The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that blockchain and cybersecurity experts identify as a major financial conduit for ransomware payments, narcotics trafficking, darknet markets, fraud schemes, and cybercrime services. According to investigators, the platform’s operations have actively helped Russia circumvent existing international financial restrictions and maintain its wartime economy.
On October 8, the U.K. government formally issued sanctions targeting Cryptomus—which has previously operated under the names Certa Payments and Xeltox Enterprises—for processing high-volume transactions that directly benefit the Russian government and its financial institutions. The newly enacted sanctions freeze any assets held by Cryptomus at U.K. financial institutions and strictly bar British companies from engaging in any business dealings with the platform, whether virtual or otherwise. Alongside Cryptomus, the U.K. also targeted several other virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.
The designation builds upon prior investigative findings, including a December 2024 analysis titled "How Cryptocurrency Turns to Cash in Russian Banks," which documented how Cryptomus functioned as a critical payment processor for dozens of Russian cryptocurrency exchanges and websites peddling illicit cybercrime services. Since emerging on the digital landscape in 2022, the company has repeatedly rebranded to evade scrutiny. Most recently, it adopted the name "Heleket" following a record-breaking CAD $176 million fine levied by Canada in late 2025 for severe anti-money laundering violations.
Major blockchain intelligence firms have underscored the systemic importance of the U.K.’s actions. In an October 8 blog post, blockchain data-crunching firm Chainalysis emphasized that the sanctions strike directly at the broader financial infrastructure supporting Russia’s wartime operations.
"Cryptomus and Heleket have emerged as major payment hubs for illicit activity," Chainalysis wrote. "Together, these services received more illicit funds across tracked categories than the mixers in our dataset, and the number of illicit counterparties surged to more than 900 in a single month in late 2025."
Further illuminating the sheer scale of the platform’s illicit operations, an April 2026 report from blockchain analysis firm TRM Labs revealed that Cryptomus had processed more than $7 billion in transactions since its inception in 2022. This staggering volume included transactions tied to vendors of child sexual abuse material, terrorist financing networks, and human trafficking operations. TRM Labs also noted that while Cryptomus’s transaction volume initially cratered after the platform instituted new "know your customer" (KYC) rules, the network swiftly bypassed regulatory pressure by launching Heleket as a parallel service that continued to offer completely no-KYC payment processing.
Richard Sanders, a blockchain analyst and investigator who spent months mapping out Cryptomus’s intricate payment infrastructure and transacting with its customer base, stressed that the U.K. sanctions are vastly more impactful than prior penalties because Canada’s earlier sanctions and fines against the platform were ultimately unenforceable and uncollectible.
"A fine doesn’t stop a cryptocurrency payment processor from processing payments," Sanders wrote in a public post on LinkedIn. "Sanctions kill the operation. The distinction matters."
As previous investigations revealed, Cryptomus originally shared a physical Vancouver address with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to have any actual presence at the location. Following the imposition of Canada’s CAD $176 million fine for alleged money laundering violations, Cryptomus formally appealed the penalty while simultaneously spinning up Heleket as a parallel entity, allowing it to continue processing massive volumes of suspicious transactions without interruption.
Sanders also pointed out another historical milestone associated with the action, noting that these sanctions represent the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—sanctioning a cryptocurrency operation incorporated in another jurisdiction within the Five Eyes alliance.
The shadowy operational roots of entities like Cryptomus and Heleket raise critical questions regarding how such platforms derive their authority to offer international financial services. Investigations indicate that the framework relies heavily on fictitious financial institutions overseen by a phony regulatory body positioned within a region that lacks widespread recognition as a sovereign nation.
Earlier investigative findings uncovered that the sole shareholder of Cryptomus’s parent company, Certa Payments, was a 25-year-old Ukrainian woman. She concurrently headed several other corporate entities, including the WS Management and Advisory Corporation. This firm marketed itself as an exclusive regulatory body responsible for issuing licenses to cryptocurrency, foreign exchange, and online gaming businesses incorporated within the disputed territory of northwestern Africa known as Western Sahara.
The website associated with the regulatory front, crasadr.com, publicly claimed to assist applicants with bank setup, corporate formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. Furthermore, digital infrastructure analysis revealed that one of Certa Payments’ former domains shared a server with 12 distinct websites, including rasd-state.ws, which served as the purported online home for the Central Reserve Authority of the Western Sahara—the fictional entity that allegedly awarded operational licenses to these digital asset platforms.
