The United Kingdom has issued financial sanctions against Cryptomus, a chameleonic cryptocurrency phase that experts say serves as a important conduit for payments connected to ransomware, narcotics, darknet markets, fraud and cybercrime services that are assisting Russia circumvent existing financial restrictions.
Heleket’s assistance delegate on Telegram claims, notwithstanding all evidence to the contrary, that it is not affiliated alongside Cryptomus. Image: Richard Sanders.
On October 8, the U.K. issued sanctions (PDF) against Cryptomus — earlier known as Certa Payments and Xeltox Enterprises — for handling payments that advantage the Russian authorities and its financial institutions. The sanctions freeze any Cryptomus resources at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual fee platforms VexPay, TokenSpot, and the Tsunami Payments service.
As explained in our December 2024 investigation, “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has been a key fee processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The business has changed its name multiple times since emerging in 2022, most lately to “Heleket” final twelvemonth following Canada levied a document CAD $176 myriad fine against the phase for anti-money laundering violations.
The blockchain data-crunching resolute Chainalysis stated the U.K. sanctions mark the broader infrastructure supporting Russia’s wartime economy.
“Cryptomus and Heleket have emerged as important fee hubs for illicit activity,” Chainalysis wrote in an October 8 blog post. “Together, these services received additional illicit finances throughout tracked categories than the mixers in our dataset and the figure of illicit counterparties surged to additional than 900 in a sole duration in delayed 2025.”
The Cryptomus assistance bot on Telegram, responding on Oct. 8 to an enquiry by saying the phase was abruptly unable to procedure transactions.
In April 2026, the blockchain inspection resolute TRM Labs found Cryptomus had processed additional than $7 milliard in transactions since its inception in 2022, including transactions connected alongside kid intimate abuse matter vendors, extremist financing networks, and individual trafficking operations.
TRM noted that Cryptomus’s transaction quantity cratered following the phase instituted new “know your customer” or KYC rules, and that the cryptocurrency phase responded to the Canadian fines by launching Heleket as a parallel assistance that continued to recommendation no-KYC fee processing.
Richard Sanders is a blockchain expert and investigator who spent months mapping out Cryptomus’s fee infrastructure and transacting alongside its customers. Sanders stated the U.K. sanctions on Cryptomus are crucial since Canada’s sanctions against the phase were ultimately unenforceable and uncollectible.
“A fine doesn’t halt a cryptocurrency fee processor from handling payments,” Sanders wrote on LinkedIn. “Sanctions slay the operation. The difference matters.”
As our 2024 inquiry noted, Cryptomus shared a Vancouver location alongside dozens of another abroad prosperity dealers and prosperity transfer businesses — none of which appeared to be physically located there. Following the CAD $176 myriad fine for alleged prosperity laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on handling ample volumes of sketchy transactions, Sanders said.
Sanders stated the sanctions additionally are notable since they are the archetypal known case of a “Five Eyes” nation (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency procedure unified in another Five Eyes jurisdiction.
Where do entities akin Cryptomus and Heleket get their authority to recommendation global financial services? The answer appears to affect counterfeit financial institutions overseen by a phony regulatory build positioned in a nation that is not extensively recognized as a sovereign nation.
Our 2024 inquiry established the sole shareholder of Cryptomus’s genitor business Certa Payments was a 25-year-old Ukrainian female who additionally headed multiple another firms, including the WS Management and Advisory Corporation, which bills itself as the regulatory build that exclusively oversees licenses for cryptocurrency, abroad toggle and online gaming businesses unified in the disputed area in northwest Africa known as the Western Sahara.
That entity’s website — crasadr.com — says it assists applicants alongside financial institution setup and formation, online gaming licenses, and the innovation and licensing of abroad toggle brokers. One of Certa Payments’ erstwhile sites — certa[.]website — additionally shared a server alongside 12 another domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.
The website crasadr dot com, the authoritative website of the Central Reserve Authority of Western Sahara, which lists the entities awarded licenses for cryptocurrencies, gaming and abroad toggle services.
