The United Kingdom has issued sweeping economic sanctions against Cryptomus, a volatile and shifting cryptocurrency platform that cybersecurity and blockchain experts describe as a primary pipeline for illicit payments. According to investigators, the platform handles transactions related to ransomware, narcotics trafficking, darknet markets, fraud schemes, and specialized cybercrime services, effectively helping Russia bypass international financial restrictions and maintain its wartime economy.
On October 8, the U.K. government officially enacted sanctions against Cryptomus, which has previously operated under the corporate names Certa Payments and Xeltox Enterprises. The punitive measures target the platform for processing financial transactions that directly benefit the Russian government and its allied financial institutions. Under the terms of the U.K. sanctions, any assets held by Cryptomus within British banking institutions are immediately frozen, and domestic companies are strictly prohibited from conducting any business with the platform, whether through virtual assets or traditional financial channels. In addition to Cryptomus, the U.K. sanctions also target several other associated virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive industry investigations into how digital assets are funneled into traditional financial systems. Cryptomus has long served as a crucial payment processor for dozens of Russian cryptocurrency exchanges and online storefronts openly hawking cybercrime tools and services. The platform has demonstrated a remarkable ability to adapt and evade regulatory pressure, cycling through multiple name changes since its emergence in 2022. Most recently, the network adopted the moniker "Heleket" last year, a rebranding move that followed a record-setting CAD $176 million fine levied against the platform by Canadian authorities for severe anti-money laundering violations.
Major blockchain intelligence firms have emphasized the systemic importance of the U.K.’s actions. Chainalysis, a prominent blockchain data-analytics company, noted that the sanctions strike directly at the core infrastructure supporting Russia’s financial maneuvering amid international isolation. In an October 8 blog post analyzing the move, Chainalysis pointed out that Cryptomus and its parallel incarnation, Heleket, have rapidly scaled into massive payment hubs for illicit activity. According to the firm’s data tracking, these services received more illicit funds across monitored crime categories than the digital currency mixers present in their datasets, with the number of illicit counterparties surging past 900 in a single month during late 2025.
Further illuminating the vast scale of the platform’s operations, blockchain analysis firm TRM Labs reported in April 2026 that Cryptomus had processed more than $7 billion in total transactions since its inception in 2022. This staggering volume included transactions linked to severe criminal enterprises, such as vendors distributing child sexual abuse material, international terrorist financing networks, and human trafficking operations. TRM Labs also observed that while Cryptomus experienced a temporary cratering in transaction volume after instituting stricter "know your customer" (KYC) rules, the platform quickly pivoted in response to Canadian penalties by launching Heleket as a parallel service designed to continue processing payments without enforcing any KYC verifications.
Richard Sanders, a veteran blockchain analyst and investigator who spent months mapping out the intricate payment infrastructure of Cryptomus and transacting directly with its customer base, stressed that the U.K. sanctions represent a critical turning point. Sanders noted that while Canada’s earlier financial penalties were historic, they ultimately proved unenforceable and uncollectible in practice, allowing the illicit operations to persist unabated.
Writing on LinkedIn, Sanders emphasized the distinct difference in regulatory enforcement tools, stating that fines alone do not stop cryptocurrency payment processors from operating, whereas comprehensive sanctions effectively dismantle the underlying infrastructure. He argued that the distinction is vital for understanding how to curb transnational cybercrime.
During earlier investigations, researchers uncovered that Cryptomus initially shared a physical address in Vancouver with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to maintain an actual physical presence at the location. Following the imposition of Canada’s CAD $176 million fine for alleged money laundering violations, the platform appealed the monetary penalty while simultaneously launching Heleket to maintain its high-volume processing of questionable transactions.
Furthermore, Sanders highlighted that the U.K. sanctions are historically significant because they mark the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—imposing direct sanctions on a cryptocurrency operation incorporated within another Five Eyes jurisdiction.
The investigation into Cryptomus and Heleket also exposes bizarre structural anomalies regarding how such entities establish legal authority to offer international financial services. The operational backbone appears to rely heavily on fabricated financial institutions overseen by a phony regulatory body positioned within a region that lacks widespread recognition as a sovereign nation.
Prior investigative findings revealed that the sole shareholder of Cryptomus’s parent company, Certa Payments, was a 25-year-old Ukrainian woman. This individual simultaneously headed several other corporate entities, including the WS Management and Advisory Corporation. This firm prominently marketed itself as an exclusive regulatory body responsible for issuing licenses to cryptocurrency operations, foreign exchange brokers, and online gaming businesses incorporated within the disputed territory of Western Sahara located in northwest Africa.
The regulatory body’s primary website, crasadr.com, openly claimed to assist applicants with corporate formation, banking setups, online gaming permits, and the licensing of foreign exchange brokers. Digital forensic checks further connected these operations, revealing that one of Certa Payments’ former web domains shared a server with twelve other domains, including rasd-state.ws, which served as the official website for the purported Central Reserve Authority of the Western Sahara.
