Privacy
UK Sanctions Cryptocurrency Platform Cryptomus Over Russian Money Laundering
The UK has sanctioned Cryptomus, a cryptocurrency platform accused of helping Russia bypass financial restrictions and process payments linked to cybercrime. The move freezes assets and blocks UK businesses from working with the firm.
Ross Grant3 min read
The short version
The UK has sanctioned Cryptomus, a cryptocurrency payment service, for allegedly helping Russia move money linked to cybercrime and avoid financial restrictions. These sanctions freeze its assets in the UK and stop UK businesses from working with it. Cryptomus has changed names and methods to keep operating after earlier fines. The story is based on a single report and has not been confirmed by UK authorities.
By the numbers
- $7 billionTotal transactions processed by Cryptomus since 2022Brian Krebs
- CAD $176 millionCanadian fine against Cryptomus for anti-money laundering violationsBrian Krebs
- 900+Illicit counterparties linked to Cryptomus in a single month (late 2025)Brian Krebs
What happened?
On 8 October 2026, the UK imposed sanctions on Cryptomus, a cryptocurrency platform accused of processing payments that benefit Russia and support cybercrime. The sanctions freeze Cryptomus's assets in UK banks and bar UK businesses from working with it. The move follows earlier Canadian action and targets a network of payment platforms.
What the UK Has Done
On 8 October 2026, the UK government imposed economic sanctions on Cryptomus, a cryptocurrency payment platform. These sanctions freeze any Cryptomus assets held in UK banks and ban British companies from doing business with the platform, whether online or offline. The UK also sanctioned other virtual payment services, including VexPay, TokenSpot, and Tsunami Payments, as part of a broader effort to disrupt financial networks supporting Russia. This action follows similar moves by Canada, which fined Cryptomus CAD $176 million for anti-money laundering violations in 2025, though that fine was reportedly unenforceable.Brian Krebs (opens in a new tab)
Why Cryptomus Was Targeted
Cryptomus has been described by blockchain analysis firms as a major payment processor for activities linked to ransomware, narcotics, darknet markets, fraud, and other cybercrimes. According to Chainalysis, Cryptomus and its related service Heleket received more illicit funds than any cryptocurrency mixer in their dataset, with over 900 illicit counterparties in a single month in late 2025. TRM Labs reported that Cryptomus processed more than $7 billion in transactions since its launch in 2022, including payments linked to child sexual abuse material, terrorist financing, and human trafficking. The UK’s sanctions are intended to cut off a key channel used to move money for these activities.
How Cryptomus Responded and Adapted
After Canada fined Cryptomus, the platform changed its name several times, most recently operating as Heleket. When stricter “know your customer” (KYC) rules were introduced, transaction volumes dropped, but Heleket continued to offer no-KYC payment processing. On the day the UK sanctions were announced, Cryptomus’s support bot on Telegram said it could no longer process transactions. Investigators have noted that the company has a history of changing names and launching parallel services to avoid enforcement.
The Role of Fake Institutions
Investigations suggest that Cryptomus and its parent companies have used fake financial institutions and regulatory bodies to claim legitimacy. For example, the parent company Certa Payments is linked to a supposed regulator in Western Sahara, a disputed region in northwest Africa. This regulator, the Central Reserve Authority of Western Sahara, appears to exist only online and issues licences for cryptocurrency and foreign exchange services. These tactics make it harder for authorities to track and shut down illicit financial operations.
What Happens Next
The UK’s sanctions are significant because they are the first known instance of a "Five Eyes" country (Australia, Canada, New Zealand, the UK, and the US) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction. Experts say that while fines can be ignored, sanctions make it much harder for a platform to operate, as banks and businesses are legally required to cut ties. However, there is still uncertainty about how effective these measures will be, as companies like Cryptomus have shown they can rebrand and move operations quickly. The story is based on a single report by Brian Krebs, and no official UK government statement has been published yet.
Claimed vs confirmed
- Confirmed
Cryptomus processed payments for ransomware, darknet markets, and other cybercrime.
Blockchain analysis firms Chainalysis and TRM Labs have linked Cryptomus to illicit transactions, according to Brian Krebs.
- Confirmed
Cryptomus rebranded as Heleket to avoid enforcement after Canadian fines.
Reported by Brian Krebs, citing blockchain analysts and investigators.
- Unconfirmed
The UK has officially sanctioned Cryptomus.
Only Brian Krebs has reported the sanctions; no official UK government statement is available.
The impact
- Money
- The sanctions freeze any Cryptomus assets in UK banks and block UK businesses from working with the platform. If the company is found to have violated anti-money laundering laws, UK and EU fines could reach up to £17.5 million or 4% of global turnover. Previous Canadian fines were not collected.
- Reputation
- Being sanctioned by the UK damages Cryptomus's reputation and signals to other businesses that it is considered high risk. The platform's history of rebranding may further erode trust.
- Customers
- Customers using Cryptomus or related services risk losing access to funds and may face legal scrutiny. UK businesses must ensure they do not transact with sanctioned entities to avoid penalties.
Why it matters
Sanctioning Cryptomus aims to disrupt a major channel for moving money linked to ransomware and other cybercrimes. It shows how authorities are targeting the financial infrastructure behind cybercrime, not just individual hackers. The action could make it harder for criminals to cash out or move funds, but enforcement remains challenging.
How does it work?
Cryptomus allegedly processed payments for ransomware, darknet markets, and other illicit activities by providing cryptocurrency services with minimal identity checks. After being fined in Canada, it rebranded and continued to operate through parallel services that did not require customer identification.
Key points
- UK sanctions freeze Cryptomus assets and ban UK business ties.
- Cryptomus is accused of processing payments for ransomware and other cybercrime.
- The platform has changed names and methods to avoid enforcement.
- Sanctions target the financial infrastructure behind cybercrime, not just individuals.
- The story is based on one report and has not been confirmed by UK authorities.
Sources
Brian Krebs
Reference
- U.K. Sanctions Cryptomus for RU Money Laundering (opens in a new tab)
krebsonsecurity.com
- U.K. Sanctions Cryptomus for RU Money Laundering (opens in a new tab)
