendors distributing child sexual abuse material, international terrorist financing networks, and sophisticated human trafficking operations.
TRM Labs also uncovered a distinct operational shift following regulatory pressure, noting that Cryptomus’s transaction volume experienced a sharp decline only after the platform instituted stricter "know your customer" or KYC compliance rules. Rather than reforming its practices permanently, the cryptocurrency platform responded to Canada’s multi-million-dollar fines by spinning up Heleket as a parallel operating service specifically designed to continue offering anonymous, no-KYC payment processing to high-risk clientele.
Richard Sanders, an experienced blockchain analyst and investigator who spent months meticulously mapping out Cryptomus’s intricate payment infrastructure and directly transacting with its customer base, stressed that the U.K. sanctions represent a critical turning point in international enforcement. According to Sanders, previous financial penalties—such as the massive fine issued by Canadian authorities—ultimately proved unenforceable and uncollectible in practical terms, leaving the underlying criminal enterprise largely operational.
Writing in a public analysis shared on LinkedIn, Sanders highlighted the fundamental difference between punitive fines and asset-freezing sanctions. A fine, he explained, does not inherently stop a determined cryptocurrency payment processor from continuing to process transactions, whereas comprehensive economic sanctions effectively terminate the operation. He noted that this strategic distinction is vital when dealing with borderless digital assets.
Sanders’ earlier investigative work closely mirrored findings from previous media reports, which revealed that Cryptomus originally shared a modest Vancouver office address with dozens of other foreign currency dealers and money transfer businesses, none of which maintained a physical presence at the location. Following the imposition of the CAD $176 million money laundering fine by Canada, Cryptomus formally appealed the penalty while simultaneously launching Heleket to ensure uninterrupted processing of suspicious transactions. Furthermore, Sanders pointed out that these sanctions mark a significant milestone as the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing direct economic sanctions on a cryptocurrency business incorporated within the jurisdiction of another Five Eyes partner.
The investigation into how entities like Cryptomus and Heleket manage to obtain the apparent legitimacy required to offer international financial services points to a labyrinthine network of shell companies and phony regulatory frameworks. Investigators tracing the origins of Cryptomus found that the sole shareholder of its parent company, Certa Payments, was a 25-year-old Ukrainian woman. Beyond her involvement with Cryptomus, she also headed several other corporate entities, including the WS Management and Advisory Corporation.
This corporate body bizarrely billed itself as an official regulatory authority exclusively responsible for overseeing licenses for cryptocurrency operations, foreign exchange brokers, and online gaming businesses incorporated within the disputed northwest African territory known as the Western Sahara.
The official website of this supposed regulatory body, operating under the domain crasadr.com, marketed services assisting prospective applicants with corporate bank setup, formation, online gaming licensing, and the establishment of foreign exchange brokerage firms. Digital infrastructure analysis further tied these operations together, revealing that one of Certa Payments’ former web domains shared a server hosting environment with twelve other distinct domains, including rasd-state.ws, which purported to be the official website for the Central Reserve Authority of the Western Sahara.
As international law enforcement agencies continue to adapt to the evolving tactics of cybercriminals and state-backed financial evaders, the coordinated U.K. sanctions signal a tightening net around the complex web of shell entities and unregulated digital payment processors that have long fueled illicit economies across the globe.
Sagoh 
Ammar Sabilarrohman 
Asro