The United Kingdom has launched a significant economic crackdown against Cryptomus, an adaptable and elusive cryptocurrency platform that cybersecurity experts say acts as a primary conduit for illegal payments. According to investigators, the platform facilitates ransomware payouts, narcotics trafficking, darknet market transactions, financial fraud, and cybercrime services that actively help the Russian government circumvent international financial restrictions and sustain its wartime economy.
On October 8, the U.K. government officially issued strict economic sanctions targeting Cryptomus—which has previously operated under the corporate names Certa Payments and Xeltox Enterprises. The sanctions are designed to penalize the platform for processing financial transactions that directly benefit the Russian state and its associated financial institutions. Under the terms of the UK measures, any assets held by Cryptomus within British banks are immediately frozen, and domestic companies are strictly prohibited from conducting any form of business with the platform, whether virtual or otherwise. Alongside Cryptomus, the U.K. also targeted several other virtual payment platforms and services, including VexPay, TokenSpot, and the Tsunami Payments service.
The recent British action builds upon a growing body of international scrutiny. An extensive December 2024 investigative report titled “How Cryptocurrency Turns to Cash in Russian Banks” revealed that Cryptomus served as a crucial payment processor for dozens of Russian cryptocurrency exchange platforms and underground websites trafficking in cybercrime tools and services. Emerging in 2022, the company routinely changed its corporate identity to evade law enforcement and regulatory bodies. Most recently, the platform rebranded itself as “Heleket” following a historic regulatory enforcement action by Canada in late 2025, which slapped the cryptocurrency outfit with a record CAD $176 million fine for severe violations of anti-money laundering laws.
Major blockchain intelligence and data analytics firms have emphasized the broader geopolitical significance of the British sanctions. In an October 8 blog post, Chainalysis noted that the measures directly strike at the vital financial infrastructure supporting Russia’s wartime operations. According to Chainalysis, Cryptomus and its rebranded parallel service Heleket quickly evolved into premier payment hubs for illicit digital asset activity. The blockchain tracking firm reported that these combined services received more illicit funds across tracked categories than the traditional cryptocurrency mixers present in their datasets, with the number of illicit counterparties surging past 900 in a single month during late 2025.
Independent blockchain data from TRM Labs in April 2026 further underscored the sheer scale of the network’s operations, showing that Cryptomus had processed more than $7 billion in total transactions since its inception four years prior. This staggering volume included significant transaction flows tied to vendors distributing child sexual abuse material, international terrorist financing networks, and cross-border human trafficking operations. TRM Labs observed that while Cryptomus experienced a temporary cratering in its transaction volume after implementing mandatory “know your customer” (KYC) rules, the organization swiftly sidestepped compliance by launching Heleket as a parallel service that continued to process transactions without any KYC checks.
Richard Sanders, a veteran blockchain analyst and investigator who spent months painstakingly mapping out the hidden infrastructure of Cryptomus and transacting with its customer base, pointed out that the British sanctions mark a critical turning point because previous regulatory efforts—such as Canada’s massive financial penalty—proved largely unenforceable and uncollectible. Writing on LinkedIn, Sanders emphasized the stark contrast between civil penalties and sovereign sanctions, noting that fines ultimately fail to stop a determined crypto payment processor, whereas comprehensive sanctions effectively dismantle the operation.
Sanders also highlighted the unprecedented nature of the U.K. action, noting it is the first known instance of a “Five Eyes” intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—placing formal sanctions on a cryptocurrency operation incorporated within the jurisdiction of another member state.
The investigation into how Cryptomus and Heleket acquired the legal authority to offer international financial services points to a labyrinthine network of fake financial institutions and phantom regulatory bodies situated in obscure regions. Investigations revealed that the sole shareholder of Certa Payments, the parent company of Cryptomus, was a 25-year-old Ukrainian woman who simultaneously managed several other corporate entities. Among them was the WS Management and Advisory Corporation, an organization that marketed itself as an exclusive regulatory body overseeing licensing for cryptocurrency, foreign exchange, and online gaming businesses incorporated within the disputed northwest African territory of Western Sahara.
Websites linked to this corporate web, such as the portal crasadr.com operated by the Central Reserve Authority of the Western Sahara, explicitly claimed to assist applicants with corporate bank setup, formation, online gaming licenses, and foreign exchange broker licensing. Furthermore, historical digital infrastructure links revealed that one of Certa Payments’ former web domains shared a server with over a dozen other sites, including rasd-state.ws, which purported to be the official online presence of the Central Reserve Authority of Western Sahara, completing a shell game designed to project legitimate regulatory authority while quietly fueling an international cybercrime economy.
