U.K. Sanctions Cryptomus for Enabling Russian Money Laundering and Illicit Cybercrime Payments

U.K. Sanctions Cryptomus for Enabling Russian Money Laundering and Illicit Cybercrime Payments The United Kingdom has levied economic sanctions against the cryptocurrency platform Cryptomus for facilitating payments that benefit the Russian government, aid sanctions circumvention, and support extensive cybercrime operations. On October 8, the U.K. sanctioned Cryptomus alongside platforms VexPay, TokenSpot, and Tsunami Payments service, freezing U.K. bank assets and prohibiting British entities from conducting business with it. Cryptomus has operated under multiple identities, including Certa Payments, Xeltox Enterprises, and Heleket, the latter launched as a no-KYC parallel service after Canada imposed a CAD $176 million anti-money laundering fine. Forensic analysis shows Cryptomus processed over $7 billion in transactions since 2022, serving as a hub for child abuse material vendors, darknet markets, terrorist financing, and illicit funds exceeding tracked mixer volumes. Investigative reporting revealed Cryptomus relies on shell operations and claims licensing authority from a fabricated regulatory entity linked to the disputed Western Sahara region. U.K. Sanctions and Russia Circumvention The United Kingdom sanctioned Cryptomus on October 8 for handling transactions that bolster the Russian state and its financial apparatus amid sanctions evasion efforts. The measure freezes all Cryptomus assets held in U.K. banks and bars British companies from offering the platform commercial services. The sanctions also targeted virtual payment services VexPay, TokenSpot, and Tsunami Payments. Illicit Volumes and Rebranding Evading Enforcement TRM Labs identified more than $7 billion in transactions handled by Cryptomus since 2022, connecting the service to terrorist financing, human trafficking, and child sexual abuse material vendors. Chainalysis reported that Cryptomus and its spin-off Heleket accumulated more illicit funds across tracked categories than traditional mixers. After receiving an unenforceable CAD $176 million fine from Canada, Cryptomus set up Heleket to continue providing no-KYC payment rails for Russian crypto exchanges and cybercrime outlets. Precedent and Shady Corporate Licensing Analyst Richard Sanders noted the action represents the first instance of a Five Eyes nation sanctioning a cryptocurrency entity incorporated in another member's jurisdiction, pointing out that sanctions disable operations where uncollected fines failed. Investigations also showed Cryptomus used an unstaffed Vancouver address and derived purported regulatory authority from phony oversight bodies, including WS Management and Advisory Corporation, which claims to license financial operations in the disputed Western Sahara territory.

英国制裁加密支付平台Cryptomus，打击涉俄洗钱及网络犯罪网络 英国于10月8日对加密货币支付平台Cryptomus实施经济制裁，指控其为勒索软件、暗网市场、网络犯罪及俄罗斯绕过金融限制提供支付支持。该平台曾多次更名并规避监管，涉及数十亿美元的可疑交易。 英国冻结Cryptomus在英资产并禁止英企与其开展业务，VexPay、TokenSpot和Tsunami Payments亦在制裁名单中。 加拿大曾对该平台开出1.76亿加元反洗钱罚单，但Cryptomus随后推出无KYC要求的平行服务Heleket以规避监管。 区块链分析公司指出，Cryptomus自2022年以来处理超70亿美元交易，接收的非法资金量甚至超过受监测的混币器。 该平台涉嫌利用西撒哈拉等未获广泛承认地区的虚构监管机构和假冒金融牌照开展国际业务。 英国实施制裁与打击涉俄金融通道 10月8日，英国宣布对Cryptomus（曾用名Certa Payments和Xeltox Enterprises）实施经济制裁，冻结其在英资产并禁止英国公司与其交易。英国政府指控该平台处理有利于俄罗斯政府及其金融机构的支付款项。Chainalysis指出，此举旨在打击支撑俄罗斯战时经济的基础设施，同时受到制裁的还包括VexPay、TokenSpot和Tsunami Payments服务。 庞大非法资金规模与逃避监管策略 TRM Labs数据显示，Cryptomus自2022年成立以来累计处理超过70亿美元交易，涉及儿童性虐待材料、恐怖主义融资和人口贩运等。在加拿大因反洗钱违规对其处以1.76亿加元罚款后，Cryptomus将新推的合规要求架空，并上线了名为Heleket的平行服务继续提供免KYC处理。Chainalysis称，两家服务在2025年底单月非法交易对手曾激增至900多个，接收的非法资金规模超过了监测集内的所有混币器。 制裁力度对比与虚假监管链条 区块链调查员Richard Sanders指出，加拿大的罚款既无法强制执行也无法收回，而英国制裁则能有效封杀其运营，这也是“五眼联盟”国家首次制裁在另一五眼联盟司法管辖区注册的加密货币实体。调查显示，Cryptomus母公司的唯一股东为一名乌克兰女子，其名下机构声称作为监管实体为争议地区“西撒哈拉”的加密货币和博彩业务发放牌照，实际上是通过虚构监管与假冒机构为非法金融活动披上合规外衣。

The United Kingdom has issued economic sanctions against **Cryptomus**, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. On October 8, the U.K. [issued sanctions](https://assets.publishing.service.gov.uk/media/6ac767c6e8ef5609e7c93369/Sanctions_Notice__Russia__8_October_2026.pdf) (PDF) against Cryptomus — previously known as **Certa Payments** and **Xeltox Enterprises** — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms **VexPay**, **TokenSpot**, and the **Tsunami Payments service**. As explained in our December 2024 investigation, “[How Cryptocurrency Turns to Cash in Russian Banks](https://krebsonsecurity.com/2024/12/how-cryptocurrency-turns-to-cash-in-russian-banks/),” Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to “**Heleket**” last year after Canada levied [a record CAD $176 million fine](https://krebsonsecurity.com/2025/10/canada-fines-cybercrime-friendly-cryptomus-176m/) against the platform for anti-money laundering violations. The blockchain data-crunching firm **Chainalysis** said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy. “Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis [wrote](https://www.chainalysis.com/blog/uk-sanctions-cryptomus-heleket-tokenspot/) in an October 8 blog post. “Together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.” In April 2026, the blockchain analysis firm **TRM Labs** [found](https://www.trmlabs.com/resources/intel-library/cryptomus) Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations. TRM noted that Cryptomus’s transaction volume cratered after the platform instituted new “know your customer” or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing. **Richard Sanders** is a blockchain analyst and investigator who spent months mapping out Cryptomus’s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada’s fine against the platform was ultimately unenforceable and uncollectible. “A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders [wrote on LinkedIn](https://lnkd.in/p/e4EkbB-x). “Sanctions kill the operation. The distinction matters.” As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said. Sanders said the sanctions also are notable because they are the first known instance of a “Five Eyes” country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction. Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation. Our 2024 investigation found the sole shareholder of Cryptomus’s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the **WS Management and Advisory Corporation**, which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the **Western Sahara**. That entity’s website — crasadr.com — says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former sites — certa\[.\]website — also shared a server with 12 other domains, including rasd-state\[.\]ws, a website for the Central Reserve Authority of the Western Sahara.