By Nila Kartika Wati 
The United Kingdom has levied sweeping economic sanctions against Cryptomus, a chameleon-like cryptocurrency payment platform that cybersecurity and blockchain experts describe as a critical conduit for ransomware payments, narcotics trafficking, darknet market operations, fraud, and cybercrime services. According to investigators, the platform’s illicit financial plumbing has played an instrumental role in helping Russia circumvent international financial restrictions tied to its wartime economy.
On October 8, the U.K. government officially issued sanctions against Cryptomus—which has previously operated under the corporate aliases Certa Payments and Xeltox Enterprises—for processing transactions that directly benefit the Russian government and its allied financial institutions. The newly enacted measures freeze any financial assets held by Cryptomus within British banking institutions and strictly prohibit U.K. companies and citizens from conducting business with the platform, whether through virtual assets or traditional financial channels. Alongside Cryptomus, the U.K. also targeted several other virtual payment platforms operating within the same illicit ecosystem, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive tracking by international blockchain analysts. In a December 2024 investigation titled "How Cryptocurrency Turns to Cash in Russian Banks," security researchers detailed how Cryptomus functioned as a foundational payment processor for dozens of Russian cryptocurrency exchanges and underground websites peddling cybercrime-as-a-service offerings. Since emerging onto the digital underground in 2022, the platform has frequently altered its corporate identity to evade law enforcement and regulatory scrutiny. Most recently, the platform rebranded to "Heleket" following a record-breaking CAD $176 million fine levied against it by Canadian authorities in October 2025 for severe anti-money laundering violations.
Blockchain data analytics firm Chainalysis noted that the U.K. sanctions are a strategic blow aimed at dismantling the broader infrastructure underpinning Russia’s wartime financial networks. In an October 8 blog post analyzing the move, Chainalysis stated that Cryptomus and its parallel incarnation Heleket had evolved into premier payment hubs for illicit transactions. According to the firm’s dataset, these services collectively processed more illicit funds across tracked categories than traditional cryptocurrency mixers, with the number of illicit counterparties surging past 900 in a single month during late 2025.
Additional findings from blockchain intelligence firm TRM Labs in April 2026 revealed that Cryptomus had processed more than $7 billion in cumulative transactions since its inception in 2022. This staggering volume included significant financial flows associated with vendors distributing child sexual abuse material, international terrorist financing networks, and human trafficking operations. TRM Labs observed that while Cryptomus experienced a temporary cratering in transaction volume after implementing mandatory "know your customer" (KYC) rules, the platform quickly adapted to regulatory pressure by launching Heleket as a parallel service designed to continue uninhibited, no-KYC payment processing.
Richard Sanders, a prominent blockchain analyst and investigator who spent months mapping Cryptomus’s intricate payment infrastructure and directly transacting with its user base, emphasized the vital distinction between regulatory fines and targeted economic sanctions. Sanders noted that while Canada’s historic penalty against the platform was a significant regulatory statement, it ultimately proved unenforceable and uncollectible in practice.
Writing on professional networks, Sanders explained that a financial penalty alone does not prevent a sophisticated cryptocurrency payment processor from continuing its day-to-day operations. In contrast, comprehensive government sanctions effectively cripple the operational capacity of such entities by cutting them off from legitimate financial systems, marking a fundamental difference in law enforcement outcomes.
The initial 2024 investigation into Cryptomus revealed that the company had previously shared a registered address in Vancouver with dozens of other foreign currency dealers and money transfer businesses, none of which appeared to maintain any physical presence at the location. Following the imposition of Canada’s CAD $176 million fine for money laundering violations, Cryptomus reportedly appealed the penalty, spun up Heleket to circumvent restrictions, and maintained a high volume of suspicious transactions.
Furthermore, Sanders highlighted that the U.K. sanctions represent a historic milestone in international enforcement: they mark the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing direct economic sanctions on a cryptocurrency enterprise incorporated within another member of the Five Eyes alliance.
The persistent question surrounding entities like Cryptomus and Heleket has long centered on how such operations derive the apparent authority to offer international financial services. Investigators uncovered that the answer lies in a web of fictitious financial institutions overseen by a phony regulatory body situated within a disputed territory in northwest Africa that lacks widespread recognition as a sovereign nation.
The 2024 investigation established that the sole shareholder of Certa Payments, the parent company of Cryptomus, was a 25-year-old Ukrainian woman. She simultaneously served as the head of several other corporate entities, including the WS Management and Advisory Corporation. This organization marketed itself as an exclusive regulatory body responsible for overseeing licensing for cryptocurrency exchanges, foreign exchange brokers, and online gaming businesses incorporated in the disputed region of Western Sahara.
The regulatory body’s official website, crasadr.com, explicitly advertised services helping applicants with corporate formation, bank setup, online gaming licenses, and the creation of foreign exchange brokerages. Digital infrastructure analysis revealed further connections; one of Certa Payments’ former web domains shared a server with twelve other domains, including rasd-state.ws, which served as the official online portal for the Central Reserve Authority of the Western Sahara.
As international scrutiny intensifies and governments deploy severe economic measures to sever these digital lifelines, platforms like Cryptomus and Heleket face an increasingly hostile global landscape that threatens their ability to move illicit funds across borders.
Sagoh 
Dwi Wanna 
Laily UPN