The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that blockchain analysis firms and security experts say operates as a major conduit for ransomware payments, narcotics trafficking, darknet markets, fraud, and cybercrime services. According to investigators, the platform’s infrastructure has played a critical role in helping Russian entities and the broader Russian wartime economy circumvent existing international financial restrictions.
On October 8, the U.K. government announced formal sanctions targeting Cryptomus—which has previously operated under the corporate names Certa Payments and Xeltox Enterprises. The sanctions are designed to cripple the platform’s financial capabilities by freezing any assets held by Cryptomus at British banks and strictly barring UK-based companies from engaging in any business dealings with the firm, whether virtual or otherwise. Alongside Cryptomus, the U.K. government also targeted several other virtual payment platforms intimately connected to its operations, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive investigative reporting, including a December 2024 investigation by KrebsOnSecurity titled “How Cryptocurrency Turns to Cash in Russian Banks.” That reporting revealed that Cryptomus served as a vital payment processor for dozens of Russian cryptocurrency exchanges and underground websites hawking specialized cybercrime services. Since emerging in 2022, the company has repeatedly changed its corporate identity and branding to evade regulatory scrutiny. Most recently, the platform launched a parallel service under the name “Heleket” after Canadian authorities levied a record-breaking CAD $176 million fine against Cryptomus for severe anti-money laundering violations in October 2025.
Industry experts emphasize that the U.K. sanctions target the foundational infrastructure supporting illicit financial flows tied to Russia. Prominent blockchain data-crunching firm Chainalysis weighed in on the development, noting the immense scale of illicit activity moving through these platforms. In an October 8 blog post, Chainalysis stated that Cryptomus and Heleket had emerged as major payment hubs for illicit activity, pointing out that together, these services received more illicit funds across tracked categories than the cryptocurrency mixers in their dataset. Furthermore, Chainalysis observed that the number of illicit counterparties interacting with the platform surged to more than 900 in a single month in late 2025.
Data from other blockchain intelligence providers underscores the staggering volume of questionable funds processed by the network. In April 2026, TRM Labs published findings indicating that Cryptomus had processed more than $7 billion in transactions since its inception in 2022. This enormous volume included substantial transaction flows associated with dangerous illicit enterprises, such as vendors distributing child sexual abuse material, terrorist financing networks, and human trafficking operations.
TRM Labs also noted a distinct shift in the platform’s operations over time. Cryptomus’s overall transaction volume experienced a sharp downturn after the platform instituted new “know your customer” or KYC verification rules. However, rather than cleaning up its user base, the cryptocurrency platform responded to regulatory pressure and Canadian fines by launching Heleket as a parallel service. This new iteration continued to operate with minimal friction by offering no-KYC payment processing to its high-risk clientele.
Richard Sanders, a blockchain analyst and investigator who spent months mapping out Cryptomus’s intricate payment infrastructure and directly transacting with its customers, emphasized the vital distinction between regulatory fines and economic sanctions. According to Sanders, the U.K. sanctions on Cryptomus are particularly important because Canada’s massive financial penalty against the platform was ultimately unenforceable and uncollectible.
Writing on LinkedIn, Sanders noted that a financial fine alone does not stop a dedicated cryptocurrency payment processor from continuing to process transactions, whereas sanctions effectively kill the underlying operation. He stressed that this distinction matters deeply in the fight against transnational cybercrime.
As detailed in previous investigations, Cryptomus originally shared a registered address in Vancouver with dozens of other foreign currency dealers and money transfer businesses—none of which appeared to have any physical presence at the location. Following the imposition of the CAD $176 million fine for alleged money laundering violations, Cryptomus formally appealed the penalty while simultaneously launching Heleket to maintain its lucrative stream of sketchy transactions.
Sanders also highlighted another notable aspect of the U.K. action, pointing out that it represents the first known instance of a “Five Eyes” nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—imposing direct sanctions on a cryptocurrency operation incorporated within the jurisdiction of another Five Eyes partner.
The investigation into Cryptomus has continually raised questions regarding how such shadowy entities derive the authority to offer international financial services in the first place. The answer appears to lead back to a web of fake financial institutions overseen by a phony regulatory body positioned in a territory that lacks widespread recognition as a sovereign nation.
Earlier investigative findings revealed that the sole shareholder of Cryptomus’s parent company, Certa Payments, was a 25-year-old Ukrainian woman. This individual also headed several other corporate entities, including the WS Management and Advisory Corporation. This organization billed itself as an exclusive regulatory body that oversaw licenses for cryptocurrency, foreign exchange, and online gaming businesses incorporated in the disputed region of northwestern Africa known as the Western Sahara.
The website for that regulatory entity, crasadr.com, publicly claimed to assist applicants with corporate bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. Further technical analysis linked these operations directly to the platform’s infrastructure; one of Certa Payments’ former web properties shared a server with twelve other domains, including rasd-state.ws, which served as the official website for the Central Reserve Authority of the Western Sahara.
