The United Kingdom imposed economic sanctions on cryptocurrency payment platform Cryptomus on October 8, targeting infrastructure accused of processing payments that benefit the Russian government and its financial institutions.
According to reporting by KrebsOnSecurity, the measures freeze Cryptomus assets held by UK banks and prohibit British companies from conducting business with the platform, whether through cryptocurrency or other channels.
The action covers Cryptomus, previously known as Certa Payments and Xeltox Enterprises. VexPay, TokenSpot and the Tsunami Payments service were also named. Researchers have separately linked Cryptomus to Heleket, a payment service presented as a parallel operation after Canadian authorities imposed a CAD 176 million anti-money-laundering fine.
A payment hub for Russian exchanges and illicit services
Cryptomus emerged in 2022 and became a payment processor for dozens of Russian cryptocurrency exchanges and websites selling cybercrime-related services, according to a KrebsOnSecurity investigation published in December 2024.
Blockchain analytics firms describe its activity as extending beyond sanctions evasion. In an October 8 assessment cited by the report, Chainalysis said Cryptomus and Heleket had developed into significant payment hubs for illicit transactions. Across the categories tracked by the company, the two services allegedly received more illicit funds than the cryptocurrency mixers in its dataset.
Chainalysis also counted more than 900 illicit counterparties interacting with the platforms during a single month in late 2025. Those figures are the analytics company’s findings rather than official UK transaction totals.
TRM Labs estimated in April 2026 that Cryptomus had processed more than USD 7 billion in transactions since launching in 2022. That amount represents overall transaction volume, not a claim that all USD 7 billion was illicit. TRM said it identified transactions connected to vendors of child sexual abuse material, terrorist-financing networks and human-trafficking operations.
According to the same assessment, transaction volume declined sharply after Cryptomus introduced know-your-customer checks. TRM said Heleket was subsequently launched as a parallel service offering payment processing without KYC requirements.
A Heleket support agent has denied on Telegram that the service is affiliated with Cryptomus. KrebsOnSecurity’s reporting disputes that denial based on the infrastructure and corporate evidence it examined.
Sanctions could disrupt settlement and access to funds
The immediate consequences fall on UK financial institutions and businesses. Banks holding covered assets are required by the described measures to freeze them, while British companies are barred from providing services to Cryptomus.
Customers and exchanges that depend on the platform could also encounter payment disruption. In a Telegram exchange on October 8, a Cryptomus support bot said the service had suddenly become unable to process transactions. The screenshot establishes a reported interruption at that moment, but not its wider scope or duration.
Blockchain investigator Richard Sanders, who said he spent months mapping the platform’s payment network and transacting with its customers, argued that the UK action could have more direct operational impact than the Canadian fine. “Sanctions kill the operation,” he wrote on LinkedIn.
Sanders said Cryptomus appealed the CAD 176 million penalty, launched Heleket and continued processing substantial transaction volumes. He also described the UK measure as the first known case in which one Five Eyes country sanctioned a cryptocurrency business incorporated in another Five Eyes jurisdiction. That characterization is Sanders’ assessment.
Corporate records point to an opaque operating structure
The December 2024 investigation found that Cryptomus shared a Vancouver address with numerous foreign-exchange dealers and money-transfer businesses that did not appear to operate physically from the location.
At the time of that investigation, Certa Payments’ sole shareholder was identified as a 25-year-old Ukrainian woman who also headed several other companies. One was WS Management and Advisory Corporation, which presented itself as a licensing regulator for cryptocurrency, foreign-exchange and online-gambling businesses incorporated in Western Sahara.
Its website, crasadr.com, advertised assistance with company formation, banking arrangements, gaming licences and foreign-exchange broker licensing. The former Certa Payments domain, certa[.]website, shared a server with 12 other domains, including rasd-state[.]ws, described in the investigation as belonging to the “Central Reserve Authority of the Western Sahara.”
KrebsOnSecurity assessed that the claimed authority behind these financial businesses appeared to depend on fabricated institutions and a purported regulator operating from a territory not widely recognised as a sovereign state. That conclusion is the publication’s analysis of the corporate and technical records it reviewed.
For UK banks and companies, the practical priority is to identify exposure to Cryptomus and the names Certa Payments and Xeltox Enterprises, as well as VexPay, TokenSpot and Tsunami Payments. Heleket should be treated as an alleged parallel service linked by researchers and investigators, rather than assumed to be a separate formally listed entity.
