- The United Kingdom designated 38 Russia-linked entities, including Cryptomus, Heleket and TokenSpot, on Oct 8.
- Chainalysis said Cryptomus and Heleket received funds from more than 15,000 illicit actors across every tracked illicit-activity category.
- The United Kingdom’s measures include asset freezes and restrictions on trust services, internet services, correspondent banking and payment processing.
The United Kingdom designated Cryptomus, Heleket, TokenSpot and other Russia-linked entities on Oct 8 as part of a package targeting 38 entities, the United Kingdom said.
The United Kingdom said the package includes an asset freeze, trust-service restrictions, director disqualification, internet-services sanctions and correspondent-banking and payment-processing restrictions.
Chainalysis said it found that Cryptomus and Heleket received funds from more than 15,000 illicit actors across every tracked illicit-activity category. It published its report on Oct 9.
On this page
Chainalysis linked the services to illicit-actor funds
Chainalysis said Cryptomus and Heleket received more illicit-actor funds than all tracked mixers combined across several categories. “These two services received more funds from illicit actors than all tracked mixers combined across these categories,” it said.
The analysis found that funds from TokenSpot, Grinex and Meer converged on an HTX deposit address that received more than $308 million. Chainalysis described the services as funneling downstream funds into the same address.
TokenSpot transfers exceeded $950 million
TRM Labs found that TokenSpot facilitated more than $950 million in transfers to Grinex, Garantex and the A7 network. It said TokenSpot sent approximately $679.5 million to A7 and received another $48.5 million from the network.
TRM Labs also said Cryptomus received more than $204 million from Garantex before sanctions were imposed on Garantex.
The United Kingdom froze Cryptomus assets and barred British business
The United Kingdom issued economic sanctions against Cryptomus on Oct 8 for processing payments that benefit the Russian government and its financial institutions, according to Krebs on Security.
The United Kingdom also targeted VexPay, TokenSpot and the Tsunami Payments service. It said Cryptomus was previously known as Certa Payments and Xeltox Enterprises.
The United Kingdom said the designation names Cryptomus and Heleket as variations of Xeltox Enterprises Ltd., which has the unique ID RUS3755. Certa Payments Ltd. also appears as a name variation associated with Xeltox.
The United Kingdom said Xeltox supported Russia’s financial-services sector through its ownership of Cryptomus and activities “linked to and continued via” Heleket. The measures bar British companies from offering Cryptomus business and freeze its assets at U.K. banks.
FAQ
What happened to Cryptomus, Heleket and TokenSpot?
The United Kingdom designated Cryptomus, Heleket and TokenSpot as part of a package of 38 Russia-linked entities on Oct 8.
Why did the United Kingdom sanction Cryptomus?
Krebs on Security reported that the United Kingdom sanctioned Cryptomus for processing payments that benefit the Russian government and its financial institutions.
Who operates Cryptomus and Heleket?
FinanceFeeds reported that the United Kingdom designated Canadian-registered Xeltox Enterprises Ltd., with Cryptomus, Heleket and Certa Payments Ltd. appearing as name variations associated with the company.
How much money did TokenSpot transfer?
TRM Labs found that TokenSpot facilitated more than $950 million in transfers to Grinex, Garantex and the A7 network. It said TokenSpot sent approximately $679.5 million to A7 and received another $48.5 million from the network.
What restrictions apply to the designated entities?
The United Kingdom listed an asset freeze, restrictions on trust services, director disqualification, internet-services sanctions and correspondent-banking and payment-processing restrictions.
Sources
- UK Sanctions Cryptomus, Heleket, and TokenSpot for Russia Links, ChainalysisPrimary
- U.K. Sanctions Cryptomus for RU Money Laundering, United Kingdom
- UK sanctions crypto payment processors Cryptomus, Heleket, and exchange TokenSpot, Crypto Briefing
- UK Sanctions Cryptomus, Heleket and TokenSpot Over Russia Sanctions Evasion, FinanceFeeds
- Switching from Cryptomus to Heleket leaves the same UK sanctions target, CryptoSlate
- Cryptomus and Heleket Hit the UK Sanctions List: What Matters Now, CryptoTicker
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The United Kingdom issued the sanctions against Cryptomus on October 8 for processing payments that benefit the Russian government and its financial institutions. | United Kingdom | Attributed |
| United Kingdom said the sanctions freeze Cryptomus assets at U.K. banks and bar British companies from offering it business. | United Kingdom | Attributed |
| The United Kingdom also targeted VexPay, TokenSpot and Tsunami Payments in the sanctions. | United Kingdom | Attributed |
| United Kingdom said the sanctions package designated 38 Russia-linked entities, including Cryptomus, Heleket and TokenSpot. | United Kingdom, via Crypto Briefing | Attributed |
| TRM Labs found that TokenSpot facilitated more than $950 million in transfers to Grinex, Garantex and the A7 network. | TRM Labs, via Crypto Briefing | Attributed |
| TRM Labs found that Cryptomus received more than $204 million from Garantex before sanctions were imposed on Garantex. | TRM Labs, via Crypto Briefing | Attributed |
| The United Kingdom designated Xeltox Enterprises Ltd., with Cryptomus, Heleket and Certa Payments Ltd. listed as name variations. | United Kingdom, via FinanceFeeds | Attributed |
| The United Kingdom said Xeltox supported Russia’s financial-services sector through Cryptomus ownership and activities linked to and continued through Heleket. | United Kingdom, via FinanceFeeds | Attributed |
| TRM Labs said TokenSpot sent approximately $679.5 million to A7 and received another $48.5 million from the network. | TRM Labs, via FinanceFeeds | Attributed |
| United Kingdom said the U.K. designation names Cryptomus and Heleket as variations of Xeltox, which has unique ID RUS3755. | United Kingdom, via CryptoSlate | Attributed |
| United Kingdom said the designation includes an asset freeze, trust-service restrictions, director disqualification, internet-services sanctions and payment-processing restrictions. | United Kingdom, via CryptoSlate | Attributed |
| Chainalysis said Cryptomus and Heleket received funds from more than 15,000 illicit actors across every tracked illicit-activity category. | Chainalysis | Confirmed |
| Chainalysis said Cryptomus and Heleket received more illicit-actor funds than all tracked mixers combined across several categories. | Chainalysis | Confirmed |
| Chainalysis found that funds from TokenSpot, Grinex and Meer converged on an HTX deposit address that received more than $308 million. | Chainalysis | Confirmed |
| Chainalysis said the United Kingdom designated 38 entities for financing Russia’s wartime economy, supporting its military-industrial base and facilitating sanctions evasion. | Chainalysis | Attributed |
| chainalysis.com published its report on Oct 9, 2026. | chainalysis.com | Confirmed |
Could not verify
- Whether the United Kingdom’s sanctions designation has been challenged or upheld is not established
- Whether Cryptomus, Heleket or TokenSpot were being actively used to evade sanctions at the time of designation is not established
- How many customers or assets are affected by the designations is not established
- Whether the European Union has adopted the designations is not established
Related stories
Vulns & PatchesCollabora built-in CODE Server flaw exploited to plant web shells
Vulns & PatchesIvanti Connect Secure flaw exploited to run commands remotely
Vulns & PatchesIvanti Connect Secure flaw could let attackers run commands as root