The United Kingdom has officially levied economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that digital forensics experts say has operated as a massive conduit for payments linked to ransomware attacks, narcotics trafficking, darknet markets, online fraud, and cybercrime services. According to investigators, the platform’s operations have actively helped the Russian government circumvent existing international financial restrictions amid the ongoing war.
On October 8, the U.K. government issued formal sanctions targeting Cryptomus—which has previously operated under the corporate monikers Certa Payments and Xeltox Enterprises—for processing financial transactions that directly benefit the Russian state and its restricted financial institutions. The sweeping measures freeze any assets held by Cryptomus within British banks and legally bar any U.K.-based companies or individuals from conducting business with the platform, whether through virtual assets or traditional financial channels. Alongside Cryptomus, the U.K. government also targeted several other virtual payment platforms designed to obscure illicit money flows, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown underscores a growing international effort to choke off the financial infrastructure supporting illicit digital currency movements. As detailed in a December 2024 investigative report titled “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has long served as a primary payment processor for dozens of Russian cryptocurrency exchanges and underground websites hawking specialized cybercrime tools. Over the years, the company has repeatedly rebranded to evade regulatory scrutiny. Most recently, following a massive enforcement action by Canadian authorities, the platform morphed into a parallel service operating under the name “Heleket.”
Industry analysts say the U.K. actions strike at the heart of the complex financial plumbing that props up illicit economies worldwide. In an October 8 blog post, the prominent blockchain data-analytics firm Chainalysis emphasized that the new sanctions are explicitly designed to dismantle the infrastructure supporting Russia’s wartime economy.
Cryptomus and Heleket have emerged as major payment hubs for illicit activity, Chainalysis noted, pointing out that together, these interconnected services received more illicit funds across tracked categories than traditional cryptocurrency mixers in their dataset. Furthermore, the number of distinct illicit counterparties utilizing the platform surged to more than 900 in a single month during late 2025, illustrating the staggering scale of the operation.
Data compiled by the blockchain analysis firm TRM Labs in April 2026 revealed that since its inception in 2022, Cryptomus had processed more than $7 billion in overall transactions. This massive volume included funds directly tied to vendors distributing child sexual abuse material, international terrorist financing networks, and sophisticated human trafficking operations. TRM Labs also noted that Cryptomus experienced a temporary cratering in its transaction volume after it instituted formal “know your customer” (KYC) rules. However, rather than cleaning up its user base, the platform responded to regulatory pressure—specifically a record CAD $176 million fine levied by Canada in late 2025 for severe anti-money laundering violations—by launching Heleket as a parallel service that continued to offer completely no-KYC payment processing to its underground clientele.
Richard Sanders, an independent blockchain analyst and investigator who spent months mapping out the intricate payment infrastructure of Cryptomus and transacting directly with its customer base, stressed that the U.K. sanctions represent a critical escalation in international law enforcement. According to Sanders, Canada’s multi-million-dollar administrative fine was ultimately unenforceable and uncollectible in a practical sense, highlighting the limitations of financial penalties alone against shadowy online entities.
A fine doesn’t stop a cryptocurrency payment processor from processing payments, Sanders wrote in a public analysis shared on LinkedIn, emphasizing the distinct tactical advantage of punitive state action. Sanctions kill the operation. The distinction matters.
The anatomy of Cryptomus reveals a deeply obscured corporate structure. The platform’s original 2024 investigation by Krebs on Security revealed that Certa Payments, the parent company of Cryptomus, shared a registered business address in Vancouver, British Columbia, with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to have any actual physical presence at the location. Following the record Canadian fine for alleged money laundering violations, Cryptomus formally appealed the financial penalty while spinning up Heleket to ensure uninterrupted processing for high-risk and illegal transactions.
Sanders also noted that the U.K. sanctions are particularly notable because they mark the first known instance of a “Five Eyes” intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—imposing direct sanctions on a cryptocurrency operation that had previously been incorporated within another jurisdiction belonging to the same alliance.
The question of how entities like Cryptomus and Heleket manage to establish themselves and claim legitimacy to offer international financial services leads to a bizarre web of shell corporations and phantom regulators. Investigations into the platform’s origins point toward a network of fake financial institutions overseen by a phony regulatory body positioned in a territory that lacks widespread recognition as a sovereign nation.
The 2024 investigation uncovered that the sole shareholder of Certa Payments was a 25-year-old Ukrainian woman who simultaneously headed several other corporate entities. Among them was the WS Management and Advisory Corporation, an organization that actively bills itself as an exclusive regulatory body overseeing licensing for cryptocurrency enterprises, foreign exchange brokers, and online gaming businesses incorporated within the disputed region of northwestern Africa known as Western Sahara.
The official website of this supposed regulator, operating under the domain crasadr.com, claims to assist applicants with corporate bank setup, formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. Further tying the infrastructure together, one of Certa Payments’ former web properties shared a server hosting environment with twelve other distinct domains, including rasd-state.ws, which serves as the designated website for the Central Reserve Authority of the Western Sahara—the entity purportedly responsible for issuing licenses to these unregulated crypto and financial services.
