The UK sanctioned crypto payment processors Cryptomus and Heleket, plus Kyrgyzstani exchange TokenSpot, over links to Russia's sanctions evasion. Chainalysis tied the services to illicit financial flows.
The UK sanctioned crypto payment processors Cryptomus and Heleket and Kyrgyzstani exchange TokenSpot on October 8. Blockchain analytics firm Chainalysis had linked the services to illicit financial flows and networks associated with Russia's sanctions evasion.
The package also named 17 people and firms that import machine tools, electronics and material used in ballistic missiles and drones.
Chainalysis finds illicit inflows at payment processors
Chainalysis reported that Cryptomus and Heleket, both operated by Xeltox Enterprises Ltd., had received funds from more than 15,000 distinct illicit counterparties across every criminal category the firm tracks. In several categories, including scams, sanctioned jurisdictions and terrorist financing, their illicit inflows exceeded those received by all mixing services in its dataset combined.
Illicit counterparties linked to the two processors increased to more than 900 in a single month in late 2025. Chainalysis suggested the closure of Russian exchange Garantex may have contributed, as some users already held accounts with Cryptomus or Heleket. The firm also cautioned that new sanctions designations can cause historical transactions to be reclassified as illicit exposure.
Cryptomus had also advertised crypto payments and conversions without know-your-customer (KYC) or know-your-business checks on Russian-language cybercrime forum BHF and the Nulled forum, according to Chainalysis. In October 2025, Canada's financial intelligence unit imposed a CAD 177 million penalty on Cryptomus for anti-money laundering and counter-terrorist financing violations.
TokenSpot funds route to a shared HTX address
TokenSpot's connections followed a different route. Chainalysis traced funds from the exchange, alongside those from previously sanctioned exchanges Grinex and Meer, to a shared HTX deposit address that received more than $308 million.
Sources: Chainalysis, CryptoPotato
Trading involves risk.
Risk Disclaimer
