The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that blockchain intelligence experts and law enforcement authorities say functions as a critical financial conduit for ransomware operations, narcotics trafficking, darknet markets, and advanced cybercrime services. According to investigators, the platform’s illicit payment rails have played a major role in helping the Russian government and associated financial institutions actively circumvent existing international financial restrictions and economic sanctions.
On October 8, the U.K. government formally issued sanctions targeting Cryptomus—which has operated previously under various corporate guises, including Certa Payments and Xeltox Enterprises—for processing high-volume transactions that directly benefit the Russian state and its financial apparatus. The newly enacted measures freeze any financial assets held by Cryptomus within British banking institutions and legally bar UK-based companies from engaging in any commercial business with the platform, whether virtual or otherwise. Alongside Cryptomus, the U.K. government also targeted several other associated virtual payment platforms in the sanctions package, specifically naming VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive investigative reporting, notably highlighted in a December 2024 investigation titled “How Cryptocurrency Turns to Cash in Russian Banks,” which revealed that Cryptomus had established itself as an indispensable payment processor for dozens of Russian cryptocurrency exchanges and underground websites hawking cybercrime-as-a-service tools. To evade law enforcement and regulatory pressure, the company has engaged in a pattern of frequent rebranding since emerging in 2022. Most recently, the platform shifted its operations to a successor brand known as “Heleket” following a record-breaking CAD $176 million administrative fine levied against it by Canadian regulators for severe anti-money laundering violations.
Major blockchain data-crunching and analytics firm Chainalysis noted that the U.K.’s targeted sanctions strike directly at the broader financial infrastructure sustaining Russia’s wartime economy. In an October 8 blog post analyzing the policy shift, Chainalysis stated that Cryptomus and its successor incarnation Heleket have rapidly evolved into primary payment hubs for a vast array of illicit financial activity. According to the firm’s data tracking, these interconnected services received a greater volume of illicit funds across tracked categories than traditional cryptocurrency mixers during comparable periods, with the number of unique illicit counterparties surging past 900 in a single month in late 2025.
Independent blockchain intelligence and investigative firms have similarly documented the staggering scale of the platform’s illicit throughput. In April 2026, TRM Labs published findings indicating that Cryptomus had successfully processed more than $7 billion in cumulative cryptocurrency transactions since its inception in 2022. That enormous transaction volume included funds directly linked to distributors of child sexual abuse material, international terrorist financing networks, and sophisticated human trafficking operations.
TRM Labs further observed that Cryptomus experienced a temporary cratering in its transaction volume after the platform instituted stricter “know your customer” or KYC identity verification rules. However, rather than cleaning up its operations, the platform responded to Canada’s multi-million-dollar enforcement action by spinning up Heleket as a parallel service designed to bypass regulatory oversight and continue offering unrestricted, no-KYC payment processing to high-risk actors.
Richard Sanders, a veteran blockchain analyst and investigator who spent months mapping out the intricate payment infrastructure of Cryptomus and transacting directly with its customer base, emphasized that the U.K. economic sanctions mark a vital turning point in international enforcement. Sanders pointed out that while Canada’s historic fine against the platform was a notable regulatory milestone, it ultimately proved to be unenforceable and uncollectible in practical terms.
Writing on LinkedIn following the announcement, Sanders explained that a financial fine alone does not stop a dedicated cryptocurrency payment processor from continuing to process transactions, whereas formal government sanctions effectively dismantle the underlying operation. He noted that the distinction is critically important when dealing with evasive cybercrime infrastructure.
As prior investigations into the corporate footprint of Cryptomus revealed, the platform originally shared a registered address in Vancouver, Canada, with dozens of other foreign currency dealers and money transfer businesses—none of which maintained any actual physical presence at the location. Following the imposition of Canada’s CAD $176 million fine for alleged money laundering violations, Cryptomus formally appealed the financial penalty while quietly launching Heleket as an operational duplicate, continuing to process vast quantities of suspicious transactions without interruption.
Furthermore, Sanders highlighted that the U.K. sanctions are particularly notable because they represent the first known instance of a “Five Eyes” intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—taking direct sanctioning action against a cryptocurrency operation originally incorporated within the jurisdiction of another fellow Five Eyes member.
A lingering question for international regulators has been how shadowy entities like Cryptomus and Heleket derive their apparent authority to offer international financial services in the first place. Investigations indicate that the answer involves a convoluted network of fake financial institutions overseen by a phony regulatory body positioned within a disputed territory in northwest Africa that lacks widespread international recognition as a sovereign nation.
An in-depth investigation revealed that the sole shareholder of Certa Payments, the parent company of Cryptomus, was a 25-year-old Ukrainian woman who simultaneously served as the head of several other corporate entities. Among these was the WS Management and Advisory Corporation, an organization that aggressively marketed itself as an exclusive regulatory body responsible for overseeing licenses for cryptocurrency operations, foreign exchange brokerages, and online gaming businesses supposedly incorporated within the disputed region of the Western Sahara.
The website operated by this entity, crasadr.com, advertised services assisting applicants with corporate bank setup, formation assistance, online gaming licenses, and the creation and licensing of foreign exchange brokers. Furthermore, digital infrastructure mapping revealed that one of Certa Payments’ former web properties, certa.website, shared a web hosting server with a dozen other domains, including rasd-state.ws, which served as the official online portal for the self-styled Central Reserve Authority of the Western Sahara.
