{"id":26314,"date":"2026-10-15T11:00:27","date_gmt":"2026-10-15T19:00:27","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/10\/15\/u-k-sanctions-cryptomus-for-ru-money-laundering\/"},"modified":"2026-10-15T11:00:27","modified_gmt":"2026-10-15T19:00:27","slug":"u-k-sanctions-cryptomus-for-ru-money-laundering","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/10\/15\/u-k-sanctions-cryptomus-for-ru-money-laundering\/","title":{"rendered":"U.K. Sanctions Cryptomus for RU Money Laundering"},"content":{"rendered":"

The United Kingdom has issued economic sanctions against Cryptomus<\/strong>, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.<\/p>\n

\"\"<\/p>\n

Heleket\u2019s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders.<\/p>\n<\/div>\n

On October 8, the U.K. issued sanctions<\/a> (PDF) against Cryptomus \u2014 previously known as Certa Payments<\/strong> and Xeltox Enterprises<\/strong> \u2014 for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms VexPay<\/strong>, TokenSpot<\/strong>, and the Tsunami Payments service<\/strong>.<\/p>\n

As explained in our December 2024 investigation, \u201cHow Cryptocurrency Turns to Cash in Russian Banks<\/a>,\u201d Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to \u201cHeleket<\/strong>\u201d last year after Canada levied a record CAD $176 million fine<\/a> against the platform for anti-money laundering violations.<\/p>\n

The blockchain data-crunching firm Chainalysis<\/strong> said the U.K. sanctions target the broader infrastructure supporting Russia\u2019s wartime economy.<\/p>\n

\u201cCryptomus and Heleket have emerged as major payment hubs for illicit activity,\u201d Chainalysis wrote<\/a> in an October 8 blog post. \u201cTogether, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.\u201d<\/p>\n

\"\"<\/a><\/p>\n

The Cryptomus support bot on Telegram, responding on Oct. 8 to an inquiry by saying the platform was suddenly unable to process transactions.<\/p>\n<\/div>\n

In April 2026, the blockchain analysis firm TRM Labs<\/strong> found<\/a> Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations.<\/p>\n

TRM noted that Cryptomus\u2019s transaction volume cratered after the platform instituted new \u201cknow your customer\u201d or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing.<\/span><\/p>\n

Richard Sanders<\/strong> is a blockchain analyst and investigator who spent months mapping out Cryptomus\u2019s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada\u2019s sanctions against the platform were ultimately unenforceable and uncollectible.<\/p>\n

\u201cA fine doesn\u2019t stop a cryptocurrency payment processor from processing payments,\u201d Sanders wrote on LinkedIn<\/a>. \u201cSanctions kill the operation. The distinction matters.\u201d<\/p>\n

As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses \u2014 none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said.<\/p>\n

Sanders said the sanctions also are notable because they are the first known instance of a \u201cFive Eyes\u201d country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.<\/p>\n

Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation.<\/p>\n

Our 2024 investigation found the sole shareholder of Cryptomus\u2019s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the WS Management and Advisory Corporation<\/strong>, which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the Western Sahara<\/strong>.<\/p>\n

That entity\u2019s website \u2014 crasadr.com \u2014 says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments\u2019 former sites \u2014 certa[.]website \u2014 also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.<\/p>\n

\"\"<\/p>\n

The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara, which lists the entities awarded licenses for cryptocurrencies, gaming and foreign exchange services.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

The United Kingdom has issued economic sanctions againstCryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.Heleket\u2019s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders.On October 8, the U.K.issued sanctions(PDF) <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10642],"tags":[],"class_list":["post-26314","post","type-post","status-publish","format-standard","hentry","category-krebs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26314"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26314\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26314"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}