Krebs on Security
The United Kingdom has imposed economic sanctions on Cryptomus, a versatile cryptocurrency platform identified by experts as a significant payment channel for ransomware, drugs, darknet marketplaces, fraud, and cybercrime operations that facilitate Russia's ability to bypass financial restrictions.
On October 8, the U.K. enacted sanctions against Cryptomus — formerly known as Certa Payments and Xeltox Enterprises — for processing transactions that financially benefit the Russian government and its financial institutions. These sanctions result in the freezing of any assets belonging to Cryptomus at U.K. banks and prohibit British companies from engaging in any business activities with it, whether virtual or otherwise. Additionally, the sanctions encompass the virtual payment platforms VexPay, TokenSpot, and the Tsunami Payments service.
A December 2024 investigation indicated that Cryptomus has been a pivotal payment processor for various Russian cryptocurrency exchanges and websites offering cybercrime services. Since its emergence in 2022, the platform has undergone several name changes, most recently adopting the name "Heleket" last year following a record CAD $176 million fine imposed by Canada for violations related to anti-money laundering.
According to blockchain analysis firm Chainalysis, the U.K. sanctions are aimed at disrupting the wider infrastructure that supports Russia's wartime economy.
"Cryptomus and Heleket have become prominent payment hubs for illicit activities," Chainalysis noted in an October 8 blog post. "Combined, these services received more illicit funds across tracked categories than the mixers in our dataset, and there was a marked increase in the number of illicit counterparties, surging to over 900 in a single month in late 2025."
In April 2026, TRM Labs, another blockchain analysis firm, reported that Cryptomus had processed transactions exceeding $7 billion since its launch in 2022. This volume included dealings linked to vendors of child sexual abuse material, networks financing terrorism, and operations involved in human trafficking.
TRM Labs observed that Cryptomus's transaction volume significantly declined after the implementation of new "know your customer" (KYC) regulations. In response to the Canadian penalties, the cryptocurrency platform initiated Heleket as a complementary service, which continued to offer payments without KYC requirements.
Richard Sanders, a blockchain analyst and investigator, dedicated significant time mapping Cryptomus's payment ecosystem and interacting with its clientele. He emphasized the significance of the U.K. sanctions on Cryptomus, noting that Canada’s sanctions had proven ultimately ineffective and unenforceable.
"A fine does not prevent a cryptocurrency payment processor from continuing operations," Sanders stated. "Sanctions effectively terminate the operation. This distinction is crucial."
As highlighted in the 2024 investigation, Cryptomus shared a Vancouver address with numerous other foreign currency dealers and money transfer businesses, none of which seemed to have a physical presence there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus contended the penalty, established Heleket as an ancillary service, and persisted in processing a high volume of questionable transactions, according to Sanders.
Sanders also pointed out that these sanctions are noteworthy as they mark the first instance of a "Five Eyes" country—comprising Australia, Canada, New Zealand, the U.K., and the U.S.—sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.
The sources of authority for entities like Cryptomus and Heleket to offer international financial services are reportedly linked to fictitious financial institutions regulated by a dubious governing body situated in a region not broadly recognized as a sovereign entity.
The investigation revealed that the sole shareholder of Cryptomus's parent company, Certa Payments, was a 25-year-old Ukrainian woman who simultaneously managed several other enterprises, including the WS Management and Advisory Corporation. This organization claims to be the exclusive regulatory body overseeing licenses for cryptocurrency, foreign exchange, and online gaming businesses established in the contested region known as Western Sahara.
The website for this entity—crasadr.com—indicates its role in assisting applicants with banking setup and formation, online gaming licenses, and the establishment and licensing of foreign exchange brokers. Furthermore, one of Certa Payments' previous websites was found to share server space with 12 other domains, one of which belonged to the Central Reserve Authority of Western Sahara.
Share this story