/
← Voltar ao feed
medium financial cryptocurrency

UK sanctions Cryptomus/Heleket and three payment platforms over crypto laundering that helps Russia evade sanctions

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 11:22 · coletado há 4 dias

On October 8, the U.K. imposed economic sanctions on Cryptomus (formerly Certa Payments and Xeltox Enterprises, rebranded as Heleket) for processing payments that benefit the Russian government and its financial institutions. The sanctions also cover the virtual payment platforms VexPay, TokenSpot and Tsunami Payments. Experts describe Cryptomus as a major conduit for payments tied to ransomware, narcotics, darknet markets, fraud and cybercrime services. The sanctions freeze Cryptomus assets at U.K. banks and bar British firms from doing business with it. Analyst Richard Sanders notes this is the first known case of a Five Eyes country sanctioning a crypto operation incorporated in another Five Eyes jurisdiction.

Detalhes técnicos

  • Chainalysis reported that Cryptomus and Heleket received more illicit funds across tracked categories than the mixers in its dataset, with illicit counterparties surging to more than 900 in a single month in late 2025.
  • TRM Labs found in April 2026 that Cryptomus had processed more than $7 billion since 2022, including flows linked to CSAM vendors, terrorist financing and human trafficking. Volume fell after KYC rules were introduced.
  • After Canada's record CAD $176 million AML fine, Cryptomus appealed and launched Heleket as a parallel no-KYC service. Heleket's Telegram support claims it is unaffiliated with Cryptomus.
  • The company shared a Vancouver address with dozens of other currency dealers that did not appear to be physically there.
  • The parent's sole shareholder was a 25-year-old Ukrainian woman who also headed WS Management and Advisory Corporation, which presents itself as the licensing regulator for Western Sahara (crasadr.com). A former Certa site (certa[.]website) shared a server with rasd-state[.]ws, a site for the Central Reserve Authority of the Western Sahara.
  • On October 8 the Cryptomus Telegram support bot said the platform was unable to process transactions.

Remediação

  • Financial institutions, exchanges and compliance teams should screen for and block exposure to Cryptomus, Heleket, VexPay, TokenSpot and Tsunami Payments, and monitor for rebranded successor services.
  • Treat the named entities as sanctions-relevant when assessing crypto payment flows and counterparties.

Linha do tempo

  1. krebsonsecurity.com ↗ · pub. 14/10/2026 11:22 · coletado 19/10 17:55 primeiro registro

    UK sanctions Cryptomus/Heleket and three payment platforms over crypto laundering that helps Russia evade sanctions

    ler a análise desta fonte

    On October 8, the U.K. imposed economic sanctions on Cryptomus (formerly Certa Payments and Xeltox Enterprises, rebranded as Heleket) for processing payments that benefit the Russian government and its financial institutions. The sanctions also cover the virtual payment platforms VexPay, TokenSpot and Tsunami Payments. Experts describe Cryptomus as a major conduit for payments tied to ransomware, narcotics, darknet markets, fraud and cybercrime services. The sanctions freeze Cryptomus assets at U.K. banks and bar British firms from doing business with it. Analyst Richard Sanders notes this is the first known case of a Five Eyes country sanctioning a crypto operation incorporated in another Five Eyes jurisdiction.

    Technical Details

    • Chainalysis reported that Cryptomus and Heleket received more illicit funds across tracked categories than the mixers in its dataset, with illicit counterparties surging to more than 900 in a single month in late 2025.
    • TRM Labs found in April 2026 that Cryptomus had processed more than $7 billion since 2022, including flows linked to CSAM vendors, terrorist financing and human trafficking. Volume fell after KYC rules were introduced.
    • After Canada's record CAD $176 million AML fine, Cryptomus appealed and launched Heleket as a parallel no-KYC service. Heleket's Telegram support claims it is unaffiliated with Cryptomus.
    • The company shared a Vancouver address with dozens of other currency dealers that did not appear to be physically there.
    • The parent's sole shareholder was a 25-year-old Ukrainian woman who also headed WS Management and Advisory Corporation, which presents itself as the licensing regulator for Western Sahara (crasadr.com). A former Certa site (certa[.]website) shared a server with rasd-state[.]ws, a site for the Central Reserve Authority of the Western Sahara.
    • On October 8 the Cryptomus Telegram support bot said the platform was unable to process transactions.

    Remediation

    • Financial institutions, exchanges and compliance teams should screen for and block exposure to Cryptomus, Heleket, VexPay, TokenSpot and Tsunami Payments, and monitor for rebranded successor services.
    • Treat the named entities as sanctions-relevant when assessing crypto payment flows and counterparties.