On October 8, the United Kingdom issued economic sanctions against Cryptomus, a cryptocurrency platform previously known as Certa Payments and Xeltox Enterprises. The sanctions freeze any assets held by the company in U.K. banks and bar British entities from providing it with business services, whether virtual or otherwise. The regulatory action also extends to three other virtual payment platforms: VexPay, TokenSpot, and the Tsunami Payments service. Officials stated that these measures address the platform's processing of payments that benefit the Russian government and its financial institutions.
Experts describe Cryptomus as a chameleonic platform that has served as a primary conduit for illicit activities, including ransomware payments, narcotics trafficking, darknet market transactions, fraud, and cybercrime services. According to an investigation from December 2024, the company has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites selling cybercrime tools. Since emerging in 2022, the entity has changed its name multiple times, most recently rebranding as "Heleket" last year following a record CAD $176 million fine levied by Canada for anti-money laundering violations.
Blockchain analysis firm Chainalysis noted that the U.K. sanctions target the broader infrastructure supporting Russia's wartime economy. In an October 8 blog post, Chainalysis reported that Cryptomus and Heleket have become major hubs for illicit activity, receiving more illicit funds across tracked categories than mixers in their dataset. The firm observed that the number of illicit counterparties surged to over 900 in a single month during late 2025.
Separately, TRM Labs found in April 2026 that Cryptomus had processed more than $7 billion in transactions since its inception. These transactions were linked to vendors of child sexual abuse material, terrorist financing networks, and human trafficking operations. TRM Labs observed that the platform's transaction volume dropped significantly after it implemented new "know your customer" (KYC) rules. However, the firm noted that Cryptomus responded to the Canadian fines by launching Heleket as a parallel service that continued to offer payment processing without KYC requirements.
Richard Sanders, a blockchain analyst who spent months mapping the platform's infrastructure, emphasized the significance of these sanctions compared to previous penalties. Sanders argued that while Canada's fine was ultimately unenforceable and uncollectible, sanctions effectively kill the operation by cutting off its ability to process payments. He highlighted that this marks the first known instance of a "Five Eyes" country sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.
Investigations into the platform's regulatory authority revealed connections to fake financial institutions overseen by a phony regulatory body in a non-sovereign region. A 2024 inquiry found that the sole shareholder of Cryptomus's parent company, Certa Payments, is a 25-year-old Ukrainian woman who also heads WS Management and Advisory Corporation. This entity claims to exclusively oversee licenses for cryptocurrency, foreign exchange, and online gaming businesses in Western Sahara, a disputed region in northwest Africa. The website crasadr.com states it assists with bank setup and licensing, while Certa Payments' former domain shared a server with rasd-state.ws, the site for the Central Reserve Authority of the Western Sahara.
Sources: Krebs on Security.