# U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform for Russian Money Laundering

> On October 8, 2026 the U.K. designated Xeltox Enterprises (operator of Cryptomus, Heleket and Certa Payments) alongside TokenSpot, Tsunami Payments and Processing KG (VexPay) for supporting the Russian financial sector and the A7 sanctions-evasion network. Cryptomus/Heleket were previously fined CAD $176.96M by Canada's FINTRAC and are assessed by Chainalysis and TRM Labs as major hubs for illicit flows.

- **Published:** 2026-10-14T14:54:38Z
- **Last reviewed:** 2026-10-14T14:54:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3514
- **ID:** TL-2026-3514
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On October 8, 2026 the U.K. FCDO announced 38 new Russia-related designations. Among them was Xeltox Enterprises Ltd (Vancouver-registered), designated through its ownership of the Cryptomus payment platform and activity 'linked to and continued via' its rebrand Heleket. Cryptomus has also operated as Certa Payments; Heleket is incorporated as Handy Elect LLC in Georgia per TRM Labs. TRM Labs reports Cryptomus processed roughly USD 7 billion between 2022 and 2025 (USD 8.2 billion total as of March 2026), including exposure to CSAM vendors, terrorist financing, human trafficking, sanctions evasion, Russian darknet markets, cybercrime service providers and ransomware-as-a-service operations.

TRM Labs documents shared infrastructure, branding, personnel, identical 0.4% processing fees, a shared privacy-focused domain registrar and common terminology between Cryptomus and Heleket. Heleket launched in January 2025, the month before Cryptomus introduced KYC (February 2025), and received initial funding from sanctioned exchange Garantex on January 16, 2025; cybercrime actors, including CSAM vendors, migrated from Cryptomus to Heleket. Heleket's 2025 illicit inflow ratio was about 0.6%, nearly five times the payment-processor average, with sanctions-related entities (primarily Garantex) making up 60% of it. TRM also counted more than 75,000 transactions with Iranian exchanges, over 50,000 with Nobitex. Chainalysis found Cryptomus and Heleket received funds from more than 15,000 illicit actors and 'more illicit funds across tracked categories than the mixers in our dataset'; the services were advertised on criminal forums (BHF, Nulled) as anonymous and KYC-free. Illicit sources include proceeds of the Bybit exploit (Lazarus Group), Black Basta ransomware and bulletproof-hosting vendors (Zservers, Stark Industries, First VPN, Aeza Group).

The same package designated TokenSpot CJSC and Tsunami Payments LLC (both in Tower B, 125/1 Toktogul Street, Bishkek) and OJSC Processing KG, operator of VexPay (parent: Kyrgyz Ministry of Finance) and its director Ulan Bukabaev. TokenSpot is assessed as a front for sanctioned exchange Grinex; its TRON addresses handled USD 3.54 billion received and 3.14 billion sent between Dec 2023 and Sept 2026, with large flows with the A7 network (the ruble-backed A7A5 stablecoin ecosystem). Two of the designated entities processed transactions with A7. Designation grounds: supporting the Russian financial services sector, facilitating A7 transactions, circumventing sanctions, and business of economic significance to the Russian government.

Prior regulatory action: on October 16, 2025 FINTRAC fined Xeltox Enterprises CAD $176,960,190 for failing to report suspicious transactions involving CSAM trafficking, fraud, ransomware payments and sanctions evasion; KrebsOnSecurity and analyst Richard Sanders documented 122 cybercrime services using Cryptomus and a Vancouver address listed by dozens of non-operating money service businesses. KrebsOnSecurity also reports that a sole shareholder of Certa Payments' parent is a 25-year-old Ukrainian woman and that fake 'Western Sahara' regulator domains were used to lend licensing credibility. Defenders should screen all brand names (Cryptomus, Heleket, Certa Payments, Xeltox), treat TokenSpot and Grinex addresses equivalently, and watch for successor platforms sharing infrastructure or liquidity. There is no CVE or exploit; severity is an analyst assessment of financial-crime and sanctions-compliance relevance.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1585 Establish Accounts
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [U.K. Sanctions Cryptomus for RU Money Laundering (KrebsOnSecurity)](https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/)
- [U.K. Sanctions Notice: Russia, 8 October 2026](https://assets.publishing.service.gov.uk/media/6ac767c6e8ef5609e7c93369/Sanctions_Notice__Russia__8_October_2026.pdf)
- [Chainalysis: UK Sanctions Cryptomus, Heleket, TokenSpot](https://www.chainalysis.com/blog/uk-sanctions-cryptomus-heleket-tokenspot/)
- [TRM Labs: UK Sanctions Cryptomus, Heleket, and TokenSpot in New Russia Package](https://www.trmlabs.com/resources/blog/uk-sanctions-cryptomus-heleket-and-tokenspot-in-new-russia-package-targeting-crypto-and-payment-channels)
- [TRM Labs Intel Library: Cryptomus](https://www.trmlabs.com/resources/intel-library/cryptomus)
- [Canada Fines Cybercrime-Friendly Cryptomus $176M (KrebsOnSecurity)](https://krebsonsecurity.com/2025/10/canada-fines-cybercrime-friendly-cryptomus-176m/)
- [How Cryptocurrency Turns to Cash in Russian Banks (KrebsOnSecurity)](https://krebsonsecurity.com/2024/12/how-cryptocurrency-turns-to-cash-in-russian-banks/)
- [Decrypt: UK Targets Cryptomus and TokenSpot in New Russia Sanctions Package](https://decrypt.co/380568/uk-targets-cryptomus-and-tokenspot-in-new-russia-sanctions-package)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3514