UK Sanctions Cryptomus, a Crypto Platform Linked to Ransomware and Russian Money Laundering

The United Kingdom has imposed economic sanctions on Cryptomus, a cryptocurrency platform that experts describe as a major conduit for payments tied to ransomware, narcotics, darknet markets, fraud and cybercrime services. According to Krebs on Security, these payments are also helping Russia circumvent existing financial restrictions. The sanctions, issued on October 8, freeze any Cryptomus assets held at UK banks and bar British companies from doing business with it. The payment platforms VexPay, TokenSpot and Tsunami Payments were also targeted.

Cryptomus, previously known as Certa Payments and Xeltox Enterprises, has changed its name several times since emerging in 2022. Its most recent name is Heleket, adopted after Canada issued a record CAD $176 million fine against the platform for anti-money laundering violations. Krebs reports it has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites selling cybercrime services. Chainalysis said Cryptomus and Heleket received more illicit funds across tracked categories than the mixers in its dataset, with illicit counterparties surging past 900 in a single month in late 2025.

TRM Labs found Cryptomus had processed more than $7 billion in transactions since 2022, including activity linked to child sexual abuse material vendors, terrorist financing and human trafficking. On the day of the sanctions, the platform's Telegram support bot said it was suddenly unable to process transactions.