The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a volatile and shifting cryptocurrency platform that cybersecurity experts describe as a major pipeline for payments tied to ransomware, illicit narcotics, darknet markets, fraud, and cybercrime services. According to investigators, these operations have actively assisted Russia in circumventing existing international financial restrictions established in the wake of its wartime economy.
On October 8, the U.K. government formally issued sanctions targeting Cryptomus—which has previously operated under the corporate aliases Certa Payments and Xeltox Enterprises—for processing transactions that directly benefit the Russian government and its financial institutions. The newly enacted sanctions freeze any assets held by Cryptomus within British banking institutions and strictly prohibit all British companies from engaging in any business dealings with the platform, whether virtual or traditional. In addition to Cryptomus, the U.K. action also targeted several other virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive tracking by the security and investigative community. As detailed in a December 2024 investigative report titled "How Cryptocurrency Turns to Cash in Russian Banks," Cryptomus has functioned as an essential payment processor for dozens of Russian cryptocurrency exchanges and websites openly peddling cybercrime services. Since emerging on the digital landscape in 2022, the company has repeatedly changed its corporate identity to evade law enforcement. Most recently, it adopted the moniker "Heleket" following a record-breaking CAD $176 million fine levied against the platform by Canadian authorities for severe anti-money laundering violations.
Blockchain data analytics firm Chainalysis noted that the U.K. sanctions are designed to dismantle the broader infrastructure underpinning Russia’s wartime financial networks. In an October 8 blog post, Chainalysis emphasized the scale of the illicit activity flowing through these channels, stating that Cryptomus and Heleket have rapidly evolved into major payment hubs for unlawful transactions. According to their metrics, these combined services received more illicit funds across tracked categories than the traditional cryptocurrency mixers present in their dataset, with the number of illicit counterparties surging past 900 in a single month during late 2025.
Earlier insights released in April 2026 by blockchain intelligence firm TRM Labs revealed that Cryptomus had processed more than $7 billion in transactions since its inception in 2022. This staggering volume included transactions linked to dangerous criminal enterprises, such as vendors distributing child sexual abuse material, terrorist financing networks, and international human trafficking operations. Furthermore, TRM Labs observed that while Cryptomus experienced a temporary cratering in transaction volume after instituting stricter "know your customer" (KYC) rules, the platform swiftly pivoted in response to Canadian penalties by launching Heleket as a parallel service that continued to offer completely unregulated, no-KYC payment processing.
Richard Sanders, a prominent blockchain analyst and investigator who spent months mapping out the intricate payment infrastructure of Cryptomus and transacting directly with its customer base, pointed out that the U.K. sanctions represent a vital escalation. He noted that Canada’s earlier financial penalties against the platform ultimately proved unenforceable and uncollectible. On LinkedIn, Sanders underscored the practical difference between fines and sanctions, noting that financial penalties alone cannot stop an active cryptocurrency payment processor, whereas official government sanctions effectively kill the operation.
The investigation into Cryptomus previously uncovered that the platform shared a registered Vancouver address with dozens of other foreign currency dealers and money transfer businesses, none of which appeared to maintain any physical presence at the location. Following the imposition of Canada’s massive CAD $176 million fine for alleged money laundering violations, Cryptomus opted to appeal the penalty, spun up Heleket as an alternative conduit, and maintained high volumes of high-risk transactions. Sanders also highlighted that these U.K. sanctions mark the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—sanctioning a cryptocurrency operation incorporated within another jurisdiction belonging to the same alliance.
A lingering question throughout the investigation of such platforms has been the legal and jurisdictional foundation from which entities like Cryptomus and Heleket derive their apparent authority to offer international financial services. Evidence uncovered during prior investigative work points to a convoluted network involving fictitious financial institutions overseen by a phony regulatory body positioned within a region that lacks widespread recognition as a sovereign nation.
Investigations revealed that the sole shareholder of Certa Payments—the parent company of Cryptomus—was a 25-year-old Ukrainian woman. She concurrently headed several other firms, including the WS Management and Advisory Corporation. This corporate entity actively markets itself as an exclusive regulatory body responsible for overseeing licenses for cryptocurrency, foreign exchange, and online gaming businesses incorporated within the disputed northwest African territory known as Western Sahara.
The website operated by this entity, crasadr.com, explicitly claims to assist applicants with corporate formation, banking setups, online gaming licenses, and the creation and licensing of foreign exchange brokers. Further tying the infrastructure together, one of Certa Payments’ former web properties shared a server with a dozen other domains, including rasd-state.ws, which serves as the designated website for the purported Central Reserve Authority of the Western Sahara—the entity responsible for issuing licenses to these shadow cryptocurrency and foreign exchange platforms.
