UK Sanctions Crypto Platform Cryptomus for Facilitating Russian Financial Evasion
The United Kingdom has imposed sanctions on the cryptocurrency platform Cryptomus for its role in processing illicit payments linked to ransomware, darknet markets, and other cybercrime services that aid Russia in circumventing financial restrictions.
The United Kingdom has officially sanctioned Cryptomus, a cryptocurrency platform previously known as Certa Payments and Xeltox Enterprises, for its significant role in processing payments that benefit the Russian government and its financial institutions. This move, enacted on October 8th, freezes any assets Cryptomus holds within U.K. banks and prohibits British companies from engaging in any business with the platform. The sanctions also target other virtual payment platforms, including VexPay, TokenSpot, and Tsunami Payments, indicating a broader effort to disrupt illicit financial flows.
Cryptomus has been identified as a key payment processor for numerous Russian cryptocurrency exchanges and websites that offer cybercrime services. The platform has a history of rebranding, most recently changing its name to "Heleket" after facing a substantial fine in Canada for anti-money laundering violations. Chainalysis, a blockchain data analysis firm, highlighted that Cryptomus and its parallel service Heleket processed over 900 illicit counterparties in late 2025, receiving more illicit funds across tracked categories than mixers in their dataset.
Further analysis by TRM Labs in April 2026 revealed that Cryptomus had processed over $7 billion in transactions since its inception in 2022. This volume included transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations. Notably, TRM Labs observed a significant drop in Cryptomus's transaction volume after the platform implemented "know your customer" (KYC) rules, prompting the launch of Heleket as a no-KYC alternative.
Richard Sanders, a blockchain analyst, emphasized the significance of the U.K. sanctions, contrasting them with Canada's previous actions. Sanders noted that while Canada levied a fine, which is often unenforceable against such entities, sanctions effectively shut down operations. "A fine doesn't stop a cryptocurrency payment processor from processing payments," Sanders stated. "Sanctions kill the operation. The distinction matters."
The sanctions are also notable as they represent the first instance of a "Five Eyes" country (Australia, Canada, New Zealand, the U.K., and the U.S.) sanctioning a cryptocurrency operation incorporated within another Five Eyes jurisdiction. This suggests a heightened level of international cooperation and concern regarding the use of such platforms for illicit finance.
Investigations into Cryptomus's operational structure revealed a complex web involving shell companies and a purported regulatory body based in the disputed region of Western Sahara. The platform's parent company, Certa Payments, listed a 25-year-old Ukrainian woman as its sole shareholder, who also headed WS Management and Advisory Corporation. This entity claims to be the exclusive licensing and regulatory body for cryptocurrency, foreign exchange, and online gaming businesses incorporated in Western Sahara, operating through websites like crasadr.com.
This intricate setup, involving entities in unrecognized territories and a history of rebranding to evade regulatory scrutiny, underscores the challenges in combating illicit financial activities facilitated by cryptocurrency. The U.K.'s decisive action against Cryptomus signals a more aggressive stance by Western governments against platforms enabling financial evasion and supporting state-sponsored cybercrime.